{ "Event": { "published": true, "date": "2026-05-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-03", "timestamp": 1777852981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "139711bf-c582-4a9e-8030-946edbcaf516", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7766ab-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777794431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794431, "uuid": "18de3a55-74b0-4338-a1db-ef418c71ff27", "comment": "Malware payload (Mirai)", "value": "f852f44cf90f8b00c1b78fc4a1fd1597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794431, "uuid": "0fe26936-58fa-42e7-aa75-acd25f2daa07", "comment": "Malware payload (Mirai)", "value": "00044a61791fdb2feb278f38ab364ae5126f4e78bb6596c21de9edf7f3e90236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794431, "uuid": "85a3f053-8430-40e1-b743-e8676f880591", "comment": "Malware payload (Mirai)", "value": "1e8238ed49b1715ea3469bc86bae815778863200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794431, "uuid": "aed0e1a4-5af4-47a2-a391-ed3a61569e41", "comment": "Malware payload (Mirai)", "value": "6cd54a9e6d83202a3d61580201b008d2545404c334a53250e9c7d4e4c29a5a53ead2e9cc7047148857677f7201c5685a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794431, "uuid": "7d7516c6-773e-4319-a0c0-2fed7bf6a61d", "value": "T10F046186AFA03FFFC85ECC3241A5DB0A12DC595913A4BFB61A74D514B68B10E99C3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794431, "uuid": "eb01addc-ffeb-4f6e-b27a-3f4c320215ea", "value": "1536:e6FAoYOUtDKJKEvZfG84pTnLP3EjPljsIImRJBLbDr+ntgt6xqPMElN3YvncQZr2:nFA7OURKJK6Zu84pjx4JotZHncM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794431, "uuid": "08bb779b-3eda-413b-90ca-58121cc01f94", "value": 176396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794431, "uuid": "57e28b3a-f297-473a-93ef-3373c92c6b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794431, "uuid": "a7f5be3d-f51c-4b46-98f3-256a245d3a5b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60c8e21-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777808005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808005, "uuid": "c321e4f0-58a5-4845-a0c6-7bc1192d0a21", "comment": "Malware payload (Mirai)", "value": "63925f4f39fa21b8f1cd9bdc6afa2994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808005, "uuid": "b803f6cc-932c-473f-b49a-4c3d79e03b1c", "comment": "Malware payload (Mirai)", "value": "00b160f184f5967e95f626f70ccb5db66be177fdeb0e4f462a461c12150ce31e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808005, "uuid": "2ff6b977-59f0-496f-9033-9c8444c64f3f", "comment": "Malware payload (Mirai)", "value": "a7d0ac2dac8d165d6ac88c078daa3f7f804f5522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808005, "uuid": "496ff959-b93d-424b-acf0-fbab6c4820fd", "comment": "Malware payload (Mirai)", "value": "3ede2a1d90aa46cea8a7dab9e5b2e7d22ac0df13fb63d36bb349b874dd34baee80eb7ee4533a85529794285c20eba0ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808005, "uuid": "7011cc1d-b828-4c47-9b0a-50c1c4e00cd8", "value": "T12783E942BD429F13C1C221F6FBAF059837266B79D6EB3242D931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808005, "uuid": "24557c9e-f60f-4d74-b9c5-39e8d7318c3d", "value": "1536:PKDLhQ3BlLywjmConIxqPONb6uKBJw3Q2LKvDHytGwoUi+j0AnWPfG7a:PKDqXjmConIxq2B6uKeL4DHyOAWm7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777808005, "uuid": "14e88934-6d52-488a-acdb-402f1c4c978e", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777808005, "uuid": "85e29494-dd35-41a0-9501-339be321a9b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808005, "uuid": "5a006e78-1be7-4954-872d-c22253a5e3bc", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b67ddba-46b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777787935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777787935, "uuid": "21ea3537-ef48-4479-b5f9-244db7dbed57", "comment": "Malware payload", "value": "b1c9653eb8ea28ede0c3bd01cb808631", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777787935, "uuid": "43853be3-3361-4a77-96cc-bda299fbb73d", "comment": "Malware payload", "value": "05a1e8ffe563c4624da00920fddeaa4139ca9c93d2c9ac373393c6f000922d92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777787935, "uuid": "98a1875c-d57e-4f03-8dca-64e8fcf954b8", "comment": "Malware payload", "value": "b2baa5f5a69a6479fffc862f8749c2150dbe5150", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777787935, "uuid": "0b127d1a-06c6-4ff1-9536-1ca8e84235b3", "comment": "Malware payload", "value": "eccc9c2c14478d41d538a88416fdc17dfa012686ef2fd81c5ef9683c4b9a1b47d35dd902516281e9846bf356a73bc12f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777787935, "uuid": "6207babf-3142-4bf4-b4f3-8665041fc502", "value": "T1F4136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777787935, "uuid": "ae15458b-1dbe-4c16-89e7-d9eae7db815a", "value": "768:bxXRWNGxVu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bLlxlcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777787935, "uuid": "0e26821b-24fc-4073-b561-0a22ab9ee35b", "value": 45437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777787935, "uuid": "9a2f9f7a-e9dc-4599-a3c8-8c801bec59c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777787935, "uuid": "a72b0a92-d12c-4ffe-b68f-5a560ed72129", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6d2250-4736-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777843666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843666, "uuid": "20feb462-212c-4de4-ac11-5aebc21d0a7f", "comment": "Malware payload (Mirai)", "value": "7d843770c76d2e22e1ba3698496c796f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843666, "uuid": "78b28167-e0c8-43cf-8663-57256aaba39e", "comment": "Malware payload (Mirai)", "value": "07ad4a7004cf5c71575d2181312f21742009cd34ae11272ce9a6f9eb9a8455ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843666, "uuid": "84a2f0df-61cb-4268-b01b-8f338539538c", "comment": "Malware payload (Mirai)", "value": "cad083245865d2ea88e6dc1c1a372a177e8881d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843666, "uuid": "d34c4511-6369-480e-a99a-34f9f74cf9b6", "comment": "Malware payload (Mirai)", "value": "b4dfb75b1faf0c19a6727c81cfdf0529a070b03826500ab0ed8c7298f2cbfdac6aac039fa9a2ca79a4abdcfc87555c92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843666, "uuid": "e6aafcc4-b84b-414f-b114-13b8f971163a", "value": "T130343C45EA414A13C4D117BAF9AF428A3332A795D3DB7306D9246FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843666, "uuid": "62fcd2ac-c31b-4856-ba6d-fee7c5b63c63", "value": "6144:yjCiZsR3wLScaFskxWjKwRe9krgbMiMM/9oUexT:yDa30ScaFskxWjBY4CN/Czd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777843666, "uuid": "763085dd-ab89-490c-a143-3a0fa6bdfb70", "value": 230868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777843666, "uuid": "14de334f-e6c0-4b2a-80c3-48270b2c1b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843666, "uuid": "cd3fe05a-8772-430c-81da-ad71325afaf6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3193872c-4737-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777843780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843780, "uuid": "f33b20f2-d35f-41e5-a059-f23853493390", "comment": "Malware payload (Mirai)", "value": "711ed353ee63280b555e3c6eb0b2af9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843780, "uuid": "4af9b780-fc6b-424b-bcf9-926fd4a3cb96", "comment": "Malware payload (Mirai)", "value": "07d0069bd8fd7f97a4d0dc452d402309e2cc84d9bb30ffeeea8b8f8442af8e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843780, "uuid": "e8de4e93-f1a4-4ce4-a806-c39d0d292e25", "comment": "Malware payload (Mirai)", "value": "002b1d478a1c2b7100f75067f16f5390584a22f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843780, "uuid": "0e21d8e8-7a83-43b4-8397-899850c57699", "comment": "Malware payload (Mirai)", "value": "0a13622ad02440874beaf68017fb487484010f9f5559361f61f8136a4446e269b11dda847eb4c38348995cdf8b7cc01b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843780, "uuid": "0fc75b80-c019-4baf-8c51-7f71fabc7364", "value": "T19593E651BC82562BC5E423BAF67E668D33A577E4C2DF722BC8214B14BB8550F0D63B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843780, "uuid": "5366ac9b-443c-469a-9448-a105ee138575", "value": "1536:Nnd+RS/fk8Tq/hCaNV+A4yOeCLiEslKwczHMWLLRvAHLBvt:Nd+RSk8TMVGVhw6LRvk1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777843780, "uuid": "88bd3c45-3030-4e1e-91d3-0e2b9503e668", "value": 93756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777843780, "uuid": "8b3acba7-d6db-4453-b261-ca82ef18d1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843780, "uuid": "42febdd7-68f7-4719-bf06-08a76bc366f8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7900b4e7-468b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777770026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777770026, "uuid": "b7581f7a-b593-44e7-b39c-03f328fa3f40", "comment": "Malware payload (Mirai)", "value": "620cabbe0fee903c607192fafc344e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777770026, "uuid": "ef3cbece-2b50-4677-a2c9-360b39aabd85", "comment": "Malware payload (Mirai)", "value": "0987991d860655717aef3d796c313ec026a1657ca6ba2a541cf60c505bfa68b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777770026, "uuid": "66b5d1dc-d736-45c2-9353-d873fa30ed1e", "comment": "Malware payload (Mirai)", "value": "8456047b282e149b66242b0d1bd8e2c31572fb2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777770026, "uuid": "c31af08b-a270-4390-87e8-ef760cb0c6b6", "comment": "Malware payload (Mirai)", "value": "0bec03837d9dd23a31cbea76e76d3dd0064b0fd77362fdaf93c359fcdd822269d46da5047ec79dc806ca68db71a729c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777770026, "uuid": "523e7dd4-f82e-4f68-a1e7-1b20b6bdc9f4", "value": "T1C4C32802F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777770026, "uuid": "b1fabf6e-bb71-4310-973a-bfa5955faa3b", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7Bu76obozQPAdojgaR/1:eH3TghM/1weZbcnITeyosFAIxnJdhgJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777770026, "uuid": "18baeb24-38a5-4fb4-829c-7d9a81a1d6d6", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777770026, "uuid": "0cb06a11-e46d-4e7c-9d5e-1dd49d014ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777770026, "uuid": "09619dc1-0cfe-48a7-b6e3-65b2afbe58d4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dbc9ab-471b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777831787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831787, "uuid": "eb97c69d-919c-4934-b40c-4c3212a5b6e8", "comment": "Malware payload (Mirai)", "value": "6a2927972f708852ffa7ad8b08f1a2b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831787, "uuid": "28cb887c-4f25-4c7b-8946-ece7ce594ef3", "comment": "Malware payload (Mirai)", "value": "0a56697b0b6927c7a642c1c1068ae211694491ab732e825fe60f7f1d509a2902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831787, "uuid": "da18c1e1-d473-404b-815e-d208c6ff093f", "comment": "Malware payload (Mirai)", "value": "79629c7893342e2d93452495446aac8d76cfce74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831787, "uuid": "11cd1d99-aabb-47b9-8474-c8827c49e060", "comment": "Malware payload (Mirai)", "value": "842b318e01a9ce669eb594ef03b0763ebf6f01a4f099150cb058347471716b3876f9c69e5c2e225a16eac201a24860e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831787, "uuid": "0cd7d4a1-a357-4a83-b8c6-cffd49410862", "value": "T1ADF33ACBF800DEBDF80FE73A44130905B630B7D111925B376267797BAC7A1991927E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831787, "uuid": "08816c4f-315c-4920-8364-6eb90ff8618e", "value": "3072:owQcS8WBSZ6G2/Cw5lrKSYOGogttV2jbiVLIkEycGu29ou:o6S995l+SFhgtRLZEycC9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777831787, "uuid": "bf566f1d-244b-4acd-a490-54689cc848bb", "value": 168128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777831787, "uuid": "7f14a929-f9cd-4e49-9fce-e0b97f55bdd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831787, "uuid": "101a9554-0b0a-42c7-be38-8ae867e9ab15", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe964be-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818330, "uuid": "8e17db54-2ab5-48e8-a5c7-407dfb6d2b64", "comment": "Malware payload (Mirai)", "value": "b82887f9bee6a0b8da785694869ea385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818330, "uuid": "7d2ebeef-6824-47f0-877b-0707a377b0cd", "comment": "Malware payload (Mirai)", "value": "0a858cdb538c785c97631057073ebd5f65ec08e193cdd2ab3b2d97a875b216cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818330, "uuid": "b72fc0d4-68dc-41e6-a2ab-75a598221ea3", "comment": "Malware payload (Mirai)", "value": "28d0e7f1c8c63b1f508c01f188f1afe3cdf4ccb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818330, "uuid": "6764af29-39cb-4c5d-8462-e201f402dc61", "comment": "Malware payload (Mirai)", "value": "ef9ccfc35728f801b926a9a8de5801d5482caa8fa83b90a72d2997b159778fc38f7d81ae9750735abd06dbdd8d63c760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818330, "uuid": "736b7f32-c838-40d9-897d-3109445899e6", "value": "T13C13F191D0E74E05B5A69136BEFF3E451995EA33C8CCC5D29A8931E6F6A4B1C3C28370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818330, "uuid": "e6797d77-f593-4a59-a2fb-08ee45a92b14", "value": "768:OZOwDlOiGIe6Wpod1CZgfLI3Ml9BsbK7xKKXBBXauVvr4z1w6RDRLkmxjcEBnbcw:C6nX6Wpod1CS03499KGXxSz13RDR4mdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818330, "uuid": "10181f23-cddd-481a-9c78-277636e329be", "value": 42572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818330, "uuid": "9caa1944-c091-4638-966a-19b1f5baf8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818330, "uuid": "b1aebb90-7312-478e-98b8-22075b0de9f3", "value": "runningaway.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb01f59-4690-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777772103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777772103, "uuid": "2c0de9d7-bbc3-4c2d-83fe-b6189eb6a31b", "comment": "Malware payload", "value": "6aa3dc07f8d4903b2b212d6c36f5069c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777772103, "uuid": "3243d970-b4e6-4d56-af33-4c13d7f33b21", "comment": "Malware payload", "value": "0c1a1089088abe1cf324303abba3935679fcf2aa01d36bfff7ed36e25e86089b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777772103, "uuid": "2d2c89ae-5f7a-48c4-bb24-0747b3d7015c", "comment": "Malware payload", "value": "348bfa49cf87b4d80fe21f3d9ae2e9092032691d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777772103, "uuid": "c69f616b-5a90-48f3-9128-09dfe28d13ed", "comment": "Malware payload", "value": "1697d227a3089154d21c5aaf582e89371a6cf71632f6d49580c3560657d99c5b7c2ad4079e1fa227403051f63d9e177b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777772103, "uuid": "a5ed660a-a402-48e6-b3d0-292d1ed78891", "value": "T195464B0AFEE204F8C295A6308CEA37427F71F45D4B2527D32991A2713E27BE04DB575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777772103, "uuid": "72bf3a4c-43be-465b-929c-78f74684fb42", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777772103, "uuid": "f7131a0a-3f2f-45f3-9f84-00661427d9ab", "value": "24576:SZEQkorRhovqJswksUqARNxiAXOCw3g8ot4iVU5QaM2YK1aDlpe4nhele5nK23cT:SZJkkRoqJsaARHi4OCAgkicRDaBpXdoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777772103, "uuid": "f3cb6446-ed03-46a5-97c8-646bd6dfe0ec", "value": 5679832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777772103, "uuid": "d920546e-393f-4b89-91df-9fb6f8794528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777772103, "uuid": "bbfff4ba-7551-40a0-b379-068db88b8a35", "value": "Activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c07e1cc-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818377, "uuid": "36ae5aff-59e5-456a-ab0f-78611e563d6d", "comment": "Malware payload (Mirai)", "value": "7dd1406eaa7324c3fa84b7acc61bf883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818377, "uuid": "c2df6d8c-f4b3-4e8d-8fc7-63ba7712ccd1", "comment": "Malware payload (Mirai)", "value": "0eb355e200b370ed0261d543908ec6206e88ff2f81e3fbc1ac118b40e7356204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818377, "uuid": "45274ab5-43aa-4995-8cda-038c8afe4db3", "comment": "Malware payload (Mirai)", "value": "7a2fb4ebe3b18b58b70e277247caaa2655087f67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818377, "uuid": "9945b1fc-3cc3-4269-95ed-78fa49211a34", "comment": "Malware payload (Mirai)", "value": "813b4ec29c35f83704d32aa7380a3ddb17e2f8bb2502b11600a97eb6cb022c7389714f4c94511671379f923fb710e920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818377, "uuid": "850167a0-53b7-479f-8f86-456043f7bfe4", "value": "T1EE934A45FC919A52C6D4237BFB2E228E332663A8E2DE3207DE155F21338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818377, "uuid": "fed76205-164a-42f5-a8cd-53faf833ac82", "value": "1536:2W64f8x+rcJRPDAd7YedKOQeVkWP9cszCSgPUpi8kF5vBPq:2W64fQHRMZjKOZP9cs3x+Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818377, "uuid": "436a0c02-66ef-41ed-ae27-80b626485918", "value": 97056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818377, "uuid": "2d78ee40-7d0c-4111-808e-0634e18b154c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818377, "uuid": "d16e34e7-0e74-4560-abd3-eae2792efe7f", "value": "runningaway.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1b73e6-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818457, "uuid": "cf55d739-db94-42ba-9ce1-a426788963e9", "comment": "Malware payload (Mirai)", "value": "f54ea9652c3847b685018760563a1df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818457, "uuid": "62ba74b9-c48f-4dc4-9931-aacd940f893d", "comment": "Malware payload (Mirai)", "value": "0eed41a6d3f5f77f1bdf1a9a51d13d9a892e76b1cbb5c97cb7981632f65cdb8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818457, "uuid": "78dc1b8f-b77d-4bd1-9562-f686fff1a2b4", "comment": "Malware payload (Mirai)", "value": "cce42fa51a1367cd890a99bdafb2502a28ce06d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818457, "uuid": "a7c5cb69-692c-4f88-963f-96abf7d533cd", "comment": "Malware payload (Mirai)", "value": "2ae8575d08f5b557e5e67bf8500add4c82ff3ca3c3b72f1e661b33e85252bba52333fcc10151ad08ec823f6ca6063c2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818457, "uuid": "40ed8b6a-2378-4cd7-a76f-f4fa4540e0d1", "value": "T16E13F2B7E27BEDF8C49729FB2E521B40ED153C18694D07255CFE33DAC5142986D29E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818457, "uuid": "0dcbff7c-8955-49ff-a324-b2d9bf0938dc", "value": "768:/kVefVkh6cgPErrEoHL7+ZXYggpkyo8Z6i2dOFb1tqM0x0Yx:/kVeUsErrEoO1Ygg+b8Z6i2Y1tqBxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818457, "uuid": "abe4c42f-d721-4181-825f-5b3c98b79ea8", "value": 43012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818457, "uuid": "a7f9935e-aafd-472a-8a31-8674bfa643b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818457, "uuid": "7879a343-29e7-4397-8a97-0ba3f933bc09", "value": "runningaway.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1772e0-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818322, "uuid": "8e2b81d0-7eef-49d3-9c34-3ae7fa2fdff8", "comment": "Malware payload (Mirai)", "value": "47b4c1e5665e5c2232b3bf182193d6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818322, "uuid": "453c8cb5-3879-4542-af86-fe5cda778d83", "comment": "Malware payload (Mirai)", "value": "10695fc02fb7ed9d92802952c0af862d94b4fe4589f7ace5df7af2ba36ca3635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818322, "uuid": "40123c0b-8f10-4839-a2c9-0de01ba19b6a", "comment": "Malware payload (Mirai)", "value": "a17b5bc638a9076842261e2a6ac43c9dd5ec5fa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818322, "uuid": "8e09da62-96c9-4422-bad4-b39a2266554c", "comment": "Malware payload (Mirai)", "value": "91c97c70b6ff5f613cdf9df6c9fa6612d3dcab9cfc43e7fd398483b62e598ee379486368807ca4588174b5e759bcd3a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818322, "uuid": "bbda723d-6a12-4da7-8fda-f9f81cffdffc", "value": "T1CD03F172D8A04F05E23C0936A9DE3B4F24E54E0E9964C533A4E4BD7E78E7D79281C1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818322, "uuid": "4aef903f-8863-46ef-8dd4-865fc8473eec", "value": "768:vGJo8F+g853uMgm8Lkqc/GgEd3LmcjQDO9QLJHnfMCctPnbcuyD7UHQRjq:vGJWYLs2pLlGOmnfqnouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818322, "uuid": "e786dabd-d2fd-448d-b58b-2357b802413b", "value": 40668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818322, "uuid": "1753a4d5-ecfe-42d5-8592-fe469dd6e11d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818322, "uuid": "89a93a48-b94d-43f9-a767-1a14c484c38f", "value": "runningaway.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8706f7b0-4744-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777849507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777849507, "uuid": "1be9eaa4-e52e-4cf9-bc21-1acd96b89b17", "comment": "Malware payload", "value": "70b1c1334f224b7a5323386b3a731240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777849507, "uuid": "f0349524-e1d0-4b13-8546-f33941f6bb27", "comment": "Malware payload", "value": "1222a3e5b6d739d944df36ae12d187d0e3b3f35fdb54975669f5609873094e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777849507, "uuid": "a9a17028-ff9a-45ea-a023-d0ab00352fa1", "comment": "Malware payload", "value": "3187e700ffdbd8a3701da30ffa13ec7e383cc5e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777849507, "uuid": "4c94f8ec-3774-4b67-b76d-395840dffc45", "comment": "Malware payload", "value": "b7ec259e3ad9758ca4786c4692ac63f6f853c25ba73343a2c086bb8d6d52460b667266f6481767d92d0d513d821a1d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777849507, "uuid": "a23acd47-6aae-42c4-9792-22720c0b63dd", "value": "T1C77733E6DA330C99CA53533FF9865EBA31B078E8016C8B9A747830306256ED3ED15B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777849507, "uuid": "7b730ae3-30f0-4db5-958c-361b511f3a14", "value": "8085ab79c9d31d1a8728fccbe61a0f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777849507, "uuid": "38d0b580-514f-47c5-929f-b0f73c790f9c", "value": "786432:OAAacXagNSvJJiLydIKEzy6xhFpdkpLqC6FfP42Ui1j1gv22RfaI:aDagNQJL6tjxhFpdkFqdFfP4bcCvlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777849507, "uuid": "da00f305-718b-4ec7-a228-a07096ad5308", "value": 33595392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777849507, "uuid": "6d670bf9-e815-4ac0-838d-0ee088288552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777849507, "uuid": "0072cbe2-e367-4461-8966-04c353e776f4", "value": "Zetox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd6f794-470b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777825010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825010, "uuid": "f559a0b6-4dce-47a7-8ba6-1060a129e30d", "comment": "Malware payload", "value": "2afc014ecf72f3228fb9e84b015e7ec3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825010, "uuid": "c3a24956-fd47-4a38-a732-dbcbad3ec31f", "comment": "Malware payload", "value": "15ce0b09a2d4275047bf7d9b3a6904d02534fde30a33b9fe04f140d5da616d77", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825010, "uuid": "42dae058-68be-453e-b0c0-0b2355d415b2", "comment": "Malware payload", "value": "2cef3106556e87fab25e5aa517b20b6441437307", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825010, "uuid": "00226f1d-7b43-49b9-abc2-82ba2c3320e4", "comment": "Malware payload", "value": "e6111ee4ba9e8fad83ff71bd6830183e007c54850f64725c2fcc3dd51f2e20994fd8db4f5c9ebe411b6cedb47f6d26fc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825010, "uuid": "371fc967-8853-4bf5-8bc5-868a630dea13", "value": "T102955A0B7CD105EDC496AB3298F662817775B8090B3533E36EA1AE783E72BD05DB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825010, "uuid": "756dec32-d0e5-4fc0-a4d1-de6a670d0b54", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825010, "uuid": "10fd137f-698a-45fb-8d86-eb3b8fc68e0a", "value": "49152:fk58VAWesTiUkw0uzxxueYPxxLDfeOBfbc:fsd6iUkwjxxuPP/LDW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825010, "uuid": "ff23d0b0-cfc5-4f04-b651-a9af64f71024", "value": 2018520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825010, "uuid": "e805c99c-2ad6-4328-80f9-0d1da3c2d5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825010, "uuid": "203228e1-bb56-4162-9247-9810c1bd265c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e3cdb9-46e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777809124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809124, "uuid": "3e3f9bb9-bde0-4ae5-b1b1-ce6dcbd01e36", "comment": "Malware payload", "value": "d08c8e556bdfeadf4ffb1a55258b2f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809124, "uuid": "6d699031-a82b-4641-bc3d-9a824a1f0443", "comment": "Malware payload", "value": "1777ccb9e0b58756c65ab09fe05aa581fb1f93a268bdad9fd5cd690b72ca7095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809124, "uuid": "a9152903-fde3-4db0-b628-fbd4271e4e08", "comment": "Malware payload", "value": "6cdca4c9ca0ed65423b285b4786e4ba452e93c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809124, "uuid": "d8d43341-c08e-46a4-9016-9eaf7570cb9d", "comment": "Malware payload", "value": "c53c0010fd61bad4b260326ab73757942db35c8d89caa02d820625a04c54398a4407d89fe8687b72b794f837069c684d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809124, "uuid": "9cbf8a28-864b-411c-bbc3-2cee4b2e2373", "value": "T10CA30A96F8A28B56C4C557B7FB4FC75637231795E3DF36038A184E34278B50A8E3AA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809124, "uuid": "23b21d24-a6fa-408a-ab40-ebd6b3c6fb64", "value": "3072:9LOuh02xHCKQnqZ9YfMXKgyLlOZSyPjYN5:FOuhPHCKsqZ9YfM6g2wZJLYN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809124, "uuid": "d3d2e27f-cbf9-465c-bcdd-89fbaf3562d5", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809124, "uuid": "e5721714-300c-4fe2-9931-8121611dbe2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809124, "uuid": "f938232e-28cb-4e28-8336-a098a977567d", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496870c8-470a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777824493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824493, "uuid": "37abce8c-a486-4e7c-be87-7167ee6d1ab5", "comment": "Malware payload (ConnectWise)", "value": "2aa89c4feae3c1ef4188f09b79590ff4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824493, "uuid": "241d30d9-29cd-4936-a3ea-dd06053775f4", "comment": "Malware payload (ConnectWise)", "value": "177e2b8b1471421f6e44e762b95b4f7c1ef9c4775ee041b49053a4ad647a9b1e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824493, "uuid": "04812ba7-3108-4032-a275-caccc829df4a", "comment": "Malware payload (ConnectWise)", "value": "d1b25a590a83488bea8f8d8519abf65e407cfefa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824493, "uuid": "f22a6326-78d2-4b29-a5e0-353c26d50cf4", "comment": "Malware payload (ConnectWise)", "value": "56cc05b484e12b856da9dfeaf56bcef9052af862d927be3b5fdf575bd10705211d6b47a7598fe6d2d6c54ba30f1e2167", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824493, "uuid": "f5cb0349-c8b5-4d3a-94ce-aa755aa3f419", "value": "T1B1646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824493, "uuid": "248aec6b-6151-46c5-88ff-7879eed825c1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824493, "uuid": "1ea36b8f-29ae-4f46-a2d1-87b3e47e8884", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824493, "uuid": "fe6009af-eaba-497d-8a92-6d9c4de6e166", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824493, "uuid": "c12172cf-9da4-4000-9b38-d5f40643214f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824493, "uuid": "9e639cc7-0a4a-4256-82cc-2d268519d5d8", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43925537-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777823624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823624, "uuid": "310c2495-4595-40d1-8da2-683e0a99cffd", "comment": "Malware payload (LummaStealer)", "value": "061c80c34679b0f33dd9dcbda51dab1e", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823624, "uuid": "93a8fa57-7fa5-48d0-810b-a9f1858a6f2b", "comment": "Malware payload (LummaStealer)", "value": "17e49f8440a4d9c2908e3fc09fedf838069fd185ade384365bc0c3a101a0894e", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823624, "uuid": "f9812c4c-73f9-4c10-a507-00d39e6c4e30", "comment": "Malware payload (LummaStealer)", "value": "7f28638027e627879f27ab0dcac78e641447ac69", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823624, "uuid": "060021d8-ec37-4537-bc8f-6ab0b9c8b772", "comment": "Malware payload (LummaStealer)", "value": "c34e50a6a8263e731bb843806e86b56d77f5d33e00fcdf8db278995130d60a7c1d12c08436df2e2f76e0c1ca68287fec", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823624, "uuid": "5c1f08a3-6fd4-483b-ae9f-ceb1178a8af5", "value": "T108A67B41F98795F5EA03193155A7B32FA730AC028F36DBE7EB503B29F8B72910936245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823624, "uuid": "28a32626-5c46-4183-8f1b-0ea04985c17a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823624, "uuid": "f5bb93f8-ab68-4fb9-91cf-257e72e0a5a2", "value": "98304:pq8CVOtn9f4qOlbwglImoy4jjREE8hmJkr9ccfs7J3o8GcWuHTGTcl/eBGLW:x59abwzmBU9z85ElJG+Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823624, "uuid": "420a4d60-83ec-4bae-a812-5d394b5fc4cc", "value": 10378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823624, "uuid": "743a9e7b-cf8b-4fa2-a18e-0322c82672e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823624, "uuid": "f3a9a313-8a28-4f6a-9b88-22e28a830700", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4c86fb-4715-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829168, "uuid": "ef7ebcb3-13f6-4ce6-b8c5-3b2e62e3a311", "comment": "Malware payload (Mirai)", "value": "5b41b1a782e928f231ff6e78dd7d7211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829168, "uuid": "485cd91d-5b2d-4888-a1b6-9aa44cf10693", "comment": "Malware payload (Mirai)", "value": "17eb009edc82ee046b01a99bdd35021221b71dcf5478415fb20532f4be0d91bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829168, "uuid": "4221a943-29d2-447a-a5f2-97ee9c4c410c", "comment": "Malware payload (Mirai)", "value": "c491a2268316edff1bb1b852cccd7a523205d9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829168, "uuid": "67a12461-9426-4706-bab8-77fd38cd679d", "comment": "Malware payload (Mirai)", "value": "d41af474796fc1f4ecfb088070d64f0061b34f79b1fb5781ab566bf91e46f79b103bde0ee1b654a94872d01c87803e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829168, "uuid": "d837d2a7-e895-4cff-aeac-4af963764267", "value": "T153335B31B6712A1BC5C9687A26F74B24B2B5028D74E8CB1EBD720E1EFF149D0152B2B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829168, "uuid": "fb64f813-efd6-4650-a449-ae64b08b6ec8", "value": "768:DAq7W393xaF2ePfuGOrNWVZJe7X+YgvMN67QOQiQJAO+eKf36VE/o:8Ym9cFTPfuGONe/EOYtN6MO1QJKePEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829168, "uuid": "3525ad48-734f-48e0-945e-01220e127b9a", "value": 54860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829168, "uuid": "e9549912-d3bc-42c3-9cd5-c8ced009de78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829168, "uuid": "4c47a003-ec9e-4f61-ad07-f69b4034b66b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1fc1b3-470a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777824687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824687, "uuid": "0742d856-25b5-4566-8eb5-e7cae66409c6", "comment": "Malware payload", "value": "43949f2de3c160b7135a11d4d292b8b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824687, "uuid": "6bf8773f-5722-4166-acf4-ea3320edc400", "comment": "Malware payload", "value": "1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824687, "uuid": "42a6f5ef-7600-4855-9b99-985402a3213e", "comment": "Malware payload", "value": "d1346c0bca958e3c225a7653f09cee36d840285a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824687, "uuid": "92861b81-731b-4b86-b3ee-79fcb8330f8e", "comment": "Malware payload", "value": "43801ea6d75a20c91217c9397bafbdaee11e97a125e65bbcc39b6237b56413d977259a8a48e10b67fcba7b1df6205197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824687, "uuid": "4d2967b3-ed93-4cff-af25-7770d319f7b1", "value": "T137D633F46AC93974F2EB4B3D73624FE9C9A62725342E02B8E0E4435D8BD7A8D45DC850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824687, "uuid": "69b030f1-1e6d-46cd-b23d-f692ec9058c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824687, "uuid": "c97abf6d-577d-4ee4-ad8f-75b74e13fc6a", "value": "196608:GW4NDHH+SJcOpbN5oKesKFewST06Ov5qMoHp9ZHBgdMMwHdzS5sUUTLxD:nsDnFpbHieTo5tolhgdMMwHM5srR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824687, "uuid": "abdf773f-476e-4005-8a6a-d324e199524e", "value": 12727808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824687, "uuid": "6ef4d98e-fb8f-484a-b51c-d0aaed92fc2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824687, "uuid": "a96772b9-470a-437c-8915-b6c080b5b2c8", "value": "XBinderOutput2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f28b602-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818382, "uuid": "6024699f-8c95-4ad9-8e18-c897960c56f3", "comment": "Malware payload (Mirai)", "value": "06a0f85b309ae55955dd0e1ba86d7e62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818382, "uuid": "098bd820-d8b9-4b5f-af69-be84610de6c7", "comment": "Malware payload (Mirai)", "value": "1903a3ba9d0f37a96a25449bdc2734263690773c57a6523d55ceeb39bc63234e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818382, "uuid": "ac0affd2-1b4a-4c1a-93ed-f75c8c01e614", "comment": "Malware payload (Mirai)", "value": "e2a2ef1b3d49bcd7c81c9fbdf2466d887deb74a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818382, "uuid": "4451af3e-ba99-46c6-ba4c-c6babf343ec0", "comment": "Malware payload (Mirai)", "value": "0dd6fbf78ad9ea449aee347845f5bae63f1f033d5f359376a0a1f649819a47778a9dde9884f138683eae714e3525be06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818382, "uuid": "785bba34-8da3-45d7-a2bb-a0b801fa0745", "value": "T174045C46EA814A13C0D71779B69F524633339764D3EB33069928AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818382, "uuid": "77bdaa9d-1c3f-454e-8aa4-c20b911ee1d2", "value": "3072:OcfInGt1g8cae5dPRdfxBoJE4wUCyV5Ul/Ay7xKnM/9Nz:OcfIIXcae5dPRd5BA5hCs5c/AydqM/9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818382, "uuid": "84aa5d2d-7186-4a3c-8cf9-5c6c21c23df7", "value": 181165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818382, "uuid": "ca2d55e6-5648-4bd2-b691-8c6b012d4177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818382, "uuid": "debad79c-7392-47ac-b4bb-6909818280dc", "value": "runningaway.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef007011-470b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777825200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825200, "uuid": "f28f242e-4b80-4bac-a5b3-1342153f9ce7", "comment": "Malware payload (ConnectWise)", "value": "29a271bf1dcb067651a3f805818801dd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825200, "uuid": "3cc10b41-ec58-4974-927b-82ec7bbcab92", "comment": "Malware payload (ConnectWise)", "value": "1a33e24658a1053f0af8c7c224ecb5aa756f539c8735d3a1cf023e6dcc638a03", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825200, "uuid": "78506123-62ce-4303-a36f-c30fd1027057", "comment": "Malware payload (ConnectWise)", "value": "3416d15545b8951cca5798942471be9c62d956f1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825200, "uuid": "8b561d14-6998-435c-922d-51e735a81490", "comment": "Malware payload (ConnectWise)", "value": "461f378a0321f3a079e4265af4605d5e4b858eaf06afa5ad94f246510435905f8f74f9b5c73a3c86ad342584b8986a0e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825200, "uuid": "fcb65313-34b5-44ba-beae-f499e0fb28c5", "value": "T1C546E101F3E695B6D0BF0638D87952666634BC159312CBAF53D4B92E2E33BC04E32766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825200, "uuid": "e8f3fc46-614d-42b3-b721-2a785e66f55f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825200, "uuid": "2b1364c5-012f-4cea-987e-20abf2e553b0", "value": "98304:jzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:jhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825200, "uuid": "44d4fc05-4d02-4e0a-b69f-11faadd93bf4", "value": 5873112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825200, "uuid": "9d0a8536-5e76-411d-8460-cb8a199cf68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825200, "uuid": "34892a88-afa5-4f32-a0ba-680c2b3ba023", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07ce9a6-46dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777805338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805338, "uuid": "20f2a572-e272-4d6d-b47c-5fa15c60c06e", "comment": "Malware payload", "value": "088c6ea5244c4223c2c50d980565ad69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805338, "uuid": "f5745387-a393-40fb-b36f-e20c69c08fe9", "comment": "Malware payload", "value": "1bb0ad8bbc45778d3ec11097f82e9074a9f1e2e289dcc1476bd46b6754af3852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805338, "uuid": "fb2b82c7-8840-4858-b238-11638d4e76b2", "comment": "Malware payload", "value": "2fd2d36c0b127599e2d0b3dbee5f4b3574b6f805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805338, "uuid": "fea1619c-b9b4-4240-a0fb-99c88ad31a43", "comment": "Malware payload", "value": "3a6fb998857b774533af98e5305feeff727a5786ea1d7c5e7eec1b286808396e1cfc426ad5eee1eceb066c9bcd037b36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805338, "uuid": "c95fee42-a85b-4db9-829d-9bcf0a90ee55", "value": "T1C1A68B41FDCB10FAEA431A3005ABB27F23315C064F64EBD7EA407B29F97B6951936249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805338, "uuid": "89f77036-96db-44d3-8eb2-775491cc2b34", "value": "98304:/hkDGP/mKDS0PE+VVGVYWU3vkz1AEjg+qpCqXDWTXtBfHunywM1QQ7:4qmDKE+VVG3Uy15jgPpCODWDtZH+ywS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777805338, "uuid": "c59bd82b-b91a-48f5-ad48-715d5f04a7fa", "value": 10233625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777805338, "uuid": "5985b438-5511-4fa5-bd65-ef0ad7576b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805338, "uuid": "3ddb9e73-80c7-47b5-8990-c2e37e42bbb6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8cf99f-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818324, "uuid": "c0d175d5-dbe2-49c9-acea-953c6c4366d3", "comment": "Malware payload (Mirai)", "value": "bee7fd3f8f08cf17bd8b3315344ad151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818324, "uuid": "27e1e115-b24f-40b0-b781-7b0b478f4750", "comment": "Malware payload (Mirai)", "value": "1cdd2e48884da407e44e6e6010095ebb70015f3fd34548e6ff513d84b2548740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818324, "uuid": "6e81e4cb-24e1-4d25-81f4-62064a704553", "comment": "Malware payload (Mirai)", "value": "c612c8119c4c762a9d7cdb3684a6835dde88e1e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818324, "uuid": "8b25d449-480d-491d-8293-13e3906d3d72", "comment": "Malware payload (Mirai)", "value": "144836d8fd934f31d21bba66219a8f21e759760e1d753a728e52ad4e600a36b3f06d452de9a8c2a0a6aa5448d1515c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818324, "uuid": "a7d457f7-c4f1-4ec7-8e85-6f41b55624fd", "value": "T15463026289337612FBE5FE1BD67405D7B5380B3C47A549BF7288C1443BE22020EB8A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818324, "uuid": "34d5c412-706e-431c-ae7e-cba91ea6963a", "value": "1536:/U6ODgnb1Ud3IXray7SpXQdVRB5HRXLOTBjCmiY7ulj:/K8c3yay+KJfHtLGhCmCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818324, "uuid": "eedfdc39-b39e-4305-9481-b6a69acf9536", "value": 68588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818324, "uuid": "09ad2ce8-1c9e-44c5-a84f-d25e71d2c2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818324, "uuid": "b94a9b6d-b4b1-4817-a79a-331eed602f20", "value": "runningaway.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0eb8d61-470f-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1777826894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826894, "uuid": "c5b51b37-6251-4cc3-8b73-0ba805339a2b", "comment": "Malware payload (UmbralStealer)", "value": "ab92a1a28147061759624c759e5d1dae", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826894, "uuid": "ab91040b-1b22-40c0-8c35-79c0a1da95df", "comment": "Malware payload (UmbralStealer)", "value": "1ceb7b4723b0ba88fd6ff4f7a629e33211912752d647724828d6d1b4bcc9d8e8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826894, "uuid": "cff9198c-1010-49dc-84e0-6a5092b915ce", "comment": "Malware payload (UmbralStealer)", "value": "2074922d9c828578bec60258f900b636bd4124b2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826894, "uuid": "5a16aa55-4885-432c-bb62-0caad1077a2e", "comment": "Malware payload (UmbralStealer)", "value": "076d3c29772db0dc7f45dbe264fb80b28c2020217baf39433564ce2b32434edba76d32b5e481efdb2ba79ffbabe839da", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826894, "uuid": "9858000c-efa4-474e-b263-95407481ce6f", "value": "T1AD83120ED5C092227876D87C947313C9ACF591509A2C684AA4D8FBDBCCDEFAA24D42D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826894, "uuid": "f2dd697a-048a-415b-96b5-71956389293c", "value": "1536:aUaB4wb37OWyijmMbndwyvm+3S/zatmSPf8zYH+Pp0TceEE+1SinB8YVa:gBPOWyijNb9vmn/zSP0zYHIp0rZHSBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777826894, "uuid": "3cab69fa-a500-458f-bc26-eeccfb0cd61e", "value": 84133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777826894, "uuid": "ac7f77f1-fa89-4162-a0f8-79ff7108ea8f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826894, "uuid": "1db067b6-839e-4054-b759-1fdb8dfa16b7", "value": "loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5c1f24-4731-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777841330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841330, "uuid": "5843b252-7dbe-41a6-80a5-2c3e863aa7e2", "comment": "Malware payload", "value": "708cf1499ac4439a470867d59ccdd33c", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841330, "uuid": "adcee3e6-b773-461b-8dc9-18594f6930c4", "comment": "Malware payload", "value": "1d24776d238329c21bdf9484bd1b739b83bb6e09507bf4d54b9bc1acf0469e37", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841330, "uuid": "4ea28145-98ef-46a2-836e-cce6b2fd5c12", "comment": "Malware payload", "value": "15569c91d62cd523b86c2b520b6a30acff49a3ba", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841330, "uuid": "3ed5b900-a401-4e1b-872d-09eaedab1108", "comment": "Malware payload", "value": "7e965be91d2bc981b1ae98fc4b65b2cd15f3d1157f35acdd66ebb8bffd1a438fd8ac7cc3f0018e1483e1f31f7bc528f1", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841330, "uuid": "5ecc8d6a-a6f8-47e7-bae9-dcca0f997c8a", "value": "T1D3648C5813ED8A26E6EE62B5E83D440D47F6B51A612EFB4E19A020FD6C13FC489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841330, "uuid": "b1ecd282-7e45-4f7c-930b-6eaf91c9fe89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841330, "uuid": "dec11d7a-fa95-4c01-b5e7-d74c48e5fa44", "value": "6144:tcPENsaxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:6Psyu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777841330, "uuid": "65cfeda9-b4c8-45cf-baf0-f25c748fab64", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777841330, "uuid": "a7061160-d012-4333-96c8-43c480da92fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841330, "uuid": "3ec1b870-ed8a-4baf-b817-152da7356703", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5735d0f9-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777807765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807765, "uuid": "0d6807ac-c667-4526-8ada-571d5a844a61", "comment": "Malware payload (Mirai)", "value": "3e8ac4bda880fef9423b009938b0188f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807765, "uuid": "2a37d15c-6a9d-4122-a15c-46d3682efc1b", "comment": "Malware payload (Mirai)", "value": "1dffbafcdc635aab0fab71ed8bac71870a218330776fd332c817584ce3d885bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807765, "uuid": "1207ed21-4dbd-43dd-87c2-bdb60e4767c5", "comment": "Malware payload (Mirai)", "value": "60b2750ce2d4107f401dc64ca9efac06f0c59a96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807765, "uuid": "4a496330-0a9b-4d77-abee-f3bc5a91b758", "comment": "Malware payload (Mirai)", "value": "0bbd41316d5b5e3e8acd8651f2a33bccb791a707ae6b70e3833d068028221717d96d869513b9698ce6666252859cb3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807765, "uuid": "c6a6ab31-bb2e-4b42-9ddd-cc901511ff54", "value": "T197931C46B9528E12C5C212BEFAAE415D33136F7CD3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807765, "uuid": "af6e218d-5e96-47b3-bd58-4bf89fd24622", "value": "1536:gUnBEkjRCMMZ0l3EVepOFnTRfGqtCMu/5hyHvhcY4smvVaZ6fEEarNQ7ibQZfn5m:KktCB0qVepOFndfGqtCV5YHJcOmvVaZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777807765, "uuid": "4d8b86ba-ea97-402c-9cad-dc046cef5258", "value": 96856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777807765, "uuid": "124ef451-1aac-42c4-89c1-d5a38c9ff8d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807765, "uuid": "4d33afe5-c483-4202-b267-dc2b18745144", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d39a1-470b-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777824967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824967, "uuid": "189301e7-85a7-48cb-8c09-b1c6977edb99", "comment": "Malware payload (RustyStealer)", "value": "5d63f37e9020eba7bc4988c35c8986d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824967, "uuid": "dd4720be-e5a3-42eb-8cf7-f76b3df20a75", "comment": "Malware payload (RustyStealer)", "value": "2017b04f633a0bf38d20acc7c718a2e5cf1891c17429d311b7e4f09e885013a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824967, "uuid": "223804bb-c727-4ed8-a74d-640a20a879ae", "comment": "Malware payload (RustyStealer)", "value": "35897ab23cb886894b50eca8301d547f76aaf673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824967, "uuid": "94e49d3d-5f61-466e-9b0b-8c1c566a2184", "comment": "Malware payload (RustyStealer)", "value": "809824eec28c34d2dd4ce6589cb20c89aa559af7d96842013099a4cc8fa143b4f6c936cc71a1444fc0ba9f503a0c72c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824967, "uuid": "9131a3a5-d6fc-4c81-9b38-67bb68dcb7e7", "value": "T14B36BF1277FEB05EEAAB97B4957462818625FC774D91808D31CC548B0F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824967, "uuid": "0146f000-c9f7-44b7-84ab-5b5519d4f389", "value": "61fe64e67c59da6df0c06d1364fbe72d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824967, "uuid": "988a7590-f487-45df-883e-1d36caab04e0", "value": "98304:vBENaBPaS0/FM9/MRbIRGLPIAGaY7eHMOrqS:K8BPaJ9K6bIvAicMOGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824967, "uuid": "2dcf96b6-fc62-408d-9b97-526991b5f878", "value": 5265408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824967, "uuid": "32663f8c-b014-480d-a1ab-f4d054630fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824967, "uuid": "8a4a10d7-622b-4582-99e9-0c660a94cdb1", "value": "winwsstart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afe232a-46ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777784445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784445, "uuid": "39551789-ff8e-49f8-9eec-ba683230b39f", "comment": "Malware payload", "value": "49486f3a18b2a5025de4a7b4d6c00468", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784445, "uuid": "bdddde1e-d0ea-4a8f-9fc5-af520f8958d5", "comment": "Malware payload", "value": "2220ded0b6e8e5e917dd45ba7f85a510eda6a0017e4ed53ce89dc0f8e4a8ff27", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784445, "uuid": "b35cee10-5831-4ae4-b716-30b2782c85b1", "comment": "Malware payload", "value": "ae4a440ea7c72d446460302ad092a24c30e23211", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784445, "uuid": "82d9c968-2521-4d4b-930c-d50b7bee5cca", "comment": "Malware payload", "value": "76ebd0b60af6ad4fa3a26e8a8763c209e7aa4d21dcc88adae69256a5655a5f6f3fe7c84ee6b1591052e24d8ac890e956", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784445, "uuid": "4965b5d0-6888-4b99-a0a0-7b02077624e9", "value": "T1155733E3D4B18D4BF63F68358EB4814EDAB6AC605D538866312E326563F77E032B504B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784445, "uuid": "1fdec51c-516b-445f-832c-a69f224c1ea0", "value": "393216:M9smm13elBeNdUbwwGte84Rh3cMj9WyICUNPf8WB92RhVEAKZm7BEqTwtOgJVuz:MxlYNdUb8ih3cmsh8WmR/bKA7V4fJcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777784445, "uuid": "ac385e60-616c-4555-bccb-6ef3170ec43d", "value": 28827648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777784445, "uuid": "f7d99112-d86e-4077-aef2-58ff3224d528", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784445, "uuid": "cd1dcf5d-20c2-4c3b-a79a-c92fb5239a20", "value": "The Moonlit Awakening.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45386c4-4716-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829880, "uuid": "d3380840-28e2-4f1a-b52b-6d295ac04af8", "comment": "Malware payload (Mirai)", "value": "9ebad809f93190ada9d5ff32e9d28569", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829880, "uuid": "33a08f5b-20bb-4a14-ad34-4c51491adec3", "comment": "Malware payload (Mirai)", "value": "22c660b02415d12b4cd1c40afd252d3ebde585ce2ae09923ff43659f917bee3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829880, "uuid": "a6cfd196-b3c2-4ec0-a026-e958553f76e9", "comment": "Malware payload (Mirai)", "value": "cdba00a8a399d5c7f4cdcb2e7f3ec6194d1e26ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829880, "uuid": "d3558d13-d910-43cd-adee-93ab065dec85", "comment": "Malware payload (Mirai)", "value": "a61a60461c7e836a9e902ab88e8f310c6ceffb2a4522a93720b4a5c0ddda8abbe48d74478efeecbe6e69b0cdb337dadf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829880, "uuid": "b13fc166-25ef-47cf-874e-ea275f707f0f", "value": "T113138E53CD6A6EA8D3151AF0B8354F3D4B63E415DA534AE5D1A6C63AD003EACFC242F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829880, "uuid": "4ab0b9a0-0a0b-4c5b-903c-5108f8f04407", "value": "768:DUcqsns++huYK6Jms9DOl3w/pqQ+l9YU1bfskq4m6KoyJRCZdk:DDdnsjh39D4Gpq34U1bfskqEeRCZdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829880, "uuid": "040455c0-bf56-4a10-9b66-b3da6e66149f", "value": 44200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829880, "uuid": "4dd223bf-bd7a-47de-9f9b-5f71b58af9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829880, "uuid": "42505329-c19a-4f79-904d-df811e9b8d14", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e208197-4687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777768263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768263, "uuid": "755b0935-b728-473d-a944-a015c6c73df0", "comment": "Malware payload", "value": "763cdb5a637d29e583696be5fb23eacf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768263, "uuid": "0bef5edd-f077-45db-883a-5256dba54114", "comment": "Malware payload", "value": "249a049e611f83823c514eb7b904977ae94371768ea3a93160378a9f757827cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768263, "uuid": "bd1b0c80-a162-4ad8-a1c1-aeff3435d16f", "comment": "Malware payload", "value": "7118a872023ae87a8f13a3e321e6675e12e81f30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768263, "uuid": "7660c3ba-8cf0-4f44-b631-61924e05c330", "comment": "Malware payload", "value": "e3410e2865e4f3a738695e50529d9894a02b82baec1a2ce53c0a2339ca8ab314062c4e35201d02200fa57287ac2a5a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768263, "uuid": "d0a50d67-ddb2-4a72-b0a5-1b11a3493600", "value": "T11EA68C73945324D8E1A989B4D11416527DBC3C8B5738A3CBBAC471F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768263, "uuid": "c6922bab-fd76-4d62-ad74-fb089bd29a71", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQi:cqYUQuVDt0TZEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768263, "uuid": "cb01eb20-a490-4b31-8112-e9619a85d447", "value": 9994240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768263, "uuid": "c575ce74-1359-4380-b5fe-09e84960e511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768263, "uuid": "0602f937-51f1-473f-adcd-7b995d32c4af", "value": "249a049e611f83823c514eb7b904977ae94371768ea3a93160378a9f757827cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223b265a-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842466, "uuid": "d6cd50a1-9b99-4f80-abf7-325f0c18b060", "comment": "Malware payload", "value": "93809d9420272e655d1e100a9982ceb2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842466, "uuid": "94d3e3b4-23dd-4332-a7f9-f7b14ef50546", "comment": "Malware payload", "value": "264f487079ca7ef58766b907101fdab8ba115b6b13d15cde917fad75acc9d0e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842466, "uuid": "3595dc7e-fdaf-4bf9-97bc-a5f6cbd29462", "comment": "Malware payload", "value": "6e13a2d73202c1353358175db5c093fd2b4035cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842466, "uuid": "72a7d891-03f0-4a8c-915d-5eff080f82f3", "comment": "Malware payload", "value": "6688559f2918bcc8ea16d942370b460ef364f766604f871d3b8c914e3477a52493ca549c446444139b1a20ac3cac0f8f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842466, "uuid": "9e98ba1e-a526-4608-aaa9-79138f26c4a6", "value": "T111311E4A7C620632A58E94556F9811C971C2689F72507D2E70CFEC353F3A894F2FE2E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842466, "uuid": "d39de196-4751-47c0-80a2-4a2083a7b053", "value": "48:2qloKUYUSyX7iKxOErEqusK8Y/3U3xWaZullIw5Y:xloP9oL18Ys3xhZolIw5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842466, "uuid": "f6267d70-1236-4600-b4c5-23519cc8cbee", "value": 1787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842466, "uuid": "0a1bebf8-ad1c-4710-a70b-e08b1fec73fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842466, "uuid": "2dc6024a-538e-4c84-a8e2-78654a04dd74", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85677c5b-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777814715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814715, "uuid": "95b41df1-7c12-4f48-af5b-1edcf47a9b29", "comment": "Malware payload (DCRat)", "value": "28895b8753fe1677a1df7aed7f5e1f8e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814715, "uuid": "1f809e81-f50d-4aaf-b10a-05c95fe5dda0", "comment": "Malware payload (DCRat)", "value": "269ce57860dd8c1e869b5d84223808f07d15442eeefb569042fc1f788ed56e7a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814715, "uuid": "0443584a-3977-4c8c-9a47-6bc355399687", "comment": "Malware payload (DCRat)", "value": "83ee066809497b43a3639f7a5e2f1ede5482ef1e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814715, "uuid": "15de41b8-a429-43c2-a788-8e66c15bbb6e", "comment": "Malware payload (DCRat)", "value": "772d099056d1d53a0f671fce733b01e0f45e03fdfc7c9836b5fb4579d533a737a78a27ab14156b4afed5a55f4b460c1f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814715, "uuid": "fd95732f-a54d-4792-b454-165230948f82", "value": "T1A13508163A46DD02C0291637C9EF4A2447B8BD45BB66DB1ABEDF735E60123A70D0E1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814715, "uuid": "316d7f33-34d7-4e46-b447-f1a799a7e454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814715, "uuid": "a0ecaf84-0a12-4986-a959-b51266292604", "value": "24576:sQdvFN+JWIsQqfZTdViqIYzZxv17rcuq+vzo+4:dpIsQqTViq3TLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814715, "uuid": "ec2c7c04-da6f-4bae-9c0e-d8b63ea51755", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814715, "uuid": "3a1137dc-c8b1-4fb2-8687-924d8b39cb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814715, "uuid": "906ce867-f603-44d0-9ccc-70b404b47194", "value": "28895b8753fe1677a1df7aed7f5e1f8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dcde2a-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818533, "uuid": "506df678-b77f-4d11-8858-c3a8686d1b6d", "comment": "Malware payload (Mirai)", "value": "8ad0ba426d45a182dada5de45569d9ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818533, "uuid": "7e0d1edb-c024-4ed7-8f15-0071541c3d5f", "comment": "Malware payload (Mirai)", "value": "284eb6d517937cef318b3a0eb4e9efc5f8e05ced926632172e7b1e2ea7fb8644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818533, "uuid": "9db52803-bd78-4d34-b24c-809172675048", "comment": "Malware payload (Mirai)", "value": "f88a3be65afa5750df014172a2e8d2c06fe89060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818533, "uuid": "5c2eb243-ab1b-47a4-9703-ed711d229cca", "comment": "Malware payload (Mirai)", "value": "0f335c773adfe98e2f8da9c9d6b99dd0c10cf9bd9a161b440a8d01c8771352ed168bac27fd64654ea1405ec059334c57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818533, "uuid": "0a415b5f-9618-4f23-8130-be361a4e8341", "value": "T1A4938EC6EA83D4F9ED2202352172FB3759B3E53D2228CB43C3A9DA769D125C0D56235E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818533, "uuid": "7611c16e-4316-496a-95c0-a75c1b4fd118", "value": "1536:CUQp7jG2M9Lr27UBroNkrExF36Kd29TEvNk713ZPnfdmYQ9FBXU:pQp7jA9nCn0EF36w6TeNCtZwYQzBXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818533, "uuid": "e61a5ac3-2dbb-4672-8961-df8d8d677792", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818533, "uuid": "5f385d99-439a-4a1c-9144-8efe32231d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818533, "uuid": "28858363-205d-448a-b39e-f8e620c3ba51", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d3feee-472d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777839462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777839462, "uuid": "94ab2a48-43c0-445d-bd97-342b3e2e58d4", "comment": "Malware payload", "value": "abc3926bfbb605fedea9a6c9a74802ed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777839462, "uuid": "684a4346-7025-4127-955d-f43df8405888", "comment": "Malware payload", "value": "290edd6d3ed29a29820d0ca6f5f62716426ea89f73bd1f575400ac2d78f39c8f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777839462, "uuid": "a746b0b6-14be-40dc-886b-6bb9ad317382", "comment": "Malware payload", "value": "e18b95f51a8017b8cc3343f6db69fd2a785363a0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777839462, "uuid": "6b84068c-f06e-4360-858b-09337bdf1390", "comment": "Malware payload", "value": "4890280679be604b2acf39c42b585306cc988018b093d8180afbeed02eced5a8c1b49471b12f13af72fda02d23bc2ed3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777839462, "uuid": "511a497a-bca0-4344-941f-257535b98e6a", "value": "T1A0F5A63371077167CD8140F6E66251978EFCB3A92732A1F6B4BD820C75ED0E852B7AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777839462, "uuid": "4563c164-3de4-46ba-862c-eb957458c088", "value": "ed1fbfbad6ac1c8f1815f39cd131b344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777839462, "uuid": "702d4b99-dec2-4c80-935b-9e99ca8f97e2", "value": "98304:LkLAb9XT3cfWevq+FPwoH/QYmJ5B/US3DzPlH59TvIiqRC0HxSor0:IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777839462, "uuid": "42607d04-5db3-43ee-a616-e2e64a35f184", "value": 3349320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777839462, "uuid": "e58032d4-fd5c-44fd-9552-a026ddc2245e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777839462, "uuid": "8d224515-ff28-4e71-acca-e2dc155bfe78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4814f1-46dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777805336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805336, "uuid": "d4f496d3-7892-4e12-b2c6-60bd6b44406d", "comment": "Malware payload (Mirai)", "value": "dc613d3dc9ec6702e99b30a7ab9f9767", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805336, "uuid": "ecf3752f-351e-4499-91f9-65ff91757cff", "comment": "Malware payload (Mirai)", "value": "29f88665736becc93737f3388ddd17d28566e30863a7a52b3e56a0614dbd0e73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805336, "uuid": "77834e3e-94b1-4c77-b4c9-dac7a2142501", "comment": "Malware payload (Mirai)", "value": "d71972ea1c26fdfac623ab6c268eb3f1248294fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805336, "uuid": "866c76f0-9c80-4629-b9b9-13fa6afcaf12", "comment": "Malware payload (Mirai)", "value": "3a022f5b215f73b6731473b30f500efc30342749a706aeb7286626c098bd2ad4da518bd9cabfec46915cc075338d26f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805336, "uuid": "f8f494c5-3813-4eac-b575-9aae902d4898", "value": "T1A973F942BA47CAF3D41708F041F7B63F8E31FD3A493285A9EB65BDA2CA275C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805336, "uuid": "08b7e513-f1e3-4f84-b4ea-0ebffb60c68f", "value": "1536:t+ml11IujxuIX9GtkxBP4Hojys9jxeU/riWj8iamQuPbiXaGYjqrU9+o:t+ml16ujxVXPBP4HojyOx/3wiam/DiXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777805336, "uuid": "a1ddf677-be01-46a8-a6a2-9454f101362f", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777805336, "uuid": "9300002b-3473-4f0b-8221-19bcab1b6879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805336, "uuid": "1b989843-f2b4-49a5-a69c-aca044c44ff8", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8a4ebe-470b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777825201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825201, "uuid": "64b1f056-c89e-45f5-b7db-81df3e7b7dc1", "comment": "Malware payload (ConnectWise)", "value": "294ab44f0f43b4a1f04276fd6bacb39d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825201, "uuid": "6fc44a71-2e6f-4ce2-8743-ef175f3d34ab", "comment": "Malware payload (ConnectWise)", "value": "2bad623d0ec0d17a3844d3a6d443a5c221e5924a76485f2070bbedff85220ba2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825201, "uuid": "e73cd2b7-3c04-43c0-8c04-bcf286c40ed9", "comment": "Malware payload (ConnectWise)", "value": "97e2ed01f00199f3047b26ebd0ca5a5f41ebc4e6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825201, "uuid": "3ccde32c-a925-45c1-8e3f-70e9dba2a83c", "comment": "Malware payload (ConnectWise)", "value": "81a1766ab255c53fa0a0b6a5fa72f08cb14f2887bd50d60f5d160efa674ee29de9c0ac72d1d69ceb7e6bb874167f89c3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825201, "uuid": "4d7e048a-173c-4828-a419-96e827070c64", "value": "T197646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825201, "uuid": "79673e20-c753-4c88-afaa-14424587eef8", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825201, "uuid": "2d34dc41-6a39-4c0a-97b0-ce079adc523b", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9Q:h1iw7gryNkSV1hy1Z1u2JLu9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825201, "uuid": "e54f3695-f254-4224-a654-5710c3a5bcdc", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825201, "uuid": "a698e329-f52f-4292-84b2-83975fbabe26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825201, "uuid": "7a75cc11-b00d-455c-a4bd-d5bbf424468d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c523f911-4718-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830713, "uuid": "aff07011-cd50-4d43-9eab-a6f9267bb01f", "comment": "Malware payload (Mirai)", "value": "214c960de800b69149958e432249bd91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830713, "uuid": "163d3c61-60ee-4eb6-8b19-e236ea6f7aa2", "comment": "Malware payload (Mirai)", "value": "2c27db27d312bb67795873dd06954a48bf8f8db791e314fb475e5890e96a7dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830713, "uuid": "4af870d9-9ae4-4b50-bb7b-efd28613f164", "comment": "Malware payload (Mirai)", "value": "f43062d4df6d465c3a1928391bcb3a2782ef0480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830713, "uuid": "1641d682-5b85-495b-8036-0b402c13076a", "comment": "Malware payload (Mirai)", "value": "93c96b814d85484ea8bcb89725e54f324777b00ac46e6da2aecb01a1ab14c7c4ccbce15a3035dac409371e75e663eb15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830713, "uuid": "568743d9-b091-4550-af24-c46c5f6ea81b", "value": "T1EE430A957CC2CD1AC6D413BABB7F42A9331163A8D2CA7353D8184B687E8A51E1F37781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830713, "uuid": "bf20a631-1b9c-4f34-a02b-87be97024cfc", "value": "1536:i7GsJLA5ZpVN6lA3IdUK3PH4MbkAPgWh7fO:5YLapcAYKKAMzPgWh72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830713, "uuid": "0c8ee213-1acf-4407-8ad9-b24efd0cc86a", "value": 57209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830713, "uuid": "a2bd56a6-ab93-48a2-9391-56a21c93835d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830713, "uuid": "133dd3bf-5952-4472-8b47-11b6b678c2e5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394289ed-4732-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777841645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841645, "uuid": "78dd7582-1554-4922-b591-0a3eb56c12d3", "comment": "Malware payload (Prometei)", "value": "1a9d2e0e49ab852113391c4a2f3571cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841645, "uuid": "058bb5a2-c8fb-4004-ae86-d23238be930a", "comment": "Malware payload (Prometei)", "value": "30f377411d54976bd9f0b7e202a1879eabf4eb9f4bf92e3e9d177fb47bfd72e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841645, "uuid": "7eb74079-78a0-4208-b642-d5dcbc3beb50", "comment": "Malware payload (Prometei)", "value": "350c9ca3f0441400b38d288a35416a92af7fe5c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841645, "uuid": "53a7554c-961c-4e96-9e3d-51f33ab62aac", "comment": "Malware payload (Prometei)", "value": "f43d688d65b8ebcf8fe94b515904309e8768d7cb07d05a56db927ca4215153fff901a8ae56e9e300566b8af11aeae136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841645, "uuid": "36f6b679-d72d-47e7-99c7-908f35eceea7", "value": "T194A423B4F9219E8F6DD769B91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841645, "uuid": "f4b20f8b-0494-4c98-8858-1512cc381114", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdY:Fs6pyCC/Ya2hpi6T6N4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777841645, "uuid": "1fc2df09-834a-4a65-b26b-7a6379933f69", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777841645, "uuid": "30d3a261-e42e-4235-98eb-ee08010a5654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841645, "uuid": "ac348354-26a7-440a-8a60-0989189d2899", "value": "30f377411d54976bd9f0b7e202a1879eabf4eb9f4bf92e3e9d177fb47bfd72e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d9604a-46ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777810929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810929, "uuid": "8a04e26f-342a-41b0-9bbf-f49a67d9fb46", "comment": "Malware payload (Mirai)", "value": "45eae77b9edd53cf56080370f75abf46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810929, "uuid": "572e9e78-6790-4e80-a7c5-2ac23ed79cf2", "comment": "Malware payload (Mirai)", "value": "3178253bfabb6bba45846ac532f47d36ac85b1b7fc31863d38844169ea0e0a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810929, "uuid": "37262dab-72c8-410e-a437-dbf56dc505b2", "comment": "Malware payload (Mirai)", "value": "24b819bae6b22f4f231918f9c58391b02369900b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810929, "uuid": "22a6fa4d-ff7e-4e7c-98a6-e38e2a59cafa", "comment": "Malware payload (Mirai)", "value": "3ae27db34d00c9e939ffb07699adefe74495b6a6576d3b7052c73b71c3ba65c94b292b16283a5d2b32094ea7ab698e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810929, "uuid": "79cb9246-782b-45c9-a01f-ccdbf04f4a2f", "value": "T182730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810929, "uuid": "87933163-31bf-4100-89cc-0c5190d95953", "value": "1536:RcK8MffyU5RL+r9RS3TlUgf/wSBO7kVgu3Urpbr5ag1416mEv6+8u:RcHCfyU5MuTlUgnw/Ygu3Spbr4q4HDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777810929, "uuid": "5ee14f7d-4a55-41e4-b96f-0e22e8e163bb", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777810929, "uuid": "2f72e552-8828-4d65-9394-fd6b69c0654c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810929, "uuid": "8e0d1670-6cdc-4f07-9d21-9bcccbfc61a4", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d850c87-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794462, "uuid": "baf62722-4d24-4bf4-817a-1bc44bbac297", "comment": "Malware payload (Gafgyt)", "value": "050f217d0164a1aac69b3d0bf3366dfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794462, "uuid": "e3fd6746-078d-427f-84a3-adfeabaf227f", "comment": "Malware payload (Gafgyt)", "value": "32efce951cff77f13514c8d2e0a8554eddea5c5715e0ecc2ca0ac16a3c2612e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794462, "uuid": "b1b31af6-8a92-4772-b339-5f9b38518f2a", "comment": "Malware payload (Gafgyt)", "value": "5eacfa398c0f9e7748d5f401eadd432f956e686e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794462, "uuid": "d048e003-f4bd-41b1-bce9-b83bd8eb6c9a", "comment": "Malware payload (Gafgyt)", "value": "30ebd525b05013e018953fd76aa01753842e62ab43ce9e9c9ddc7df6fb01965bbf6d7bfcf9f53c6b1de07371a2ac701d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794462, "uuid": "b704db03-eb8d-49b1-94cb-2ad1e49b331c", "value": "T167731843E965AF73C1976BB116E75D300763B9215F4F1BA93128EAF8474B8CDB80A324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794462, "uuid": "3b8d8144-f18e-4f8b-983f-27fa1d37f162", "value": "1536:NVBiqrIy+KYlcJHLONnBKNLO7TC/aYHU6mOEVMYLpGDfL6e:liOIwYALONc8TYQ6mOEVMY9GDfL6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794462, "uuid": "95537d9b-b6c3-4a36-8e37-1c5217c4abc0", "value": 74532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794462, "uuid": "7ee2eb85-40fb-48d7-8a4c-df572d958cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794462, "uuid": "16a39fce-2479-48df-857b-def1c5f7f109", "value": "sh4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2040c0b0-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842463, "uuid": "0258bc0b-00e7-4c64-ad6e-371aeee553da", "comment": "Malware payload", "value": "de5201caa96891552441bb2b59327299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842463, "uuid": "4bf9fd01-b9ba-43b2-ab82-8303094f8529", "comment": "Malware payload", "value": "3509993affe7c0f8a6149182df703a13295981945b8fba66d1046a227f739fe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842463, "uuid": "f3f073a2-8d86-4a32-b5f7-8494dd5e6709", "comment": "Malware payload", "value": "c92b804dfa4cc2f35c3bf1db2b24e88c83cddc6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842463, "uuid": "3633cc72-a9be-4b17-be5c-6d6f427d5bb7", "comment": "Malware payload", "value": "124ca991747b13ae58ef89867b4fab2753e1f2321b3946cba7e4a36cdd4998846ea9d23da0776e81fa9afb9326414b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842463, "uuid": "1d274039-9b53-45d3-9142-24786bf7bcc1", "value": "T1F0B37E64E90F7D81D2C7E37EBD550FA2B22738A0D365C1F27901A25DD8A6EE08DA1523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842463, "uuid": "e1a61eb1-11fd-4d7c-9d92-3d7f95e450f0", "value": "1536:aZf0yNAhHnhjUDu1nlwTMiz5+v+UcU0mI4rNzBT3vjxao6wwxg10fIKOC54L6MIZ:G0yKHhjUKlwvV+dwYDv9Tj14IKhR9Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842463, "uuid": "db105db7-4aba-45ae-ac7f-654e21a6ff77", "value": 108616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842463, "uuid": "77a75fc1-5ddd-4e1d-86f9-ffbc18ee05af", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842463, "uuid": "8ead8731-7704-446a-ba2b-7f6a09a69273", "value": "35fc4b37.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8cc983-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "f9c13afd-4a47-419c-8692-a4100c845a65", "comment": "Malware payload (Mirai)", "value": "2cef8d1479aaa6c5a247b97fcefb58a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "324fea5c-3c92-4a5a-a799-08df9d6d8d39", "comment": "Malware payload (Mirai)", "value": "35467f46ffa29ee7b50695cc4a3dfec7c1321ed45db39b27250a7ed493d21e06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "31d3166a-f07d-4c52-840c-8eb9ddd8fa0f", "comment": "Malware payload (Mirai)", "value": "ea527a53c025b2d8e5812a8b54d936f2daa935f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "d2566d09-3cb2-40d6-ab8b-f94a3b204628", "comment": "Malware payload (Mirai)", "value": "367734841950a6da94f8983b67e74742b01ceee89e8c56ede74da458657cf6e09f3f07996619ee7bf55f287fdff12623", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "0205ea25-7ff8-4877-86b4-a6d2ffa63909", "value": "T16023E17791C660F3EB2046394E0EF4D4ECBEBC93825B7D5F4A6539D65966C402E20393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "1b6d9357-d607-418e-a699-f0b8f2ca073a", "value": "768:K9+DSezaIPMQ6WeAeRICUXktqeeWw4DzdnRXJH94/m+mX0LsBEtN8Ewmx+NriErZ:3GAPt6kemCqQeWzZtJF8yEH+BX3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823933, "uuid": "18773f27-bee3-489d-9b3a-1129ac741704", "value": 47720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823933, "uuid": "f9e4dc13-5af8-4dda-aa53-42a28aad428e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "ae79b0da-0337-4fec-994f-b19ecc8d8257", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8a44b3-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794463, "uuid": "5dbde4f4-e1ca-41e4-a108-0e61b7fca0cd", "comment": "Malware payload (Gafgyt)", "value": "d74bc4248053b2503707bcef146f08f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794463, "uuid": "9fe8e8fc-5fa6-424b-a3c2-580af3b07857", "comment": "Malware payload (Gafgyt)", "value": "3948626a2d3858ddd354c65df5067f1f0651a9d23ec992274d327927432dff2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794463, "uuid": "172e18c8-7496-46d4-9ac1-5653446bf30d", "comment": "Malware payload (Gafgyt)", "value": "75d35455d66d62e7603a11e1143ac8ee52c42e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794463, "uuid": "db54d088-7f73-4818-98cb-592d90f2aa25", "comment": "Malware payload (Gafgyt)", "value": "3292c22070003956a3dde83e842768a67d285fc032ef9967e3f3a6deb4c37823dce50b5199db4ecd48033b265ef513a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794463, "uuid": "e658525a-af68-40e6-a311-824396cb13e4", "value": "T110732943B70C4B43C167AAF01AF72BF187A9F96126A77245B50DFEC45372AB01816F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794463, "uuid": "ec761da8-877c-401e-a106-dd92322ef6b6", "value": "1536:887QBIQTznGB3Ob+ngTDVzESRB6APqna146uKmXEVMXjfbfLXe:LQNG++ngPdbvMkeKmXEVMXbbfLXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794463, "uuid": "7793027e-88b4-4925-9c6a-9c39edef608b", "value": 80674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794463, "uuid": "6f17da4e-9892-4d00-aa37-24ed6e517023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794463, "uuid": "20c8ac7e-9b9e-405c-9a2d-87dc32424ed5", "value": "ppc.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4424efd6-4708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777823625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823625, "uuid": "5e617de6-43fb-421b-a2e7-50faf25ed42b", "comment": "Malware payload", "value": "8ba3333437576fc53dfdeb3edb4a3c99", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823625, "uuid": "5e04d3ec-4ff1-4988-bab7-e79c470e46e5", "comment": "Malware payload", "value": "3963ecb0b715e2c6e37b5de3b67326bda9625fb9e9c5cb88596559251646b941", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823625, "uuid": "d374bdf8-b800-4809-a9aa-67d780585db2", "comment": "Malware payload", "value": "31bca6cce58bb41668dc2c1c2487bcf9fdcfe48d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823625, "uuid": "a1fd070a-d4e6-4d0b-842a-ea8d016e1195", "comment": "Malware payload", "value": "eacd869e3c6231d62f836fb6d59e6a10045f439131fce36d9aaf458ccac8f6aa81eeebd2f3c781825bb08ba4ec9996da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823625, "uuid": "41d434b0-6a5d-4b75-abdb-4ab232a54c19", "value": "T160B6AE03E89104E9C5A9E231CAB79253BA717C495B3237D32B50F7786F76BC06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823625, "uuid": "006f0166-40d7-4faf-a32a-fbaa12b53465", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823625, "uuid": "161a263f-2e7a-4d8f-a3e7-c66ed9885070", "value": "98304:bhcqR8TZ42cx3Wngdb9Dk6KE0TSN/QNrGRtAr/OkxpEQ0sWcEIewW:bh3RWZ9zUxXxVbRM/bzPEIewW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823625, "uuid": "2f103aaf-dc6d-43cc-95a6-5feeebf50586", "value": 10656256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823625, "uuid": "2debdc83-e4cd-4542-bf19-bdfdd75e9553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823625, "uuid": "66c6868e-2c9c-4b12-85cb-305138053962", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f344a03-4688-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768748, "uuid": "1858b168-70b5-41c3-bdb9-819e1266cebb", "comment": "Malware payload (Mirai)", "value": "db75bdb555106ed2a6e11da9a2761a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768748, "uuid": "f265dd9f-afad-44c7-86e2-f33f13f66294", "comment": "Malware payload (Mirai)", "value": "3997f1ee72c837fa05af9d9d9b1a072ab4d75063a884a90851ed3ff27467ee0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768748, "uuid": "e7d0c3ab-1441-49c0-9f8c-52b6f4bfdefa", "comment": "Malware payload (Mirai)", "value": "72f1b4979355bb2992a05c4b6b6da50f7bd17108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768748, "uuid": "12f2016c-1d0b-40a6-b20b-8bd1369d2f76", "comment": "Malware payload (Mirai)", "value": "f17cd95e573a61f645dc67e9ad73eb204ff9015689eeb8c06dd0d9ad8440452898d0d0d7a9be0f550862ee9980f4a8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768748, "uuid": "56566eba-9753-46c5-8582-567b0469513e", "value": "T101B56C99EE0E3D42E3C7E27CDF4A8BB13137B6A8E32281B37552025CC0DA9D597B1255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768748, "uuid": "45987a37-9bf3-4765-812f-c8991df8f9fc", "value": "24576:+UPTHM88TceMI6TlhwbrtAhCnKBOPSY7DvU4kwCOwbOH0pnlp6KAA9vlCbtt1AIQ:Vz4Tq1+tAdlC+QE+tte4zPc07fZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768748, "uuid": "28384874-fa0d-4072-bda1-33d8a8a22faa", "value": 2476976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768748, "uuid": "a19dcc6a-6f82-4fb3-bf53-3d5955918b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768748, "uuid": "b2af6752-ab16-4913-a401-db1c24484e7e", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e696907-470a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777824501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824501, "uuid": "fd4fedbb-69fe-423e-bc7c-892e6e63f026", "comment": "Malware payload (ConnectWise)", "value": "caeb727e45e204804684d7ceeb702a05", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824501, "uuid": "e1245640-d102-4219-9ab7-9de00ece46b7", "comment": "Malware payload (ConnectWise)", "value": "3ac64697f4e3c09f8d6d5ea2245e2fc902cfd7408f4e7ced5e4a66fab07cc9b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824501, "uuid": "9785d399-7a10-473e-9233-38d202ec4648", "comment": "Malware payload (ConnectWise)", "value": "166d0a2b45a19d12818ee0f13efd8cb0b8ed28fb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824501, "uuid": "b99e1e70-8529-4cc8-8b62-8d5dfdfff990", "comment": "Malware payload (ConnectWise)", "value": "39366d8f98be89cb17527b11d1f9d8979d9beb39c5e1b03961a34fa8649041a1410a74bfe6ca4cc7482eba19e1004a3b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824501, "uuid": "d9126e9c-a86f-4f4c-b9e2-f91b94da8eb9", "value": "T17C46E101B3D695B6D5BF1638D87A52A56634BC048312CBBF5394BD3D6E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824501, "uuid": "0f9f4ca2-7ca9-4469-91d3-6a03a380fc2c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824501, "uuid": "ebf778c1-df73-4d62-99a1-fe7a7482686c", "value": "98304:gzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlV:ghfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824501, "uuid": "d45e6596-4c83-4e9a-b2f7-b57dce95b599", "value": 5720664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824501, "uuid": "79c4b41e-4d12-487e-b9f6-f020559f8385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824501, "uuid": "96c1c748-d458-4fdf-95f0-c40f0e2d846b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c521dd-4686-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768093, "uuid": "43714f72-bd2c-4fe2-a6af-7966c3b99a7e", "comment": "Malware payload (Mirai)", "value": "1e2cb94da88ca7bd5024c05201fedfb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768093, "uuid": "685adfe1-52bf-4827-927b-b53e97facff4", "comment": "Malware payload (Mirai)", "value": "3b4b6aa5b1bacef9174218fcd97c76cab4349cfee2ff00405237d6a6e29674de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768093, "uuid": "1bff725a-057e-4f8b-a8cd-4d67e4582799", "comment": "Malware payload (Mirai)", "value": "e5f1dea6d47d154bd53f6f3706cb83fcc454e46c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768093, "uuid": "c3c59e6e-46af-4190-b4d8-9f577ee7a497", "comment": "Malware payload (Mirai)", "value": "961fa781232ec73cffc1747a4bebf3086425d9c11c6447e2833f6fe3332679861e7ecd2dac1db53a77088532c1b9045e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768093, "uuid": "944fe243-fdc8-4149-a9b8-a51bc5d7a4b4", "value": "T161C51744EAC780F5FE470E718167F33F4B306B05C420DEAADF94AE16EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768093, "uuid": "a461e304-762b-4e69-8cfd-86371e57f072", "value": "49152:zp60MIXVPzQBX/JcWpIGDtkkbpdL0VJ8lHMLuxTJrpPkV5m:zp60MIXZzQZpkqL0LuxTlpPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768093, "uuid": "12b74960-d3ee-4ff4-8c1b-7a1e61431a34", "value": 2539768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768093, "uuid": "03686428-44c0-4c46-8668-2896e116d3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768093, "uuid": "75c964aa-a07f-4bbc-b263-fe36af7c25e2", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e1481a-46e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777806775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806775, "uuid": "40690abf-8fa2-4f02-995c-d98c2d65b488", "comment": "Malware payload (Mirai)", "value": "0d30ba88dd41c0c770c3c65b8b4abe83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806775, "uuid": "c0e3643d-2331-4c83-a4f9-deee81d8ea3b", "comment": "Malware payload (Mirai)", "value": "3bda9c729887e256d01f9f4ebaeaea25b916d9c0c75d1de574a06456b9b851ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806775, "uuid": "abf3a469-405b-41e0-be51-29575f803393", "comment": "Malware payload (Mirai)", "value": "9b20ebd98ee597f94f5b833104a4af5668da13e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806775, "uuid": "74297da0-e984-434d-81de-1bc0b3d97e97", "comment": "Malware payload (Mirai)", "value": "2deb72b894ac51653af94aebee4ac571df4f91f7e06a364e1afa6dfcf5bcecd98b529128e1ea857622394f25311490f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806775, "uuid": "b1477cd8-1d85-4b05-a1d0-21488e152a5f", "value": "T191C3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806775, "uuid": "3c2340ca-0ec6-4359-a048-a7916f60039d", "value": "1536:j4w4zW/h4SZsqEznAfgiDSAPzfO4jaXbzjZjCfPNXm/iRK0UgSSW+:0xW/rZsq8A3fHjarzjD+XW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777806775, "uuid": "f0970ead-ed44-486a-a739-fa1a69800d65", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777806775, "uuid": "5a32a811-9a54-45d6-8309-c714ae6a1ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806775, "uuid": "f76de07a-3dab-494f-b962-866e918dae97", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd57516-4688-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768879, "uuid": "7c54c5e7-41e3-4bbc-b2ba-fffa87c3a3ac", "comment": "Malware payload (Mirai)", "value": "4bc56bbb85b8d811fad6d150297d55f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768879, "uuid": "b1390768-2551-4184-ab69-f0cc3c5bab0b", "comment": "Malware payload (Mirai)", "value": "3de8657ff702daa6109487325f41c379acb49a7dd5a1e025bd8923a3df5c772b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768879, "uuid": "6698a2eb-872f-4293-86b5-e83a5c607478", "comment": "Malware payload (Mirai)", "value": "42a8e3636f3b4d13cbc246417d00494c6cdf16e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768879, "uuid": "e94157c2-96c2-4833-a2bf-85d2a4eba95b", "comment": "Malware payload (Mirai)", "value": "aeb1638f304f4eea1f16a099020acd06d53ab5c54664f85eeb64298c35775f600695767b055aad5dad97557949d64167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768879, "uuid": "014621ba-3813-41b3-aa61-15913e883d11", "value": "T1A0343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768879, "uuid": "9b3b4daf-924a-4e8a-bf8e-eec5cfd20da4", "value": "6144:sQYf71sTafH/a7KKck/l9Inplzo6f9ihM/9eAU:sjxEiH/a7KKcktOpCPG/wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768879, "uuid": "31739f36-6aee-4222-b8c5-28d7201cf52d", "value": 230968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768879, "uuid": "9cdf474f-c96b-4a4b-b814-38a0097f7981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768879, "uuid": "dfde1657-52c7-49bb-bad1-085e46d95bce", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a20a45-46df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777805937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805937, "uuid": "baeb91c1-84cc-43d4-bba2-ccdd87b14699", "comment": "Malware payload", "value": "eea1b4e10091e3468aa440094de0791a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805937, "uuid": "9972dac4-cb8a-401f-8e93-0a6c0db44769", "comment": "Malware payload", "value": "3e33c02964e7499d272871c03356b10ca88ad62b0959f85b3f1b699e028a0a66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805937, "uuid": "852b0a89-2aa8-4122-af2a-e02967edbdb8", "comment": "Malware payload", "value": "9b127300c980b1f92d28c47d000053f60fb68db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805937, "uuid": "fe3f528e-9b1b-44fd-9dff-5cf74870d61b", "comment": "Malware payload", "value": "628027bd066835ae419eb3171e7d6d226db4ddc44ab419fd112b5497dceb11a8df2b203e20222d7785a01eb7390dddd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805937, "uuid": "a57fd1e1-236f-4862-b488-221ece5338d9", "value": "T166B66A137B6CEB0FC228223409F2DA946B695C9601D7A517B385F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805937, "uuid": "8aca2cf3-3c23-4cdf-91ad-dd08c07f4d1e", "value": "196608:Jp2o4msp+R4KNEzNC5GvGzwsQqNaJqQnvXMcIXSBGjweOseI+k/QOLDq:Jp2o4msp+R4KNEzN+GvGzwsQqNrQnvMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777805937, "uuid": "24bd4d9d-989a-49b0-a727-e27a1f613a55", "value": 10964613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777805937, "uuid": "633b71d9-51e4-4d9a-9bab-a9efba1f7d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805937, "uuid": "6aa37c52-6c75-4b1c-a12a-7fc09a519daf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d1edf6-46e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777808882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808882, "uuid": "f401d58e-7e87-48fc-b144-2e74f7d79117", "comment": "Malware payload (Mirai)", "value": "e5b6598bd293a6afcb26c13269996043", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808882, "uuid": "69808b4a-7530-4a1c-9444-755187891ad0", "comment": "Malware payload (Mirai)", "value": "3f0077df5d36aecafa68980948fb55329f44b9ad9b714704f01a4374a0379962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808882, "uuid": "ecacf69f-7b95-4356-8b41-8e35c69d70bb", "comment": "Malware payload (Mirai)", "value": "e5222ab22a2c0cfc5bad9cc393f38c8bc15ccd45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808882, "uuid": "34d5ac33-b81b-4191-88a0-85684c6d12e7", "comment": "Malware payload (Mirai)", "value": "b09a943616209bfc9fe8b1bac949d61dfd17463f7cba29d13a220653af2f3d087d55f071520077c2f87192ee610c63a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808882, "uuid": "d623ffd7-0787-49e8-9011-addc9751e7c3", "value": "T1A593E842BD429F13C1C621F6FBAF059D3B166B79D6EB3202D921BF9023868DB0D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808882, "uuid": "7c1be1b2-626b-4ded-9b9f-a18caa41f5d3", "value": "1536:IV4F+8wMvh/zTjmCon3rqMGbUCiqeivkQGvu8DgYcwdxMUBACRa:IVSUujmCon3rql4dgk7vu8/M+Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777808882, "uuid": "c8f62a45-d997-404c-a6b0-df3cc728e834", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777808882, "uuid": "9fdf880f-f04d-462a-9cfa-c2803ffa6921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808882, "uuid": "38ec9264-58c0-4cab-bcee-77b10b03b741", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dfc522-470c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777825500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825500, "uuid": "24b21b4d-da24-4fbf-91b3-d3ed532835a0", "comment": "Malware payload (AsyncRAT)", "value": "41e0dc39cc6da98fa73b25326c3cf6a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825500, "uuid": "6a152e8a-a4c8-45b0-8540-aaf6b3507bc7", "comment": "Malware payload (AsyncRAT)", "value": "402dfcad45c1accc395ec18cc56d4dae549f30dfe251bdfbd556d7de42ecdb40", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825500, "uuid": "42df7d52-a884-4023-8b1a-6d2364fbb92f", "comment": "Malware payload (AsyncRAT)", "value": "81c8ca8881a4b44e57df5d39d51f5eacdbdd0769", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825500, "uuid": "1231647c-b4e4-4fe8-a86b-bd903408a217", "comment": "Malware payload (AsyncRAT)", "value": "48f432a72627044b554742cf7ff6bfe44989f316a9e75c137d7566e340d86f1b92a94c80ffc935e30275318328cce5d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825500, "uuid": "a247771b-c890-4070-8117-e2bb9ada9746", "value": "T1EC437C287BE58465D1FF6BB11DE66392D735F3534A13D72F28C8028A1623E88CE417E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825500, "uuid": "d9adae1a-5c46-4c30-b3cb-599384644d84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825500, "uuid": "1da35571-eb69-4767-9630-43c7c31cc19a", "value": "1536:mWOYjOFEjXQYoXegGGI20rFcbFZbfZLu6ajV8Ot+Ji:mWmFEGYGo2FZbfYj2OtQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825500, "uuid": "1e42736c-4999-436b-a84e-0072bf394be4", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825500, "uuid": "cebd8911-eb8f-48bd-8c9d-d15c6a3a4f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825500, "uuid": "80a83db4-c239-425b-ae25-4d27889efeb7", "value": "velocityy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20cafbc-470c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777825635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825635, "uuid": "6f0081ce-966d-401e-beb6-c1f6df4c57fe", "comment": "Malware payload (SalatStealer)", "value": "ce896c50fa1db2a4b70f189560bd25b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825635, "uuid": "2699463e-d544-4fb6-a7a2-ce9a51ede85b", "comment": "Malware payload (SalatStealer)", "value": "421f03c399e3bf9e2ca462094aebbbecf5e24c9907616aa90f9bc1695e18567e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825635, "uuid": "84f923e1-c5b6-4dc9-9f63-ff48041ec3a5", "comment": "Malware payload (SalatStealer)", "value": "0d86339009552f31ec23c9da1da95758939b47df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825635, "uuid": "4de8382b-67da-4607-b4aa-48eea16ab7d1", "comment": "Malware payload (SalatStealer)", "value": "34cf99ced115fc18511539edc16cb625a38103f00893819eda416b58cc015087328cc4cb0d1ccd98248c2cc1ff66b1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825635, "uuid": "7e6f22cb-e522-49a5-aad1-8dbf0bc99e41", "value": "T16146AF023BFEB05EEAAB97B4957466818525FC774C91808D31CD548B4F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825635, "uuid": "8b16bd84-ee5b-4ab1-b5fe-d76769aef411", "value": "3db7c3e97e1f43d793acbd41e7497fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825635, "uuid": "7e5e4031-188a-45b0-be4d-23ad13ebae27", "value": "98304:l23ufXKQOe/AsSH0yxNaWNoc95e33Z3nJdSQhweMTyh:V5OxsSFaEcdv9+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825635, "uuid": "a80058fd-7183-4a71-a956-414877b7062a", "value": 5452800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825635, "uuid": "2c4cddf8-7eeb-4f77-a07b-e30c657c22a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825635, "uuid": "b5b25c58-ed9b-467e-b099-1fe87da8bba7", "value": "DiscordFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadf23ed-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823931, "uuid": "a219c274-6dc5-4b40-935b-efb5abb8c89e", "comment": "Malware payload (Mirai)", "value": "32d9d437cd4627d3c3d0f3262b3b8cda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823931, "uuid": "9880ba1a-d567-480d-9853-86e0898eb66a", "comment": "Malware payload (Mirai)", "value": "422b1b0b779cf97166c6f793a825c7c9b1e1e78bbabd3b9d68066d967f79f02f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823931, "uuid": "0074d436-0b06-4cd4-907f-bd2ef67a41de", "comment": "Malware payload (Mirai)", "value": "7b9942b84834fb7bc2fe9cd8a54b25c30f106f8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823931, "uuid": "af6f5fa6-d803-44a3-b7c8-6f1404aa44d0", "comment": "Malware payload (Mirai)", "value": "448b8c841be2d53895e33ac1864ba8a8fcb150a844446e0bc7ba7609b99ce2d48a6948404cf7cdad4eb5d8339592e315", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823931, "uuid": "d36a51f4-eaf6-40d6-8c08-dd957f400013", "value": "T10D32C6079BBA6E97C0D0337302A30751B2A98F9275A0637FBE051C491EAA3446D2FBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823931, "uuid": "d97d6e9d-061c-4884-8655-17350fe66695", "value": "192:rYq8kOR1CQLKpOjxJHEJw0H4xueLMUG0bmF7ytURxdCiem:rtjTQxJkJRH4EeLDbL+Rx4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823931, "uuid": "74c2220a-8575-4b73-a9c8-1cb5409276d9", "value": 11620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823931, "uuid": "60e5dde1-4117-413f-966e-b736ee7a7b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823931, "uuid": "1474c0a9-479d-4ec0-a03a-37a3af432293", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe5e7bd-46de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777805814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805814, "uuid": "7d3e461c-a148-436e-a4a1-548ee9442793", "comment": "Malware payload (Mirai)", "value": "68213754dca8a1ab8bbfedcaac79f03c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805814, "uuid": "81c73401-c262-4918-aac0-b58014419c55", "comment": "Malware payload (Mirai)", "value": "424d17faab64bf784b813b81d27a29e4300cff4d26050785d70036fac8a5bd9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805814, "uuid": "151f3c95-c7f8-4b5a-b9ab-2ee12a76b572", "comment": "Malware payload (Mirai)", "value": "0f65ba6d2e48a7ee914e6075130276245a72cf75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805814, "uuid": "e19202f1-a187-4a28-b319-4a0a815c31b4", "comment": "Malware payload (Mirai)", "value": "4c8737ad43e303b2d1ece967c8cea923292f7c1e4c4b93e7d619264ca89c650b8536d32a02c9a8bc03b75cc7fdd69eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805814, "uuid": "4988e99d-f079-41c8-9760-2471e8183d4e", "value": "T1AAB3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805814, "uuid": "550f99e5-81f9-4b70-8795-53ed4da7f6a4", "value": "3072:hqiKVqVEpOFnYfG/7/0lZYz4BmnlsQatFbR17z9c7YfNpg0w0zPyf:hqiJPdYe/7/0lZYzWylsQatFbR1Vc7Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777805814, "uuid": "edb12416-2489-4221-add1-2c505d38d4d9", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777805814, "uuid": "68d798a0-ee4c-4ad5-b38a-191ad2730039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805814, "uuid": "349bb218-8e1b-4769-a60a-b3daa39430bb", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcd52e3-46e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777809599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809599, "uuid": "0cf7d1cd-394f-4ed0-a3a1-65c77bf41f4d", "comment": "Malware payload", "value": "89f50bd6a959252ce9055d88ae3c8cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809599, "uuid": "d3ab3a2e-20dd-421f-b5d4-648b96829ef5", "comment": "Malware payload", "value": "42e5a2dc48b0974416c1ebc522740d8e0ff73d88634d1637fd2db596e27cdd37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809599, "uuid": "a62d08b3-d660-4634-9c0d-d64c260816b5", "comment": "Malware payload", "value": "cb23a69a4d5b1d8eca3e9c22de5499db0f267dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809599, "uuid": "371fa356-a79e-4b96-9aaf-ace35e9ab04c", "comment": "Malware payload", "value": "883f37d646d689977427242569f45e0d0ce63044922094f49599a5c570698db65f8c90294dd8053e2fc7aeb69f8b517f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809599, "uuid": "4389b8a1-2934-4d4b-98fc-8e1c9fe1e06c", "value": "T170E56D4A788208F9C019B231C8E937907B7DF814072937D72695A2773E3BBD25D79B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809599, "uuid": "892a17e6-82f0-4d09-a015-be995d3f89e9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809599, "uuid": "ff72f9b5-245a-45a3-9937-b1855d600272", "value": "49152:ygUQuyJPM0V/CtI6e5ueeRFHk+G7hRhsI:y0Jz/gW5ue6KsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809599, "uuid": "14587d62-041e-466e-841f-df77fbbdaa56", "value": 3159040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809599, "uuid": "74c78435-bddd-475c-af8d-a1038001f7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809599, "uuid": "2d5b55f6-015a-41d8-8e29-fa39d08d2bd9", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385b80f4-4713-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777828330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828330, "uuid": "1200dbe2-f4ba-4526-b23a-ccbeaed2f594", "comment": "Malware payload", "value": "97cd652671b2f1fc65d021d9836b9aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828330, "uuid": "eab11b34-fe4e-4309-81aa-1262636b92a7", "comment": "Malware payload", "value": "44bf49b6427fb1a814a2e45e9b875e92674aa6ea1a36a1a7f1d4eaed68d64080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828330, "uuid": "1aec61d6-6a53-48b6-ac83-7113bac62f83", "comment": "Malware payload", "value": "e02cc04eefc9d259686e925ac3e2cc547d467271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828330, "uuid": "9359b688-7d37-4f74-9f58-23cc5853edeb", "comment": "Malware payload", "value": "a56ebc31b50a97f7a7fbbad26ea88f509029aeecd06a1a93564f8cfefaf2801a046254089673209839461e410b29f95a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828330, "uuid": "0c124061-84b2-40fe-b45c-f257bcb5815b", "value": "T1A1E623EAA4D473E4C9D38680664B57CE71E1E01E86BA6C2D3BCB2C426931E57074DE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828330, "uuid": "4bb193e3-c61a-468d-946b-87fe493a45b2", "value": "347edb80a29d2f15cdb44b553321ab3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828330, "uuid": "3aeb589d-7614-4b8b-89ef-6df89e219358", "value": "196608:slJnRjQpl/5lvY0ytsuxTnfyOnHsdfqZ9Nzbd8mxOwdIQIszADZmOptml/SA6f2I:sb27/5l5yxx+zxC/bnYwdNzADZ0YXjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777828330, "uuid": "34c54cc3-ca73-41aa-843e-7c62d0f5cce2", "value": 15158272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777828330, "uuid": "ce58576b-5e9b-42c7-b281-9335c63cd8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828330, "uuid": "13800371-573f-4f53-966c-b59b687fa9a1", "value": "Hotel of the Damned Desires.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c054ac9d-46ab-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1777783890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783890, "uuid": "a23981ed-9302-4698-89ed-c2310c5c6bcd", "comment": "Malware payload (HijackLoader)", "value": "2afb57251378f6e6ec7c166fe76c51e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783890, "uuid": "6aaecc26-1775-470f-90b9-af1faaeb6168", "comment": "Malware payload (HijackLoader)", "value": "46a53b80f897ff8deb7babd0549aea64c9269ddc68ef43e8960fb2271c5739c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783890, "uuid": "7397e91a-aecd-421a-966a-917b4ea293c6", "comment": "Malware payload (HijackLoader)", "value": "4f4a3c29bf3a12ef4e31c905694f63f1274bc6a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783890, "uuid": "60b4c81f-33e5-4102-9542-b5bdfd08e418", "comment": "Malware payload (HijackLoader)", "value": "bc1cf0f7bce56fa0e864e96c7076d871c0c4daa6758559e2846bff339a74fb66eca2bf243ac1c804217cf32f3f6a7dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783890, "uuid": "b0bf772d-0c3d-4bd8-b3cb-6f9ef8c46208", "value": "T181F4FCD195C38CDBD41A0A316474D9B7112A3F246B74A3CA2EB0F5B95ABFEC13F12816", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783890, "uuid": "753b4568-bacf-4140-9b2a-c20083b672e7", "value": "7a485fe51b5d2e1b8ee9e22c1d488fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783890, "uuid": "ba8ca9d3-957f-47d6-868f-e9fc0c01d3aa", "value": "12288:Skb98NVlrZQuNP2gdMz4MMMMMMf8XRD6D+InjioR4y:S4QZQufMz4MMMMMMf8XB6D+InjioR4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777783890, "uuid": "e213087b-14f0-4066-b727-3d02ad9aae2d", "value": 790568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777783890, "uuid": "bb01356f-9ce1-4eba-a76a-ac3bc06451af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783890, "uuid": "055895c0-6680-4618-8b20-d24a7aa36030", "value": "Zalo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3309a43f-474a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777851943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851943, "uuid": "f5a58125-4f9e-49fc-b85f-9e3564c014e1", "comment": "Malware payload (Mirai)", "value": "16dabc52723609dbed0a93a236bb6cf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851943, "uuid": "67f7d473-0961-4853-ab55-6f87193c4fd0", "comment": "Malware payload (Mirai)", "value": "46d4770d309b4fd9ae1944ceaf54da301525d18945815b5ea41a82b971ff11f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851943, "uuid": "aa81e2ec-1cb0-4fea-b393-4e08111cd1b1", "comment": "Malware payload (Mirai)", "value": "d219ca99931a35623148238f175702c42e154f10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851943, "uuid": "00a78528-de17-43be-b0bc-65bbaf4ec15a", "comment": "Malware payload (Mirai)", "value": "a6da93226846969c18aa55e2b318312820b54e210fdc8fe1adbc32a30408438a372bc4f330b4c1d9d2636e2959aaef51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851943, "uuid": "aeb8e4bf-9493-420b-a420-3ced0e94a0ea", "value": "T192B339C1B643D4F5EC1641306277F73B9A32F0791239DA97E7A49E327C92A51DC0A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851943, "uuid": "06ff128a-6252-43eb-a429-74886e3f07ed", "value": "3072:tbcWYdCLFaGFhu3/45g1jcV2wGNS+AMFfpz:tbBYdoYGFh0/45g9Yupz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777851943, "uuid": "e1a48e74-4053-48c2-99c1-ed5ca7a7a284", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777851943, "uuid": "397d93f8-5b34-4ebd-a5e2-e80fc5f66a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851943, "uuid": "3fedf8a9-d313-40df-8729-8792fbd0dae5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d896ea-4708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777823623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823623, "uuid": "34603f78-1530-4980-b414-0ec51ac0ad9a", "comment": "Malware payload", "value": "ed06f2ac6907f89a09f8bc5d6988700c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823623, "uuid": "72b5c889-0f2b-4b6f-93d8-b1a70d08fb0e", "comment": "Malware payload", "value": "47285209d74af7d839485d5abb7cddf8e68966b794e183a2288809434248517a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823623, "uuid": "7676462e-f407-4a24-9682-e0ded0a0a09e", "comment": "Malware payload", "value": "43673bba08b77e92188c10cdaace528422a78af8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823623, "uuid": "911b941b-c52f-450b-830a-ebce5b5611bc", "comment": "Malware payload", "value": "56cab49fd190d964f82f1e5a12ce790f85f8f350e651c338308eb397c389753e8eafd116b9de7ef2ba9e7ed2601759b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823623, "uuid": "abfc33c1-f42b-4e1b-b0d5-2c159b63cd3d", "value": "T16931F18EA0F56143C5DCDE0070E78DC86316B99161DA2A3AECC1BE67ECE9D547019B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823623, "uuid": "6fb8449d-3587-404f-91da-5df462096b33", "value": "48:saW0mbHqMA1lbQ5f3a4OcmHiwCo78R/qC6vuYb:CQ1+tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823623, "uuid": "5036cb99-80cf-48c8-89d2-44b86560149e", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823623, "uuid": "a1c7ed06-102a-40a0-8170-247a7bbe1d35", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823623, "uuid": "14089775-b844-4890-ba19-227108955acc", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133fd2c7-46f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777814953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814953, "uuid": "d56f2107-3d68-4fa4-abb9-9e4473248c4f", "comment": "Malware payload (Mirai)", "value": "66362c17e9315908b5da65639d913781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814953, "uuid": "2cea81e3-ed75-4aa5-a24f-2ad0fbb7edae", "comment": "Malware payload (Mirai)", "value": "47a764f5ffa7da798ee6c17e4e710536ff77ada387986c50f11c681ae614d6f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814953, "uuid": "cbb81ed6-f887-45b4-9321-5f6c898de9dd", "comment": "Malware payload (Mirai)", "value": "7a3ff09f1bfd01ba571f34542e02d4f725c611ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814953, "uuid": "154dcff7-08bf-4174-aede-16445db7ed44", "comment": "Malware payload (Mirai)", "value": "24cc7a6c146196f1440e1f4673bdeeaf0d13da8947d5968d7443075714e83d5b44be8882e45680906fac038aa6c7660a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "IoT", "colour": "#93B38E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814953, "uuid": "bafbc4e2-54db-4777-9175-39b442f45a27", "value": "T161769E5BA6B724BDC15AC470835FC263AD31345402713D7F7E449AB42E66E302BAEF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814953, "uuid": "3bf347ec-b599-4d78-ae88-d78ac092bdd4", "value": "98304:3wkOVY9Jf/A9rX9dpjoO+adreC9QUM7pM2monC39PH+f1XlV8:3yAsHZtApg3hCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814953, "uuid": "a62e621b-8022-4278-a178-16e7fb4f87d3", "value": 7734480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814953, "uuid": "9711f941-aa2b-4348-a587-122811c8be52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814953, "uuid": "bf12caaf-cff1-4a39-a32e-2bc8c9107ebd", "value": "47a764f5ffa7da798ee6c17e4e710536ff77ada387986c50f11c681ae614d6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582092e8-4721-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777834396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834396, "uuid": "8337d72d-b891-4066-99e6-0397089dae21", "comment": "Malware payload", "value": "c0ceabe37259b0d56e7ed76b8868314b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834396, "uuid": "b9b3d801-69b6-425f-a133-8693609c2c71", "comment": "Malware payload", "value": "482152fe0654b681fdf4d12f69c37c4531ca33fa2229b80ffa4dc61a85a9c2a2", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834396, "uuid": "e4dcbbe3-7d0a-4e9a-9e7f-61229c230ad9", "comment": "Malware payload", "value": "8eb6b8f5cfec7a52541351d2db541e140571e103", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834396, "uuid": "c89f7884-9219-4aa6-a2cc-2a8b3f5ee7ff", "comment": "Malware payload", "value": "1497263fb341433e60a855572e2d7b8c67bd67177b02252afcb3808959d0a9e79f40e655ed4f64a4af5ed3e2f4cd7c9b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834396, "uuid": "bf9240e9-c296-4d64-892f-9f2472f06e60", "value": "T1AF953A0B7C9108FDC49AAB3288F662D17730B8090B3273D72A916E743E76BE05E79755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834396, "uuid": "95fcec76-bdb5-49ab-965c-c926e9f6ba3d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834396, "uuid": "32aba41a-f623-4aae-8083-6948b1463496", "value": "24576:+jkz6z1HRBJ9a74DibfPkHnoHpUmYh3BXbnJ6Fhele5n92jU50e04v6:+jce1H19a74UfPInoHW5BbSO/Dy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777834396, "uuid": "ee6a4b9e-3bb9-437f-9040-5bae51bdb57d", "value": 1955032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777834396, "uuid": "e9176ba6-ca8f-4f4d-bb59-56fe523253ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834396, "uuid": "2a5b50e9-9c2b-4d08-ab20-60f865330f91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52169cde-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794442, "uuid": "bf7ce524-19fb-4d70-9d72-2ee36b3bfb61", "comment": "Malware payload (Gafgyt)", "value": "0e35a012c9b58e140dbb3fdc3a5eeb93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794442, "uuid": "889595e3-e8ac-4241-9ca3-ea6bbc88fb4f", "comment": "Malware payload (Gafgyt)", "value": "4917594dd27edb409cc7f3bf3de64633586e08121b724d420e2948c5a3182cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794442, "uuid": "69f035c3-a0bb-4621-ab53-70eee361002d", "comment": "Malware payload (Gafgyt)", "value": "cd308e2674b3240d03256c65d31dbd7b4d40fdac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794442, "uuid": "ac07c93d-3f69-4861-83a9-1e64d342e135", "comment": "Malware payload (Gafgyt)", "value": "2303c198fc71c2851e223696a3cc5cc9ab3e571893597a1ebf20b1b0156bdd2c6bca1a9b0fb17720a02d90fff31860d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794442, "uuid": "d3600c7b-92ba-4382-9ccc-b91edc7111ed", "value": "T17E631B03EA91C7F3E5831BF912A79B210532FD692E1BEE65E32D7CB48B124887117758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794442, "uuid": "74d53d6a-4360-4db4-97fa-d0063d733a7e", "value": "1536:ul00ZWjfMmNCRpOyamoaI+g9KIpcmUrm6m6IjVYCjEGmf4Rk:ul1ZWr/NCRkyap7+qKJhm9jVYCgGmf4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794442, "uuid": "ec9f394e-ae34-4b7d-b6d6-b362596af7e1", "value": 72763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794442, "uuid": "ab9f3556-37d8-4d97-be7a-5f3643a312fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794442, "uuid": "d3c01bea-992d-4d0e-955e-e66ba7c04d5d", "value": "i586.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c3292b-4735-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777843012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843012, "uuid": "9c3f580d-9836-465e-af91-a9f031a1bfa7", "comment": "Malware payload", "value": "8828c00967f01585ebf0de48a85c4a4d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843012, "uuid": "07a144cd-0b34-4af5-8cf6-75e5a3041668", "comment": "Malware payload", "value": "49eb543d698bfeb4178b60cf6d6c960e410d7209cc51c49350beb93df8117951", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843012, "uuid": "5363bca7-8c36-45b4-8b39-4960fe9f8404", "comment": "Malware payload", "value": "6d3cf29bf93732fadc9b87999cea1a5ebd917864", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843012, "uuid": "2f30cd28-ee8e-4eb0-9186-ea08b1b634fa", "comment": "Malware payload", "value": "e5318f4afad1c6bffd1ce0e506829f60c08870c4de5155e4f67e8450347ead7af37fd9fdb94e14ddd3a1bb0f0bc5421e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843012, "uuid": "c087fd9f-a8e4-41b6-9cc1-4fb6fbe4c966", "value": "T17008332E406B82F5CB2EE4793C83B572B74C5197D8A5085AAB1A3E1879D33C8257C773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843012, "uuid": "ec9c400a-931f-4d8b-a6c0-ce76dfea1ab6", "value": "1572864:At9IKPNP2BBYKRWYgZIQ9yQ0qv+sjJmXMDo5tfM6W1AOzXcDwk3Tv3kTKhSrb:AUKV+BBZRWlZ3v+yl8PMR1ASIvCrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777843012, "uuid": "9c3eb634-28f5-492c-b8ac-91b8a40b4e0b", "value": 77659095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777843012, "uuid": "2a2043fd-4e45-4989-a953-1ec0ae59676a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843012, "uuid": "252bdb30-4644-487a-8758-b2778c06ac88", "value": "$RI19WF8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50c508f-4716-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777829881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829881, "uuid": "551c41b1-f0e3-4f13-9ac4-640c704374f8", "comment": "Malware payload", "value": "c26bf258ac28759a077d8a7bd738d1b9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829881, "uuid": "f0e10bad-f710-42cd-8ecc-6ca1cd5533a3", "comment": "Malware payload", "value": "49f8988e9c979bb388074e1d58c0545cf0790bda7dd73022e64cfb551293e598", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829881, "uuid": "c91ed0d2-bd7f-4c63-9e3e-8fcdf139b94c", "comment": "Malware payload", "value": "963cd41866e24135bce963823542fb07941edf74", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829881, "uuid": "c502ea30-65d3-4e47-99a7-9400ff737298", "comment": "Malware payload", "value": "89bf1a38bd3e840f7faf7a10d7c5b8fded7d85cecd0f23f9394b6b974a55def001ce3eb0e85639c6795a78ecd151f98e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829881, "uuid": "54c80adf-9311-4984-a426-f6743c8860b8", "value": "T160136D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829881, "uuid": "8ca153db-5e9b-4512-9b1f-32b15f2e6461", "value": "768:bus9NyXsZztC1q9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bDHusZu/co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829881, "uuid": "db02b950-2075-4d3d-9fa7-c6ce53ebb0a4", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829881, "uuid": "171c466f-ba2b-474e-8c50-e082ee8ada73", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829881, "uuid": "f711d176-a1b5-496f-a0f2-f06267f6fa25", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cea2207-46bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777790998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790998, "uuid": "a576b976-eee0-4240-ab55-60653b90b790", "comment": "Malware payload", "value": "4cbf64c2431ea27dd6f7d36348c77d40", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790998, "uuid": "9ca249e6-cd22-4cb7-b394-8a420b52b8b7", "comment": "Malware payload", "value": "4b331e00611436f17176c7f5be7a99548e3d5cb007aa99d4ab5222ed27f6922b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790998, "uuid": "f2c1b39a-9785-49b2-8194-a640c35e1b76", "comment": "Malware payload", "value": "c8b1b11aefc3f70dff47f60db46dedde49286cb6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790998, "uuid": "8995fc65-0f36-480d-b103-f25827d9faf2", "comment": "Malware payload", "value": "0e71506083a64d0333dd83ac42390b8c93d79497174448674342a0ba10940c7c2afc23746d05dc38d9d88d62b5c79134", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790998, "uuid": "a90cdc3a-ad57-465a-9cde-ada2d874474c", "value": "T111C3208C599E44A6AB0F3824815B2E47EFBEE2170B0DC9C0B79DDE553F452A434BB5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790998, "uuid": "9660d286-7c66-495a-a87e-4e20eeadb394", "value": "1536:utVwmTEZc57wd3grvBpAC8RGNAAiucaO5JIhcF9d:e6LZc57AhIhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777790998, "uuid": "9ffd9245-c9c9-4456-b9c8-e92777b4d363", "value": 129275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777790998, "uuid": "44275ef5-1612-4f96-ae56-91899dc33abd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790998, "uuid": "89b4d019-28ff-4695-b6f0-3460b787cc5e", "value": "Server_X_Session_113.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026da497-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818361, "uuid": "8b08c5f3-0257-4add-ab84-75b0214b68c3", "comment": "Malware payload (Mirai)", "value": "02ab49279124f75b1052b6cd0fe138fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818361, "uuid": "2a312a5a-741e-48d4-aa8a-ebc6354fb8ef", "comment": "Malware payload (Mirai)", "value": "4bb375d6e841ea0beda350239c5a287631bd324f1c9562f26b9d82ce694e12dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818361, "uuid": "a8043845-5a2b-4b5e-8651-921f42f9becd", "comment": "Malware payload (Mirai)", "value": "53524284bd90fb55dbc6810a0929e361190eec95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818361, "uuid": "c2e011ce-ff1a-4cfa-a0dd-903474dab7c4", "comment": "Malware payload (Mirai)", "value": "d5f7fea4c384873fcf129999df222a781d7b4c9ef939dae1b4d195265a29c0bc1b83236f998a8eae25ac114ba4ffef07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818361, "uuid": "a1757523-7207-4789-8d58-b5744d7f2a33", "value": "T1B2934A02735C0E43D0A65EB02A3F37E9C3EBD59121E4BB89650F9B468275EB7154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818361, "uuid": "448d8feb-48ed-450f-809f-5f0ed83bab55", "value": "1536:lHToKdbJcWiGYpNcgdAasFa+wmqOYK79U6mt:VTpbSB8FgmXxmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818361, "uuid": "0e0816c8-922b-4cdc-9205-b99cc7d705a0", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818361, "uuid": "0cd0f1bb-f19a-48a5-a0d4-395a46b32929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818361, "uuid": "b2546649-e420-4651-80b8-7ad17b9ecf8e", "value": "runningaway.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa9dbac-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794438, "uuid": "773e04fd-b946-47cb-b7a5-146dc8ecb749", "comment": "Malware payload (Gafgyt)", "value": "4d2866ce28c81aa3860d4ab1d8449103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794438, "uuid": "1722d3bc-ec39-4be2-b611-e8702a423cfe", "comment": "Malware payload (Gafgyt)", "value": "522164a5354c1ff59baad75739cb63e725208cc897af6c1098e35a97656ed63c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794438, "uuid": "c298b589-d84f-47bf-bf4f-f20c69fd9567", "comment": "Malware payload (Gafgyt)", "value": "c5e4b548054c9d9858e9e5f35a6e0c4da03e2589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794438, "uuid": "664682e8-7ae0-4682-a0fb-93c65e92f198", "comment": "Malware payload (Gafgyt)", "value": "3fa4264f520d288fb25fc6057355ac5d3d860259b7d9d6b2950d5615e50600fab7a2cee56e1fd428ee53e24d9c43a3de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794438, "uuid": "8b1d3b9c-fd5a-4b78-ad86-17128f5020e1", "value": "T116B3961A7E21EFEBE268473107F38E3053D5629637A2A386F25DD7481E2128D1C5F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794438, "uuid": "567d60b0-51d9-4811-ad92-81d461597d93", "value": "3072:yyDWDNlHLcHq6Cp3DMjAaslm22/FLf6i8C0e:7DQr+qRaslm22/FLfP8C0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794438, "uuid": "083409be-a176-4122-b722-ff5e64988835", "value": 109342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794438, "uuid": "82277768-37d9-46f0-bf15-36361e1a9a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794438, "uuid": "bde1c0fd-9346-4b02-b902-970deae1ce76", "value": "mips.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd98e159-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818728, "uuid": "992431ba-c2f6-4872-8c03-ea3be17c24e3", "comment": "Malware payload (Mirai)", "value": "17fc8d94a99d4c37e8f2b1b74878787d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818728, "uuid": "e9641297-026f-4882-92af-bed76b22f5c9", "comment": "Malware payload (Mirai)", "value": "52e58818fc5ac53fdc6c45802f9844e642eb86b11d3f3d8c7ade2384e2a19450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818728, "uuid": "5d46cd41-c9a9-41f4-a8cb-920650340145", "comment": "Malware payload (Mirai)", "value": "a53cd1d3afab70ec26d82428952a2a486cf9a9b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818728, "uuid": "0fb67d45-5dc9-4caa-b741-15c622da1600", "comment": "Malware payload (Mirai)", "value": "6484dec3fd2aad38924693d8d5bcfbe86497532c4f859ec9f1a9a959d965f99d4c28dc41c72f73a580fc6e89a5bd378b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818728, "uuid": "e70e1b45-e2de-4842-af0f-1b8661c069e0", "value": "T1B0733A45F8C19B62C9C116BFFA0F829D372613E8D2DF320BDD646BA536C74260E3A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818728, "uuid": "b0a16628-1e70-4907-b6d7-fbca91d15c63", "value": "1536:+on9pZbm+14KqxsliwIiG8rl3uiQZ0cVtC6mZQx+zAsQZqJJPHHFq+h/HncQ:VZbm+WK/q8rciQZJqQx+zdikpHFq+h/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818728, "uuid": "b6bc94ec-f9c7-47cd-9e69-28ddb56862a8", "value": 79180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818728, "uuid": "b82b75d9-032e-40d4-b706-352cec42c868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818728, "uuid": "a0bbbeaa-1e4a-47e4-bc99-2f1f5d6bb02c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8e54c2-471d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777832628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832628, "uuid": "a068c8a2-822f-4bbc-ba70-c91e967c13af", "comment": "Malware payload (Mirai)", "value": "820f133d51a09c23689163faa66dba0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832628, "uuid": "19cbe31d-91e1-4c99-99b2-bbb04f3ad508", "comment": "Malware payload (Mirai)", "value": "544e1e374dcb7695e5967b25b2426a3fe24d6e95555060826188f6353f81e27a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832628, "uuid": "e601f1c0-df6d-4a5f-bf67-cd1cf440c880", "comment": "Malware payload (Mirai)", "value": "cb7237520383ae09d815675d54056a6dbe718e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832628, "uuid": "b5e9faab-c5fa-4dce-8231-ed68bbcab566", "comment": "Malware payload (Mirai)", "value": "6341cd72391b94628fea79c2bae34b901d83a5ee0d3f5ac2208cdec0eae8aa3c5c2d002650d94618f23fe414d72b859a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832628, "uuid": "36fc4bfa-982e-4493-8dec-ec7fd19cb94e", "value": "T190E32902730C0A47D1632EF43A3F67E093EFDAD121E4F644255F9A8A91B1E32558AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832628, "uuid": "7b854d3e-428d-476b-88eb-2c8ed2e54137", "value": "1536:ymkhwM6jfH233EEK1oVxTKPVxnm64Xo7WBil6pvAhw8T2m1/Iwtq6xf7B:ydioVx8rmg7iilxhi87B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777832628, "uuid": "46ab2743-b4cd-460c-a3b0-5f2992bb79d8", "value": 150420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777832628, "uuid": "b75486f5-d4e9-4a7c-9d97-0bbae89aa64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832628, "uuid": "0e381d86-342f-4479-96e1-3065e1452f1c", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4753a1a9-470a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777824489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824489, "uuid": "cfd8077f-614a-416e-bd62-305ef317c99b", "comment": "Malware payload (ConnectWise)", "value": "5ac9830135ff60ffdb6e59d09352cefe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824489, "uuid": "3086165c-7fcb-4704-b3f3-2ffe7edb0566", "comment": "Malware payload (ConnectWise)", "value": "559fc5631e2c0e9c9bedfb71102d2705a064c2bb83577b45f5279d7f2589848e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824489, "uuid": "8f0204df-08b1-46a4-9d86-888e79098b4c", "comment": "Malware payload (ConnectWise)", "value": "1a42216ac21744501fd087ee7f4edeae94c2f6d7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824489, "uuid": "7a72e69a-0fd4-404c-9959-9db9bd797af5", "comment": "Malware payload (ConnectWise)", "value": "c2102086af28b9ac7018f3ae75c9ec18a98ea3bfb2e20e9741da749f523870df643175fc47b81767667dafd6577596a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824489, "uuid": "86007374-baab-410b-9cb1-042634402abb", "value": "T1D8646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824489, "uuid": "f9ee1831-e210-4cc7-8ce1-d018793bc796", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824489, "uuid": "ad039942-e5bf-490f-abf7-2ad65aef6d13", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9P:R1iw7gryNkSV1hy1Z1u2JLu9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824489, "uuid": "61df876e-3dcc-4538-8811-3ffea1de9e0a", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824489, "uuid": "18e39abd-2d96-410e-9a23-f0b692528455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824489, "uuid": "31391744-40b0-445b-9662-f809eb46082c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccfd2ab-46e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777809251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809251, "uuid": "312e30f6-7131-4939-92e5-fe1a0b570b02", "comment": "Malware payload (Mirai)", "value": "f0c4442c64e47da1278e2c70c667e5ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809251, "uuid": "e7fb59c2-2933-4bd1-a456-b0f8430a9090", "comment": "Malware payload (Mirai)", "value": "55d07f2ce53a8f2842f6cff10f32e13bb35b4c6b62a10f2e5524ba45558f9ea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809251, "uuid": "4d1ed283-cfd9-4797-8160-6dd9a5ff7586", "comment": "Malware payload (Mirai)", "value": "7f5347dc8ea095ebbeda5c7f33f778e38eba3762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809251, "uuid": "a10fb400-4c57-47a3-80ad-f7015a8e0228", "comment": "Malware payload (Mirai)", "value": "292d72f48d97ed41af2e6a4d542cd1d06992d8780725762c62f3014b94d81c5b1806748e71cf0b13b7338e8318724e9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809251, "uuid": "a62e1b96-e438-41b8-9788-53f32c63535d", "value": "T11D733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809251, "uuid": "2bc543e0-ad37-49b3-b4e7-33a0a5ef4631", "value": "1536:+pwtq/0FORx0SFXyRwBjniiQv1MjDPKM2nu7c+GYgKCqWU3cgiK:+pv0QRxJcScv6fSMrjGYgKMEnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809251, "uuid": "2b4b2fd3-47ca-4349-b1c9-19a8246f0456", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809251, "uuid": "b1f01c19-5318-4464-a5f8-bf97a401786c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809251, "uuid": "b54174ff-dd75-4db0-b186-89cd2ecdcbe0", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d1934f-4717-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829996, "uuid": "526d0e27-37b6-4397-bcc0-79dad3500cc8", "comment": "Malware payload (Mirai)", "value": "64eac5dd188d216f7e6cb01a5af50eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829996, "uuid": "28ddfb17-0dae-45c1-a0b1-50271b11d71d", "comment": "Malware payload (Mirai)", "value": "55f85033a0d7edf9129de0a225780be60c93cdda4d69f031c55bed442238ab5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829996, "uuid": "9c769453-92c1-4e9a-9df1-acd8ac4a4213", "comment": "Malware payload (Mirai)", "value": "9c7aef5f323b55b41d98795ef1cc6cb14e86cc8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829996, "uuid": "efb13934-c675-4785-97a4-c6492fc61fd9", "comment": "Malware payload (Mirai)", "value": "e1bff88db83862432345ee62686a5c3cd16ebf76e2f21978b7655943edd67322fa8071f9794b328502da89b0fd8b7ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829996, "uuid": "62431e54-d126-47bb-91c6-2e307dd2c2cd", "value": "T16D14D70AAB510FFBDCAFDD3706E91B0629CC654722A83B357674C528F54A50B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829996, "uuid": "9512a0e7-1952-4b59-b75c-5cfaa61a0559", "value": "3072:CZMyR41CMZ3ump04vWOyJfdKLDMgPmEPQn:CZMyR4Txp03OkFKvF9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829996, "uuid": "945e92f0-0361-4ae1-9fb7-57b51ec0aeb3", "value": 202456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829996, "uuid": "5b421441-6181-4bf3-8708-6a6ac6b0d838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829996, "uuid": "61d7573f-5e1a-4e2b-b516-3a8bbc5831fd", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90df67b-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818318, "uuid": "84207642-3fd6-4843-a7ab-fd587bc2e79b", "comment": "Malware payload (Mirai)", "value": "0df3d0748768a0394a05d27b1bbb769c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818318, "uuid": "97900ac1-c68c-4c03-bb6c-64b989adf7ee", "comment": "Malware payload (Mirai)", "value": "570313c87ec20fefef12a164641621ab746b91362934a5f8a1553a615e253670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818318, "uuid": "ac8b7efb-8b23-4cff-a7a4-1e572b083b24", "comment": "Malware payload (Mirai)", "value": "968930982362cf137fc454d719a8c5823d50f21d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818318, "uuid": "d3eefa9b-37af-405a-87c2-b87a7742ab2c", "comment": "Malware payload (Mirai)", "value": "ad808476d533b9be6c8447343bdbd48c93d4cd3f3883384a265a7b53b383e318e3bcf4148dcf70ea50f7361dd41a87db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818318, "uuid": "cb4735ac-24e1-4d9c-b9bf-f91927e73c62", "value": "T12CC3BE97F68B25A1CC6147F007C76BDD2A6361029E2BA9E76C1F767F097A0DB19023C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818318, "uuid": "8a7b7d5b-3ae6-44cf-a0ca-3f0623608019", "value": "1536:MgHYO3xB954dBq3eMZZ8NEZsJPaTWqAYb0pDdep1kC6xZJ39gpS/LWU:MgHYO3X2qT9WJPOt8pDy1kCu9gpSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818318, "uuid": "b2739130-66dd-4153-a38b-5341aebfcb6c", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818318, "uuid": "855bfdc2-7709-4263-8e12-97e641f7a7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818318, "uuid": "7b33daa6-6b14-40db-a407-75e3afe753f5", "value": "runningaway.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b32a8c-4717-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830117, "uuid": "6903289c-7c6a-4524-9e4f-890a446f5f2b", "comment": "Malware payload (Mirai)", "value": "e7a32c6a1fa1776d03492e05402f041d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830117, "uuid": "a6a6068a-fa36-4f72-8779-3e2a3b107a30", "comment": "Malware payload (Mirai)", "value": "57f1e0a952fcea3a24046bc4bcf53ce2e9ef4fbbd36d83f477088215d206eefb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830117, "uuid": "f8c5b9ab-27f1-47de-a4e0-b48516bb0817", "comment": "Malware payload (Mirai)", "value": "2c7f2bb00f46a97f47d6197cc94128edfd16a13c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830117, "uuid": "cf7ac48d-2114-4a40-bb70-ee47a1bafd9c", "comment": "Malware payload (Mirai)", "value": "03bf116c689ac822a9351ed17bc13a7269b8c2dea28592e8ba73a3e033c222d68525397c4e347486e1a2401db7b05647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830117, "uuid": "a533ba10-228d-4d1e-8604-2acb251fa8c0", "value": "T109243B46EA418F13C0D627BAF6DF4245333397A4D3EB73069924AFB43B8279E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830117, "uuid": "6345b0b7-c68e-4989-b183-0850b7963d57", "value": "6144:7bkLtrvYJzaWXI6ase5gxJiaK2wTiPGLrKM/ReyNJMlmL2BggM2U:7bkLVvYVXI6ase5gxJBrtsrz/XNmlmLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830117, "uuid": "89a81e42-cad9-478c-a978-2dc61da33026", "value": 216606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830117, "uuid": "8c49b145-97dd-4cf5-9ce1-87d3c394408c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830117, "uuid": "f71dc373-bd6d-42e1-9101-03dbcde4ef48", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f5b1e-4729-11f1-a769-42010a9c0008", "comment": "Malware payload (UnixStealer)", "timestamp": 1777837997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837997, "uuid": "68d8e358-d5ad-4897-807f-694e9c89d5a8", "comment": "Malware payload (UnixStealer)", "value": "3b7a70bc5a21912298ff0faf2b2be20d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837997, "uuid": "fb9f186a-4f3a-4546-983f-57261053e558", "comment": "Malware payload (UnixStealer)", "value": "58165345738044d0f11554f8b8907830c537a1c9f9cb7c7e1015836d73b15f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837997, "uuid": "8bc6f8ac-cb84-4ca9-ae5b-ded680d3c6c5", "comment": "Malware payload (UnixStealer)", "value": "c572265ac048c7b540a05eb07158818d5a2e90ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837997, "uuid": "272e9a28-2b1b-464d-a2e6-1658dabbeaa7", "comment": "Malware payload (UnixStealer)", "value": "8417cdd33cbc9854ec6208c85d394d55f0d629b6d054beec84dd0e4e694651dca61b3bd7c21ccf071bc694c17ec4a0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837997, "uuid": "f970ab4e-0207-4450-907d-65f4a4908e42", "value": "T150C50102451C90D7E9AB37345059A9779370ED35B998CECEFAE980BF276BC421E38B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837997, "uuid": "faad7691-d9d7-4eb3-ab06-56ec06642f2c", "value": "32ff8d0a1b5ee0520474e4ca7a9c4ccf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837997, "uuid": "d6fb2ba4-9b8c-4590-83fd-fef0537d282b", "value": "24576:gS0RZih0oUQyc4dDTfHvJZ+IOfO49ssbhFwLZ8reboA/N2t675hbQ3+XuCML83iT:CJuQfK9XZk/k1t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837997, "uuid": "c9c7ba8e-0858-40ad-9b2f-cb0649c5affa", "value": 2580304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837997, "uuid": "69d249e3-80b3-49f3-b960-829270c145a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837997, "uuid": "c3374910-c8cc-4005-9706-44a9e27d074a", "value": "build_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c1b56b-4719-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830828, "uuid": "aba3cbf7-679d-43d4-9278-149d4c5d6d25", "comment": "Malware payload (Mirai)", "value": "8a755860afd5d38d382f8de29bb875cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830828, "uuid": "93967522-4e99-4bf7-b3bd-3c5a70cc4b26", "comment": "Malware payload (Mirai)", "value": "588bc2a91edaf3eaaec5cd99f2e8bb1dba21378c54d30de4684178f9c932a0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830828, "uuid": "d8ee42ab-9237-49e7-8162-de1cd31982ce", "comment": "Malware payload (Mirai)", "value": "b6ed61776dff4961d2fe53af96ccee1d5b5b0773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830828, "uuid": "6786f12d-9137-45ff-bb4e-dc838c3308a3", "comment": "Malware payload (Mirai)", "value": "3987b16c0cd004e31c1429a2c1108f3eeefaa1db06b5d385a0322a2cae70ef2bff05b592c83d3b3b8199f2074a681fe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830828, "uuid": "ea1366f1-033f-4add-ae2e-805fa5b7382e", "value": "T169335B09C713D5F0D9560470406FA775EF75AC326270EEAAEB983A26BC33B11992736C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830828, "uuid": "975a8644-589f-4364-aa3b-3f60a468af24", "value": "1536:PyXNJXsLovdONKgv8Cp4ILB8pRBcRgPN:K9JXsAOAAVERBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830828, "uuid": "4799379c-816b-45d5-8737-817155198bd5", "value": 50564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830828, "uuid": "20481a52-beb7-4fd7-a443-1dae13781fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830828, "uuid": "b3a156dc-53cf-40c0-aad5-41386a331318", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2121ffb-4715-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829393, "uuid": "803838f8-5060-4375-8c37-5a0b8a28c617", "comment": "Malware payload (Mirai)", "value": "7704077fd89f8f41c0a35ad9692a20ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829393, "uuid": "1aef4870-3ee8-40a9-a137-b1e4c9cfb73d", "comment": "Malware payload (Mirai)", "value": "58d7583df6a5d549ca98291bae9cd47af7a984a8e81145edf5e659ce808eca57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829393, "uuid": "7fb003c4-1495-4228-b6b3-453e7f257695", "comment": "Malware payload (Mirai)", "value": "853900d304928c6d77a0e56fad906b9695c1dc93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829393, "uuid": "4fd1879a-cae3-4e19-acd1-365d7b7f50e6", "comment": "Malware payload (Mirai)", "value": "06e7ff601a19582305f2120d8f7d21630ef829dbcd0dddbc5d21739bbecc5c0954fc8c520ccaf9bbbf8849d630ccd556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829393, "uuid": "779282ac-97a6-4de8-af04-203bf763978f", "value": "T184F31B06F8818B11D5C112BAFE1E128E37131BB8E2DE72039D246F65778A97F0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829393, "uuid": "8be21e95-8fe1-4e87-8145-c1bdc58f8761", "value": "3072:y1EUX2xlIg9ZJ4UCNpQHXVIwCG3aObAP+hM3feq8Tv:y1Dmxqg9oZ8HXOwC4aLx3f18Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829393, "uuid": "36963600-35d0-41a7-8a86-94f590b3fa45", "value": 164604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829393, "uuid": "5d34a95c-1836-4f98-a53b-d024dae26c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829393, "uuid": "3d4d86d4-af03-46ac-8320-a5592d4818ac", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fb2e6e-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794441, "uuid": "6e7bb103-3ad2-439d-b6bb-f21352a0f257", "comment": "Malware payload (Gafgyt)", "value": "a19e47fa63c04b334e031267bd598102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794441, "uuid": "04de975a-3229-41ba-b27c-91d78b502bd8", "comment": "Malware payload (Gafgyt)", "value": "59b90917e151c92a64daadeeb30b4c6b826104d987f81c09fab3053f3822b72d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794441, "uuid": "2662c1f4-7004-45a2-a788-99e6d1d4cffd", "comment": "Malware payload (Gafgyt)", "value": "eb57b2a4d1a6d446c2a4d9ac16efaf19cab38e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794441, "uuid": "7b6a4f03-22d5-4424-a7d3-b80e8f64d7e3", "comment": "Malware payload (Gafgyt)", "value": "ebf52788f5532b6277753327313f2357282a61b2815713bf02f89a8c3b1d13abfe9ef9df969c592b60b26c63bfb91ddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794441, "uuid": "d5bb77e2-3759-4f79-aa0a-34a0f44d97ba", "value": "T1B4836C13E552C7BBC4E78BB907C79A315433B8392B37720AB7E8BCA92B069D41D59704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794441, "uuid": "01bb6272-e006-472e-aae7-8763addb5a96", "value": "1536:dMsIXkIMya3XMVA9RxlhbpE8ioWBb36Ye0MzBtm/I/uYVjXGAZcne:8XkPysp9RxvbW8io6T6Yej/mg/uYVjGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794441, "uuid": "8578c548-6cd7-49a0-b88a-db30a50ef6b7", "value": 84962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794441, "uuid": "a026a1cc-21e2-456a-a794-cf3a4fae2e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794441, "uuid": "55d0fd60-bd07-439c-8345-0189aa720736", "value": "x86_64.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7372ed-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777794435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794435, "uuid": "362511e7-7a57-4490-8705-5d3dab23b943", "comment": "Malware payload (Mirai)", "value": "d9f0389b63398eb3c6aab6ed8acdc06f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794435, "uuid": "600a860e-b07f-48e0-9b64-2ad426ee7049", "comment": "Malware payload (Mirai)", "value": "59efbdbbfa5a6c65a5a7214b33e0b7d727534f353db32e34290be170a90c14bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794435, "uuid": "4e641df0-b20f-4ada-93c8-4d9b4a61161e", "comment": "Malware payload (Mirai)", "value": "a38c9bf3f2597525f58c0dce2a91d04aace09005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794435, "uuid": "0d78e66d-6318-4ca5-b89d-44736fdf995f", "comment": "Malware payload (Mirai)", "value": "855fad18fd5d1313508533ef8582f59499c96694bf5b0297f5c05ca3d284530c2a80702a3f59d1b3ad87a271fc783f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794435, "uuid": "4821c2dc-138e-487f-b52c-585f2eb2da34", "value": "T1FF93F759BDC19B21D8D465BEFE0F519D332317B8E2EF3102DD146B25368A92B0E7B811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794435, "uuid": "71b7ac2b-67c9-4e13-9038-29f2c51f6d0d", "value": "1536:CwnzofeJOrzjN8dY+ojFaX0iEHaIl9PXoIZUdyupKHcVtC6m9B0jAyS+pYfq+29A:CfeIjydY+oj0X0/T3XoEUNpKyCBWAySv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794435, "uuid": "fc83e7ff-0b13-4654-b39f-1a3dceff2857", "value": 96800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794435, "uuid": "b1df85e4-d615-4f40-a675-224aeebcee2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794435, "uuid": "eabb09be-5bbe-4b7b-8698-d4d80bb44d85", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f31a55-46e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777810209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810209, "uuid": "b9b35772-7447-48dd-95de-57ca49828983", "comment": "Malware payload", "value": "bdf14fe162363fc2678b0fe447520bcf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810209, "uuid": "80d1a8af-315a-44c1-9c69-fe59e1de69d2", "comment": "Malware payload", "value": "59f5bae69d3b0751fc31c24367c1920c4786e945eb44dabd7a7b84e69ce52442", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810209, "uuid": "c9f0fdec-4208-49d7-8210-76bbd94ec8e8", "comment": "Malware payload", "value": "54be496f4ef1d970bc88a51dc437ce7490e062af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777810209, "uuid": "04bd1215-7d10-4186-9412-d1d253db4486", "comment": "Malware payload", "value": "6ef3deac102b9a4d1d082e949e5ee41afc5191055c1d17a906be86d2dc1ba06e6e9b6b2640203792de5e3e7e875b73df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810209, "uuid": "f605a7d7-a1a9-44e6-8420-74ca9fcfaae7", "value": "T1B5137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C496DCD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810209, "uuid": "dc5f7ca8-8460-4efa-987d-b2f161b0efea", "value": "768:bW+V9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bW+Gcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777810209, "uuid": "5a1793d4-2c8a-4dd9-b5e8-4e337f92e959", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777810209, "uuid": "018e87ba-4b60-4ab8-aa83-24c2c8102f70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777810209, "uuid": "e2dc771b-67dc-4b79-846c-5491f3b49435", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a84429-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777814519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814519, "uuid": "d75df96e-72af-4e3c-9223-720bde628494", "comment": "Malware payload", "value": "d01e04fdd1c8e652525f40a7211427d7", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814519, "uuid": "90471bd8-c705-466f-9844-5f5ab4ef8a1e", "comment": "Malware payload", "value": "59f7224229c1ba50c0caa5edf51b2726b876f18f2faba099cb948ba1fd21bedd", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814519, "uuid": "206ee53d-8dc6-450c-b3ef-c2a6581ee5a2", "comment": "Malware payload", "value": "ec7fdc52b39211dbe8db6b8324c372ccd1480972", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814519, "uuid": "c1e9b739-4621-421f-9159-8857e283dbc3", "comment": "Malware payload", "value": "9473ab1a7f0807cd1ba970d6bd63b03b0c6180e6b5fdd0d9165ea9cc9c0acb8bebd30514256148cf0a25f5c73b44ab1b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814519, "uuid": "b50ec097-7d73-4730-adbd-b9423d2ae2da", "value": "T1FD954A0B7CD108FDC49AAB3688F262D17734B8080B3673D72A916A743E76BE05E79745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814519, "uuid": "c874697b-d4e0-4a17-bea1-0bfa0b37c740", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814519, "uuid": "856260d5-6722-409f-a59b-116edca376be", "value": "24576:D0OUkTnjN8SLnVXi98ic5wtgRoeHcrKHRf+EAf6Fhele5n92jU3ve0BgO:D0lkTjN8cVXi95c5wa+eHAmEEZOyDiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814519, "uuid": "77e5b674-48c7-4a2b-9131-edd24528dc8a", "value": 1961688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814519, "uuid": "e6440711-9cee-4699-b450-e737d2649c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814519, "uuid": "c20f2b0f-8905-4cdd-b028-9a6d89e9d8ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308ae108-46d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777799540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777799540, "uuid": "bd7e4d6e-48f1-4344-abd4-09f5ea52ef01", "comment": "Malware payload", "value": "34f0f812c8689f2fab8cddc4b2186d39", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777799540, "uuid": "51b25c68-f633-4b5a-b1fe-bbbf9f0f07fc", "comment": "Malware payload", "value": "5adab377fb31ff952a1b85ee8d768fb52aaff3ece99ee03fc1ca8b8bd1c7c15c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777799540, "uuid": "19f5f8c4-eb91-45fa-8b93-c641d9523d03", "comment": "Malware payload", "value": "de170755ce7341d7bfa474364700b5f72815cedc", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777799540, "uuid": "096c45f5-9fd6-4e05-b46f-eebc6a0439f2", "comment": "Malware payload", "value": "d0fc18d5afeee6096f74c90e50cd29379b852921410c283f0f10cfb44aa983cfe5871e45a78e59a337b04b8bf798ecbf", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777799540, "uuid": "b1ce0ec3-f969-497a-b563-8d2e6431bacb", "value": "T141A55A027CA041F9C099B33294F67696FB20B8580B3937D72F916B742E36BE05D79B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777799540, "uuid": "e740ee84-cb60-449e-b509-2b066375a7b4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777799540, "uuid": "6bc40b21-8152-43c6-b422-3abe1b18ec0c", "value": "24576:ldQKZVHiHHDvYg2j/9uXtox8VSUHmLxEEpvE/1X4nhele5nK23UdjmgtRhn:ldvZkHHMg2jVuXt1HGSm6kdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777799540, "uuid": "d9d3df0c-36ab-4077-a888-731b8ac1f154", "value": 2233560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777799540, "uuid": "758e9926-13c8-415f-8c99-8091c1b0befb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777799540, "uuid": "28193329-dfd8-4414-b2ad-5bb6977d486b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d5e6f3-4688-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768598, "uuid": "502180e3-709f-4bac-be2b-e6ae4e5114f1", "comment": "Malware payload (Mirai)", "value": "63ad3f19524b635919751120250f27ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768598, "uuid": "6c62732e-6add-46b9-8c26-7b7737c87240", "comment": "Malware payload (Mirai)", "value": "5be3e94b8cc808d8491804eb840122e2f693c465ad732dcac1ed3826cb464d4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768598, "uuid": "787bddeb-306f-47b7-9685-990451981e21", "comment": "Malware payload (Mirai)", "value": "1ed7714d21ad4caca7a4c9eb744f13f98326054b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768598, "uuid": "c07b545f-f02a-4386-b8ab-f67e7534cd9c", "comment": "Malware payload (Mirai)", "value": "a620d8d2d519ffb4cbb9891a0dd172179171be4f9f8bcd1746cbb2566bfa1a73bc16950438d085c15dd3b8c0ea3af43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768598, "uuid": "50a7c4e6-13ff-45cc-ac2e-e22cc16401f6", "value": "T119E56D62AB87DCAFF6A903B407F389B473E8A06331758DA1D36F760A1F25194451DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768598, "uuid": "2952dec6-87ae-40e7-b266-76f6929a6e80", "value": "24576:5yvvxt+By31LMVi6vJHdSQcUsjJ4KMebOUljYFsiSenWgQPuIMA9PP/rqp7vO:Wxt+By31LMVi6viJ5nEfsVuU9PP/C7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768598, "uuid": "2fc77938-7972-44bb-8960-717822297ed4", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768598, "uuid": "a6a455bc-18f9-4f54-9fbf-735d99732287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768598, "uuid": "a4345744-4e4e-46d0-b1d8-8f16265d4241", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc4983f-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794465, "uuid": "824cae72-6049-4bc9-86b9-dad26cdbc4fb", "comment": "Malware payload (Gafgyt)", "value": "32faae2b5be5f2332932df99a85e8acb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794465, "uuid": "376352b5-d664-4d1b-bd15-11f82c971f79", "comment": "Malware payload (Gafgyt)", "value": "5c58b38e197f31f5f9f4e7dac8549ebe2de00c9d8aaf9feece74d903aec42ad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794465, "uuid": "25414601-aa6f-416d-8d1a-46cef54337d4", "comment": "Malware payload (Gafgyt)", "value": "040caa646518581c654b7f1473b878cfe38ad037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794465, "uuid": "be7cfe7f-f9f0-4beb-9e75-324c646ea17d", "comment": "Malware payload (Gafgyt)", "value": "bb529c4fd427f6c5295473084e2ad90e5b5ca53b813cf21899374774486472593d36cd9ad973b75013be9782493fe81e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794465, "uuid": "eb392f4d-498a-4b15-b0fb-2b92cf8b1f1e", "value": "T19D830B41F9418B13C2D327BAB7DF476C3B356664A7DB33116A287EB42B867D81D26320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794465, "uuid": "3654923c-1a74-4721-8274-59bdc4156306", "value": "1536:SRTzsKYoRI/Ko33j9Va11nDGs6tS1O4f7iYIJcqr1Crm8HqQmb/sGwXXee:mTjYEpoe118tS7iYIJcxrm8HqQmbUGw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794465, "uuid": "53536176-c908-437e-b7da-6b6db7b5dc0f", "value": 88403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794465, "uuid": "5d296de6-945f-425e-887c-6fede1e453b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794465, "uuid": "9dc215ff-4312-4f54-b85c-3d2f05d74d2f", "value": "armv5l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d380d06-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777807641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807641, "uuid": "a49f5c32-3a8d-4cc8-a21e-752a86faca65", "comment": "Malware payload (Mirai)", "value": "283708fd2ae8b0b4837040bfcefdcdd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807641, "uuid": "9e408dc3-cb48-44e5-83c4-17fe6eccf194", "comment": "Malware payload (Mirai)", "value": "5ce8a6de9a4d8bae9d6950aa64b31bbdb76c78d8bcfcc720878575c6ad14b2fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807641, "uuid": "425f0ce0-e54f-44e3-9735-cdf66b02fa0e", "comment": "Malware payload (Mirai)", "value": "55de84613e1e4c0dca220e99d611530f1214649b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807641, "uuid": "1d495986-4abc-4251-84d4-27ad844bc7cb", "comment": "Malware payload (Mirai)", "value": "c57b89c517c3cd3a1e1f888e131c420296aa3c6e50e428376299e3233af37ffc0dd001f69a2f5523b83630d91ed04c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807641, "uuid": "15fe40bc-e60d-4c15-89fe-b7296355fb92", "value": "T17F631B07BA428BAFC14FC1F407F76A399922BDBE0A36F1E5E3A4FD865901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807641, "uuid": "d342e799-ebef-4b4a-b455-30c3c0caf1e8", "value": "1536:GnHkHRxHBFPSWGzHGAlGy5TGpWE7wH9OXEL9q/:mHkHvBFVGzHIytJE7wwXEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777807641, "uuid": "212fddde-8ee3-4546-9477-5c4e1bf3b629", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777807641, "uuid": "0f22ec4a-985c-43da-9545-1083c2ddbb14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807641, "uuid": "16bf1fe1-6939-4b00-a1fe-2246c54d59c9", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8193a3-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794460, "uuid": "f80df775-fee0-447a-9bcd-3ac9717a5f7b", "comment": "Malware payload (Gafgyt)", "value": "92a7e09cf05deaf4f917e2c3ef4867a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794460, "uuid": "f385174b-d13e-46dd-8021-506869579746", "comment": "Malware payload (Gafgyt)", "value": "5f5cdb6397ec7e1a4c4fc2e20566cc5351bee56a9693d1791861a416deaee932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794460, "uuid": "66aa22a9-9436-4306-93b8-0f2b7520e894", "comment": "Malware payload (Gafgyt)", "value": "9bdb8458b53a8d8a208c7fdbf7519fd45b8dfe6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794460, "uuid": "210e3782-b4d5-4b16-84f7-2305dc3234a7", "comment": "Malware payload (Gafgyt)", "value": "fce75b6c5e912e8c8dd717d3c5fc8d2599d0f207ade5121abaffc577bc6bb7c037b453499cfa11a310d64e159955c789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794460, "uuid": "9740475e-1430-45a5-91bd-be1a50693f9c", "value": "T1B6E31A05E7408B53C5D2277AB7DF825933239B64B3DB33055A28BBF43F827994E22616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794460, "uuid": "e28741d5-91a6-4310-a042-a7035241e474", "value": "3072:P8pxUxL3+aueO4xarU+fj47m+FCapNM/9ioKmGwZvhQAxn:PgxUd+aueO4orV47fFCa/M/9irmGwZv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794460, "uuid": "779f48db-21c1-446d-93cb-49db36a6e6b0", "value": 146668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794460, "uuid": "5cf41113-be54-4934-afc3-de3c08278d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794460, "uuid": "0ae99eed-a093-4b56-b14f-8daebf8729cb", "value": "armv7l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ded844c-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777807643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807643, "uuid": "80b86473-a9c0-4b3b-b211-dde453dd623a", "comment": "Malware payload (Mirai)", "value": "98280a590ad6fcfbb5e3d4c33042eaae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807643, "uuid": "5b2c5bd0-c4b2-4182-9bd9-0507c4b0a0ff", "comment": "Malware payload (Mirai)", "value": "5fb0916f8b37829de00fa5a051f19f596ebfee5194c4f67047b5036f65205e68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807643, "uuid": "58f6f969-db6f-412b-9cb7-4a9be4880a72", "comment": "Malware payload (Mirai)", "value": "d5ced219614f7d5d9c5a4b3ac9823bc9646b1188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807643, "uuid": "57d0aaf7-456a-4a5e-96f0-edb3085e90f1", "comment": "Malware payload (Mirai)", "value": "d720c2cf5dfd52567d59f4142c2578e7f81c76dbce6c0eac00ad6cf7fd270ac7e8317f02eb60046cda60b2c6b71ce889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807643, "uuid": "ca4d4313-e7c0-4044-bebb-211d48b9b5b0", "value": "T1D3A30887F902DE7FF80BD6BA049309197520FB660E530B76A367BD93AD311D41926F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807643, "uuid": "9aa26e5e-49cd-44ca-8f5d-f2f1c3557cef", "value": "1536:3yT7fahnRWBuk8ycato5P1068Fx4/9W0aU5f9ZYjrAldWG8lQT/x:3yXyLY8ycatmP10H4DaQ+jG8lY/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777807643, "uuid": "cf2cf586-ed50-4740-9f24-ec531b747e19", "value": 99676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777807643, "uuid": "2831c41a-17cb-402f-8483-8906ca8a3de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807643, "uuid": "19a71250-f65a-4ae1-a14e-788dfdffe40a", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57702552-46e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777809054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809054, "uuid": "d004e367-f733-4fd9-9a9c-ef740d0c9597", "comment": "Malware payload (Mirai)", "value": "2cede25d11c6e786b5df19d7f67dc58a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809054, "uuid": "41e37c55-93fe-40f5-8310-3606ec0d062a", "comment": "Malware payload (Mirai)", "value": "6078db0bc70f54d1aedd48b4e609acbaf2955e5a7ade2a3595763d0478d38ef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809054, "uuid": "f0820d46-95dc-485a-8757-8cc8bdd7a542", "comment": "Malware payload (Mirai)", "value": "829422cc2f7c2b0c5187e023c8fbb6b1797cd680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809054, "uuid": "52f01a64-1e7f-4fa0-baca-6c7689a6259b", "comment": "Malware payload (Mirai)", "value": "22615cd7774a4271b5fb63bdb5e6360fc1f8182a038d2c0ac942810b59bed8977d1aad82f96943a33717e68d63eee07b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809054, "uuid": "92d78a4b-33f6-4314-b21e-63cd027bac87", "value": "T135E4E50A6E729F3CF36487314BB34B24D6AD72E617F1C585E29CD5055E2028E192FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809054, "uuid": "f2dd4e0f-18c8-4e38-936c-e25966a5811a", "value": "12288:+koo9FIR0u+hfZbPfscWMPUwVTHbQxm4desR8JK01+6:vPIR0u+nPfgM8wVT7yDx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809054, "uuid": "72cf11a5-b0df-4a22-961f-a3b2733ad50a", "value": 713172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809054, "uuid": "9d2d7897-c7fc-4700-a0d6-3a1190824937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809054, "uuid": "0646d4d7-cce6-4b56-a3ed-e7fc15522f24", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b798908-4704-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1777821919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777821919, "uuid": "7a6384f9-cb93-4102-a968-3f14121b342c", "comment": "Malware payload (DarkComet)", "value": "5cd11b0a5cc2460fd9762d7c44467a53", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777821919, "uuid": "f34e383f-d424-493b-9cbc-e99f2e49f224", "comment": "Malware payload (DarkComet)", "value": "6090fe5aec71d6047fc74967df405d5fb14a18d3eeb83449227c95c9d2fb0948", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777821919, "uuid": "a49fc36b-edd6-418f-9466-89454e25162f", "comment": "Malware payload (DarkComet)", "value": "e5dfe7e3bdee0fa5fae27845fbf890d971f45183", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777821919, "uuid": "6e4a45ea-8dd6-4889-bdeb-2f05496f1ef3", "comment": "Malware payload (DarkComet)", "value": "708aa39514b83fb32ccdc13849c31c80c65a9db9cf2e26bc99b0620ca8fee81e50fefdb4b6b188bb98f8158a7d9c9237", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777821919, "uuid": "35d013f7-a041-4427-b963-02646d9c3bf5", "value": "T1C7F46C31B5808433D92239F89C5A92F5542A7E242E29794B76F53F4C7A39183FD162CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777821919, "uuid": "438f100c-a9d9-400a-b4a3-aa4c99a363b4", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777821919, "uuid": "43611b99-0986-4da8-89ec-99396fa482bd", "value": "12288:X9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hMvvNVR4:xZ1xuVVjfFoynPaVBUR8f+kN10EBavz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777821919, "uuid": "0cb787e6-f91a-4a5e-9480-2620457f82a4", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777821919, "uuid": "304c6064-186e-452f-ae25-c3d6d107f47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777821919, "uuid": "965793f1-d992-465c-9094-3e11a9715df4", "value": "Firefox_Update_Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f762343-4707-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777823107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823107, "uuid": "40aa0bcf-1885-45e2-846e-4f9987385695", "comment": "Malware payload", "value": "e0a5caaf878e3649ae419cbd9b647306", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823107, "uuid": "cb2ad625-5f95-41c8-9ee5-dbfe20c0b9a2", "comment": "Malware payload", "value": "6158b2b1f3f55185f859b3026a947a8e65c2d064be4a507d1f8571b5aa53b018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823107, "uuid": "8fe85e0a-53e4-4d82-bdb1-71b4d30c414b", "comment": "Malware payload", "value": "5bb91b28334fc3f0a25a2160654607642f5af826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823107, "uuid": "ec293307-c731-4bd6-801a-f87d5a2af096", "comment": "Malware payload", "value": "b9a3649d8b8f49ee974bed6416fdef233764d40e24e2067b5a47fd670112a0ee5fe06084d67311128341d726570770ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823107, "uuid": "598c6581-b940-427a-b6cf-3e251002736d", "value": "T1C3242353885607BFD79072BEA66012C7E1D06C760A2E84988EFE9BFC049157A6DD8A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823107, "uuid": "f61730c2-97bf-42ca-9269-02bbdc5b1a3a", "value": "6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRH:jEKT2wcEt0JCgox5KzmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823107, "uuid": "bb86d302-b012-492f-a518-1d905c8c7b6a", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823107, "uuid": "8f22ab45-bf05-44c2-a378-b41f8dcfdffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823107, "uuid": "0c560b60-bccc-44a0-afd6-d457502105c1", "value": "6158b2b1f3f55185f859b3026a947a8e65c2d064be4a507d1f8571b5aa53b018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84f0a07-46dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777804976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804976, "uuid": "73e16ba0-78e6-4355-8381-66d32f8659e0", "comment": "Malware payload", "value": "afb3febe792a8da3933b688e1d3c797b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804976, "uuid": "0b970866-7ce8-49e9-aac2-15b05f848202", "comment": "Malware payload", "value": "620011df3e196f3b088c30e6469fca150eeafd302e82e003eabaa672d06fdd12", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804976, "uuid": "5f2366d3-de20-42df-9b6b-d2a18141633b", "comment": "Malware payload", "value": "fb9a1c7d863f107ecc4af7702fc51e988a3abe3b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804976, "uuid": "68c8bae0-aa47-432f-b488-b7afcd685018", "comment": "Malware payload", "value": "bfe09e3fb273a73716d83cdb7fd918c97dc500c54901accb4420b2e1b8d4196574cde1bc2316d1f67ea88268932dc998", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804976, "uuid": "c5ba9074-5d9e-40f5-b425-1627562aab3d", "value": "T169D3F3C88A9E88708F1F6079151F6D038AADD22B122DCAC07ACEEF453F456B475BE4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804976, "uuid": "26a5716f-f4c4-48d0-b0aa-4687eb5a9697", "value": "768:FhHbWCT3iZmLXkx7NGhov909kEiRzGbuP4QK2yEl696o606V6ly/n0CvKsYDEE+B:FhSCT3iZmLsnB/jbc+1c/fJNczL8jK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777804976, "uuid": "932a2534-1165-4c7a-989c-d220aaaf7fa9", "value": 138058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777804976, "uuid": "af67bf06-ff18-48af-b59e-59fcf46d22b6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804976, "uuid": "a2a5999d-2a8a-4253-a9bb-e0b213142807", "value": "Nova_Backup_School_9443.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddebc5e-4687-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768343, "uuid": "ef3f51c9-e5cb-418e-a6de-34f1b716ed34", "comment": "Malware payload (Mirai)", "value": "01e09bf08bff9f36d78a38f66305b611", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768343, "uuid": "975a949e-a0ac-4ab4-ada3-8d46e0c927d7", "comment": "Malware payload (Mirai)", "value": "62818417f373da1e38b671da98d6257792a5741c1bb15732c8fcf3cbc6151973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768343, "uuid": "abf8b0a3-290c-423b-894e-edb81d99c87c", "comment": "Malware payload (Mirai)", "value": "903b61a212b93d8cd43e63d8683f10b8e2ef71f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768343, "uuid": "bd02f62c-8349-47cb-9957-f9e5aa221164", "comment": "Malware payload (Mirai)", "value": "046f0b148aa960b0c36b8a1376364fccb80b4c5cfad0f63f2123cbe42a3b2c1dc5c250155faffa8bbdbe263ad3932658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768343, "uuid": "9935a2f4-8968-489f-951b-e45dc650552e", "value": "T1F2B56B43E683C0F1EA1206F11117E3779A399A154136C9A3EF98AD39AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768343, "uuid": "35caeada-8f9c-44eb-8e60-a2242eab5789", "value": "49152:1cWFRqwygnToEI+OUQsh7Z+ztqMcApmkVDenJ:/RCgQK7DOpmzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768343, "uuid": "dcc7a793-b27a-43c7-bc29-e64d2baf823d", "value": 2396028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768343, "uuid": "3abe39fc-1072-4ade-80a2-e2c0c268f9d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768343, "uuid": "6023551b-27c9-441d-9f0a-527360cb653d", "value": "ciubuc_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597d7738-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794455, "uuid": "668484e5-e8c9-41b5-846b-6db19a754d19", "comment": "Malware payload (Gafgyt)", "value": "b1298ba569230d58070c96569ef66fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794455, "uuid": "97403f8b-4985-4b5b-a737-cb827df96dd7", "comment": "Malware payload (Gafgyt)", "value": "635f2018d0ce660b97aca50ec3266d24fa1df894ded6ac810d9ab3cbc0e46e85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794455, "uuid": "862e6e9e-e325-40fa-af31-386ac5722e3a", "comment": "Malware payload (Gafgyt)", "value": "f3fe178931071d51e6bb6d158f7b96f955eada88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794455, "uuid": "48fc4cd7-ee34-4826-87ae-81c12e90c28d", "comment": "Malware payload (Gafgyt)", "value": "5720cf748c4dadcf2771018ead600c4b3163afc582f1ff9dc6d566838e66de6bb142e3a01c4bf7e490ba7cfb4bbf3d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794455, "uuid": "3e002a7e-3d8b-4c2b-9e00-a06fb8ccef12", "value": "T1EB732943B70D4B43C0676EF41AF76BF18769BA6126DBA244B10DFE844772AB05813F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794455, "uuid": "5ebba323-9a41-4caf-ba03-3ab764dc6665", "value": "1536:VQUwofDORiU0SecWTorNNMKT/wHi6dKSOKmXEVMXjfbfLXe:+sCRqcWTorHkjqKmXEVMXbbfLXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794455, "uuid": "13788d50-3904-484d-b6d5-a1cb4a52acf1", "value": 80682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794455, "uuid": "8fe19183-d1ff-4c3a-b0e8-36a42353a38f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794455, "uuid": "b0d4ed5e-8270-4e7a-84c2-bf01c930ffa9", "value": "ppc440fp.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d1666e-4716-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829525, "uuid": "3c607b9a-403c-46f5-b773-1f8da0c879a2", "comment": "Malware payload (Mirai)", "value": "b8ed373e8ed850ece0ab8b7f537d3f35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829525, "uuid": "a350a5a4-f951-48b8-a1b9-654fc2989830", "comment": "Malware payload (Mirai)", "value": "648eed57022930c2031edaa55e324aed4898bf5b98f87cd57c4ba50829117ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829525, "uuid": "66cdaa64-cf6c-48ef-87d7-7a0860bd7ef7", "comment": "Malware payload (Mirai)", "value": "9bca59b84787c5ace2daaaaedb5ddb10a572a84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829525, "uuid": "44b2edde-c4a1-4d3d-8d3f-9f106360bd19", "comment": "Malware payload (Mirai)", "value": "f76667e18b9c626b9fc072f8203f0a1b5ba65fd88b1525177ba2374ba9da77ebf783469529f32bd704d5e39dda92ce77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829525, "uuid": "5c1c0bd1-b177-4108-b887-d7207d5d738f", "value": "T1EDE32A45FC414B27C6C612BBFB5E428D3B2A17E9D2EA72039D216F21378795B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829525, "uuid": "93de0275-776c-4697-892b-b92b5743dcea", "value": "3072:Bw99zBJqseZjj/Y2jkk8K64UkQ4go+3swPGecFs:a99zgZ/A2jbJ64UkJgo+7GecFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829525, "uuid": "0c535b08-8f23-4a18-8d74-251692bd0750", "value": 152352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829525, "uuid": "f36a9561-0851-4fb6-82a5-a743841f7f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829525, "uuid": "632ab994-ae40-4ecc-a13a-063dfe7ef6ad", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de51b9a-46d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777802596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802596, "uuid": "7bd4dec3-5a24-4b66-9077-ce3ebe0d1575", "comment": "Malware payload", "value": "cde2092af00f81f799057b3a52ac08cf", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802596, "uuid": "407df701-41fc-44f4-b0d2-97220ac7e1fa", "comment": "Malware payload", "value": "64aafee5bfc69b4818922dc9c609f6eae637392d53a0051fb1801fa56e7671e7", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802596, "uuid": "b143c2f8-207a-4838-95fa-8502e7e34039", "comment": "Malware payload", "value": "0bcc4066d90e1c669a02b032b72889ba580c3873", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802596, "uuid": "e7033b5e-f62c-4951-889a-dbc2ee93cb18", "comment": "Malware payload", "value": "ec834d36835fed5f6d68618f0b15446813547b3d5a6f6201879ab228855fea267cec734b8c88d1b1f7068c43c1bd9ccb", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802596, "uuid": "6b219804-eef7-494c-b44a-703cffc94abe", "value": "T120D63326F5D219D0F7583A1D7E3BAAB8C2C428E529CB3E308191E075BDC47CD637895A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802596, "uuid": "a3b93af5-b51a-40b8-9d59-65b9b7c0eb3a", "value": "196608:hvdzcaQepYxBKo5t/2HsQV8qDnQkN0nSLQrmqAvCwmg6ZxFQWiBKsq8hJS:hvdzcabYx12vprtcmqw1mgkeWihhJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777802596, "uuid": "3f170500-96ce-42c9-aa7b-6b1c93d4bfe2", "value": 13211966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777802596, "uuid": "ed7f87fb-eb8f-4c75-927b-a00ebba9bfd8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802596, "uuid": "46c0497b-fdd2-4000-99d2-def95a59b22c", "value": "Setup_x64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08c5b9c-470b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777825203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825203, "uuid": "d480b755-e468-4648-a35e-df71b6feea72", "comment": "Malware payload", "value": "6ae314f8aeb96d6b24f65ddfe774c914", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825203, "uuid": "797a1a35-628a-4c7a-8ae4-7507a8e054bb", "comment": "Malware payload", "value": "64af163ca7bb37c54b3617c1938a56f975d748e2dec0ea86f63206e18450aa64", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825203, "uuid": "f9fc9c44-24d6-44f5-abef-af04f8728498", "comment": "Malware payload", "value": "fb65bbe7bb1e2147a666d30bb3b2d35a5875aa14", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825203, "uuid": "02d81c0b-028e-4215-b695-6f478cc00c5f", "comment": "Malware payload", "value": "fc667b882fedb5abb59654e2e59eade33e7966221d896c8d7bb51ed734ed6e865f066fa67f13c29a01be4a00290e833d", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825203, "uuid": "68c8d04b-48e8-4e46-aefa-7ae54ab8c24f", "value": "T1FD46E101B3E695B6D1BF1638D87A52656634BC049316CBBF5394BD392E33BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825203, "uuid": "966d89cf-ec6c-4a2b-80f9-4a9c7ea8ebe2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825203, "uuid": "043e034c-41b8-45cd-b13f-f48782ecced5", "value": "98304:dzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:dhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825203, "uuid": "8da619fb-aec5-4384-97d8-94f8f0ce26d0", "value": 5658864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825203, "uuid": "4d0b1753-037e-4436-be2b-760427d2739c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825203, "uuid": "e1c13439-e53d-447a-b4b2-acf6d3766d64", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fccd7f-472b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777838848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838848, "uuid": "1133ecfc-4fe0-4218-9144-afe8e92ed58b", "comment": "Malware payload", "value": "7cb79778425a1e6226b510f6cd196258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838848, "uuid": "6d371720-1869-43d3-8801-a380c9175741", "comment": "Malware payload", "value": "65fb4dbc4139471d0b512e72b3d96e18aa840cde86dc4ff3a0abf9aa477ed8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838848, "uuid": "d279b5f6-fdc7-495f-b04a-fe44306f4868", "comment": "Malware payload", "value": "d14dc8cb797e8662ae5f3614392a0391cdb7571e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838848, "uuid": "678a47c4-9f19-47e3-be70-96e372f22c43", "comment": "Malware payload", "value": "d81f478dfe926c20927a71158035d978896e093a84e7bec6c13a0c26865f3d093ca81e187e6d46ef1c37e1187a67effa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838848, "uuid": "c4ca92ce-b654-43cc-99c4-aca8c410b220", "value": "T16E668C0AA7D40AE4D167DE34CA628332EE717C425633C34F1695E64A1F336A18F6BB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838848, "uuid": "74a7d042-5ac1-4457-8761-492dda6f605a", "value": "4bca3404aa9eb40d8c3a810419dfe620", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838848, "uuid": "5ed92d6a-4874-4dd7-baf4-99c87a9ba28e", "value": "49152:eb40Sp83rdQs/fPFrS5ZoDJ99FmR0JGuuVfeE03qEeFCmJiPc1Y2okWWJ3MECLRv:eBqcuZotiVGEJVzYL7ZDbQn9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777838848, "uuid": "8770e16c-666f-49e9-a4d9-f95818149fc6", "value": 6855168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777838848, "uuid": "08ae212e-4b14-4f78-b9a3-9689d0912f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838848, "uuid": "5af21bd4-12b9-443b-ad25-99fd4aa99da6", "value": "79eb4631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aa20fc-46dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777805099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805099, "uuid": "7d663961-8e27-49ed-bcb0-060ce78ff1e1", "comment": "Malware payload (Mirai)", "value": "54b34e1af2daecade4f31bc4ca3f6f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805099, "uuid": "0e169c69-0e01-42a5-8dc2-2d9832f421a4", "comment": "Malware payload (Mirai)", "value": "67417cb7c4ac41da51c724730d37f15f3dab0a08a1b6410661f8db70449c1dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805099, "uuid": "26f24031-f77b-43d6-8bb6-b01ce207db70", "comment": "Malware payload (Mirai)", "value": "614fb0b97cdfa989756011ce778b380e2836101d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777805099, "uuid": "a9317d4b-b8cd-46d8-952e-06ffff808fc0", "comment": "Malware payload (Mirai)", "value": "96825f59ac7851ed0dad47fb0de59e59c7356e21e3da9b9f5ea66ff8c7f98ac87c58d10dfbf6719584c3e0fc74b99f2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805099, "uuid": "4a71e340-16f0-48cf-b9be-335ef387ab79", "value": "T1259329227E761F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805099, "uuid": "35b1c967-d624-4de0-b84f-b6cdb0121ee2", "value": "1536:5y8MSzlPyzhCJuWsZIJH11SYIZDptbwgENWq5+/sAlhEtIr:5y0A2j/SpVBJENlzQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777805099, "uuid": "5ec3b5c1-f9b4-4cc7-b7e9-21c4375fa431", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777805099, "uuid": "a19e0abd-ec30-41fe-982b-6f3bb01afbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777805099, "uuid": "cc1d3b05-6030-455c-9a41-0e83ae25bf22", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de47f4db-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818730, "uuid": "edf0ce93-6aa3-48a3-baa6-d2024e8ca603", "comment": "Malware payload (Mirai)", "value": "30a72f49bb2ec012cab26fd58f3d41af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818730, "uuid": "01174997-9088-4fd1-98d5-9b4f57808b14", "comment": "Malware payload (Mirai)", "value": "697a35f958553313fad25cba0d3b831cbc5af0376a7a612fb07093c0acce5a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818730, "uuid": "4ce7d666-df2a-477b-b319-6402435928f2", "comment": "Malware payload (Mirai)", "value": "a6e702b26a1223d5610b2cdece8107e51a2109ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818730, "uuid": "96f605b1-8d4a-4f18-95a1-262fdee660d9", "comment": "Malware payload (Mirai)", "value": "6567b01c7cde6783176ec0738184eca38c6d32ca0735e4cf137fbd139168b675696db9017a96a85bdfb67b95025d940b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818730, "uuid": "d0485056-05d8-4f76-92bb-d333af7cfd3f", "value": "T1C8F37386BF903FFFC85ECC3241A5CB0A169C995913947FBA1A74E504B68B10E99D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818730, "uuid": "92d8c537-81a3-48a1-a0c4-2ac9e7f07f1c", "value": "3072:rgU76M6t9q6uqoWAiEGcjwrn8EuPwcDncs9:rgUuOti6kn8EuPQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818730, "uuid": "6ecaaae1-b3ac-41dd-8add-1dc96e4a57ed", "value": 170064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818730, "uuid": "c1ea8c37-2f96-4bd8-b813-ffebf59adde6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818730, "uuid": "e92cc153-875c-4be8-b15c-317e5d64d4e2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b90f72-470e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777826496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826496, "uuid": "9191f452-4786-4259-960e-b5261343ecf0", "comment": "Malware payload", "value": "3849c6ffd11e31e02408042444556f81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826496, "uuid": "9cc1550f-54b1-4176-a897-070a89c20719", "comment": "Malware payload", "value": "6a5ec52e415211babf3c31f6b2f775821287f86802f8b4b303580334ebd056e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826496, "uuid": "ae504c2f-455a-4f53-9ca3-2ccdd45535b6", "comment": "Malware payload", "value": "46bdec0ece788279f38a8b9698150469328465bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826496, "uuid": "087fabb4-31f5-421b-bed3-fd18c3d3a0d4", "comment": "Malware payload", "value": "d194e75f8ab8b5fd345af93b7909743dcd3a0aac9b667dcd237f3148a646c37ede37d3148fcccb9fd66dc2da0f261543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826496, "uuid": "38c16457-0066-425e-a32d-f68d5a90febc", "value": "T180B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826496, "uuid": "fe4cc9e5-3306-40ec-859d-26b65eb4d93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826496, "uuid": "836b9cc3-fe9f-4ef6-92ee-00b3ffe48e47", "value": "49152:IOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777826496, "uuid": "b6dd6309-e4f3-4d49-b355-e64f52221e9a", "value": 11236352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777826496, "uuid": "8e70a0d0-1567-4a6e-826a-3eef17df79e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826496, "uuid": "ffeac148-c3ec-41db-b812-12262ce15db8", "value": "YvA0fSUPIxVjsA2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc81c297-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823934, "uuid": "26a2c99e-d916-4d06-825d-839cf1009ca1", "comment": "Malware payload (Mirai)", "value": "ed2061e0cdc6754aad1a3904eaa3a3a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823934, "uuid": "36e91b7b-bc28-4d7f-80fa-719b8240defb", "comment": "Malware payload (Mirai)", "value": "6cb946727a8ad88285f7335efb7763d7f3447ffcafd421308bc96e3bcdefdc7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823934, "uuid": "517ea8df-ce68-4029-8f0c-2122b0453dd2", "comment": "Malware payload (Mirai)", "value": "d6db800ba926d062b0a716684aa7b6bd815fff7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823934, "uuid": "0ce544f6-e32f-4e87-98f8-0b9bc163581f", "comment": "Malware payload (Mirai)", "value": "8b614324256c7b8b0c1cde7e0ef50be556835d4c384cd146dd4fa38316bb7557070ca8b16387201d501a9b84054c632f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823934, "uuid": "24bedfde-e605-4ffb-84bf-e753d8a95c35", "value": "T147C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823934, "uuid": "1358de35-2293-46b1-86dc-00477a0aac47", "value": "1536:qxUMZ4Ox10MLEKQ777ZLag4RvAnjSLtROj6+cTRq6SyNOZP3detc:q94Ox9Q7vZCenCS8aItc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823934, "uuid": "9b59fe84-39d0-4cc7-af0f-620ca76fc392", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823934, "uuid": "0f730ebb-041e-43d3-baa6-3210e1b5ab8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823934, "uuid": "07e32fb4-6ee8-4cc3-984f-7fec5dd9f980", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01e530d-471e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777833362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833362, "uuid": "0815f0ab-917e-4a25-b62d-2088452868dc", "comment": "Malware payload (Mirai)", "value": "1d8b75d9fbf7f79776889982c3eb2cd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833362, "uuid": "a6f68bd4-c12d-4ce4-8103-247dbbf2bbbc", "comment": "Malware payload (Mirai)", "value": "6da0119c77ab207e20ddbfafdfe08ea40980433e8f18d915f3a3e95a90aace55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833362, "uuid": "ef542ce0-1964-4082-94c5-6be759835448", "comment": "Malware payload (Mirai)", "value": "ab642d2d359314ac645b53c35a4ba828beea310d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833362, "uuid": "1b8e1192-06ab-4e68-bfd5-4d145451bb43", "comment": "Malware payload (Mirai)", "value": "8f354c3df386033cf8bc9f4a70712a184d5d047d90013c44885a880d4e00ba21f7f4cb79c039ba541985ab521632f478", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833362, "uuid": "f587ee0d-ddd8-456a-843b-85f8e9ce8b4b", "value": "T15DB1B1C812A318717DF68E67B169CA24B8C9B181DDC58F80D0EDF4F9198CF09B954AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833362, "uuid": "cce2ba65-2214-44c4-87cf-668e41caddbd", "value": "96:2RKhEcfEnsTE11CxPCx9uqQY0MWickGyE8go:2MW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777833362, "uuid": "526f025f-5721-4713-913a-460b40bce6d6", "value": 5155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777833362, "uuid": "8ec20c04-30ee-4726-b4a2-f50e45a15c38", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833362, "uuid": "9ca95d4e-8da1-4cd4-a21a-ad042a5e5892", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba11c9c-4689-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777769252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769252, "uuid": "594674ea-c62f-403b-b889-17917b5817d1", "comment": "Malware payload (Mirai)", "value": "49f87bc139fbe3f78616034a0c3655fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769252, "uuid": "7e3b37fc-e36a-44c5-a848-a7de911edad0", "comment": "Malware payload (Mirai)", "value": "6ebf284fa478eea961bd4b8a04fe7772ed1334b3153ad4382accef88615d3721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769252, "uuid": "2ba4f7c1-c273-451c-a3c6-fc54e6692a97", "comment": "Malware payload (Mirai)", "value": "f08c1243d251e14f3fba25d69a15079b9927e22a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769252, "uuid": "1e2d5107-77bd-4def-af7e-b8c34fd35a37", "comment": "Malware payload (Mirai)", "value": "7f7e1a2be70e695eeb551ea15d3643586e61902622b2bdebfb69ec2ea61e511c7366b7a6548cdfebd5175cfc304ffaad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769252, "uuid": "90c8c1ed-df6d-4d86-b5be-cff2243cf379", "value": "T1D2C39D32D8396DC4C1945434F8B1EE711FA1A5C441A25EBB1AD5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769252, "uuid": "84349a07-1494-43f3-acc8-cadd2a05e7bc", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYMYaXgDe6u8KSgnMwSMwm9rFHwW:6f5Z5Z98XdmVMJaWaXvbjSqSMrHQwEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777769252, "uuid": "9149ce36-aa67-448a-bb8c-01e86899fa83", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777769252, "uuid": "1698bac1-591d-40bc-8846-badc971108b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769252, "uuid": "25fb0bf2-1c55-45a8-a996-5be561a11def", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e74ff2f-470c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777825494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825494, "uuid": "43f63796-a854-4d05-8698-c512a1efc701", "comment": "Malware payload (AsyncRAT)", "value": "c952c646f010f7eb8cdd3fe08eeaa0f2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825494, "uuid": "57d030ee-b91f-4728-825c-c6e42de9038a", "comment": "Malware payload (AsyncRAT)", "value": "6ef495994d3720f50bab5b813b65486fa0f4052e674eadf85979f5f347e7bdaf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825494, "uuid": "77b4cadb-ad4a-4878-a2a2-4c1ae2724f88", "comment": "Malware payload (AsyncRAT)", "value": "b4f4bd50247197989a26fe3cb2dc931759f6b0e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825494, "uuid": "7413452b-1ac4-4725-9a2a-4eea0d6b4dd1", "comment": "Malware payload (AsyncRAT)", "value": "9c7e050936dc97a911123b75c7331316778dbb47bed58ac1ea16876a1f857ca7eac25e632791480e5ca5b9d354234bb8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825494, "uuid": "1cdf60cc-f0c5-44ef-99b2-debc0ea8b6fc", "value": "T12326336D1166132AF7942D7F22A8C265D1EBBE79ACE1DC3611CCD22266F309C253D339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825494, "uuid": "c4c97612-bef9-407a-8ae6-3d754a5850ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825494, "uuid": "372159dd-eaca-4351-8976-b116e021a3da", "value": "98304:9zQXP73m0Ic6rCe8hmoyTZeCN/Zh3dASYunecLVeMQfYNmVRyDjVI9xRurIR:cm0IcGCe8h9yteCN/fdJY4bVppj5IbsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825494, "uuid": "6c978a35-59f2-4e49-87a0-c32d4f5bf320", "value": 4708352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825494, "uuid": "6b9c6302-4c46-4949-9c7a-d5a9f3f55023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825494, "uuid": "251b7f72-ed43-4486-89a0-f4e39f2d31bb", "value": "zalupapenisher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b23c01-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777808026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808026, "uuid": "094d0463-4ac3-4e5c-9182-49d5dbaa1ae9", "comment": "Malware payload", "value": "508e8237cc18ad6d607ea016573d740b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808026, "uuid": "8d01ab69-99a5-46e2-86d9-b95dba583ac8", "comment": "Malware payload", "value": "6f5f0c735eea2e9600ba3758b0a41d16fd76fbdcbac96a17248cebd95480345f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808026, "uuid": "872d3594-a3b6-443d-8916-859c48e6cf31", "comment": "Malware payload", "value": "f712453d13c32cb874476572533bcdbbeeee6546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777808026, "uuid": "7f2d1f84-0a80-48ff-b286-9e3f05dfbd27", "comment": "Malware payload", "value": "6168a1449dd07b988666c2610b09d59659174c47238833b1f04d3b82f2620a569a8dd3acacf1ec7f6d57cc7ca7c918d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808026, "uuid": "87930c97-f251-49fb-b24e-67a6b2e5c6e5", "value": "T1A6F5744BBA3940C2C1BEC03DD642DA1EFCA134D6C3B6A7DF96914E562712BE4AD39341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808026, "uuid": "b0046201-188d-4613-bdce-1edf2b567728", "value": "3cddb41848ce0bf23eb76c604680a700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808026, "uuid": "489f7025-bf91-4be7-82bc-ff6cd02e9504", "value": "49152:4waVbLtYCfct6PpyygdxVeka0rLS68My:cZX6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777808026, "uuid": "f0a34ada-4d73-4ebd-8cd5-e06d727bf03f", "value": 3368448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777808026, "uuid": "49dfd617-6327-4e86-a8a7-154fcce8f228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777808026, "uuid": "27801099-094a-44ee-bf73-cdaab14136bc", "value": "ApiServer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1b40a8-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818535, "uuid": "0b2965f1-a36c-4dff-8de5-4ed4845ccedf", "comment": "Malware payload (Mirai)", "value": "05fe356c7de6ab49f32a7f1b6c9624e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818535, "uuid": "55458ba3-c34b-4557-acd2-10e459ba7e1a", "comment": "Malware payload (Mirai)", "value": "700c126319226147b2defca7ac0590ff8b730d1d76ed522b1b084ee2fb06fc96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818535, "uuid": "570c36ec-28ef-487c-beac-24ea051c9037", "comment": "Malware payload (Mirai)", "value": "7e30950168f31d8a8d9cfa2e4c6013b1c3489700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818535, "uuid": "ecc98c9f-767b-44e1-9816-2b6d54da8b6e", "comment": "Malware payload (Mirai)", "value": "f00902d3fe314de45933974e7719eecf9332fa647f530436d99696bd034678e1f13f0a7e7fa9cdcdbfbc522e44ae679b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818535, "uuid": "64d27916-ea4f-4c6f-b6d4-5477a098b537", "value": "T1419339037A8090FDC459C078477FB636D523B0BE063AB29B67C4EF266D49EE05B29752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818535, "uuid": "5358c4da-9263-44bd-970b-0c118da9d078", "value": "1536:qjF51lZZ7ocHcF+e78GcRp+txECpzkRoRU44BYIRQybKd:qVlZ1HHc8Q8GMp+3EC6Ro0BYIRzKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818535, "uuid": "c18e4026-2f37-4c6e-b02e-afdbfbae4428", "value": 89776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818535, "uuid": "9761d0f2-d644-4742-9e11-6f5ddc2ab44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818535, "uuid": "ee0111f7-781a-418f-aaec-498d7e5bad09", "value": "runningaway.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a7af3-471a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777831317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831317, "uuid": "98b7a9a8-07cc-4d5c-aa12-530525e85d25", "comment": "Malware payload (Mirai)", "value": "1bc3939bbe75f794f36aa4891c9d2d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831317, "uuid": "1a49b435-0994-4aa3-81af-af8c04a78c68", "comment": "Malware payload (Mirai)", "value": "7070ef731531745e7b95e6a25db474929c79147f343fb93f4509c91b446e7783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831317, "uuid": "6a0be95c-adbb-4bd6-8a55-f94a8600bd67", "comment": "Malware payload (Mirai)", "value": "31471d6c3fc98ef47adc561ebba5c2ceb15b498b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831317, "uuid": "18ca5a27-d482-41f9-95f8-df860ebc2ab9", "comment": "Malware payload (Mirai)", "value": "2307f9f2b16cca5c80098ba9b0424b32998260845091ba3c1b7199ef3736d782542c7bcb659ae9b576dc44bc99f40756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831317, "uuid": "30700ef4-0b6d-4bb8-8ac6-1157a1cd0167", "value": "T1A02339C25A03C5F0DD1506BA60375BA15FB688366A29F987F3F93B75AC127118B0F29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831317, "uuid": "f5d45aa6-3c1f-470a-b051-4405f47a1c9f", "value": "768:LM3NofJzDlmAtrkA4YaYkq4M1g4gB5fKvAVKmPcVzX:eNofJlVt4AvroImPOzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777831317, "uuid": "03caae86-4245-4263-b5fe-80f5e314defe", "value": 46768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777831317, "uuid": "22691d8f-e108-49cb-9dcb-72ee40ab8d7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831317, "uuid": "5a6d7978-d578-4d91-918f-e8b0e75fa4f5", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dadf0d4-4716-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777829761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829761, "uuid": "232edc3e-48a5-4e06-8e6f-5d8a673a198b", "comment": "Malware payload", "value": "a904e68ee3f84d9c991d5e9ce75e341c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829761, "uuid": "bd439de1-a02b-4364-88ae-677387b563b6", "comment": "Malware payload", "value": "71911866a66869d1124889296d42b9ca65b79c2ad7a6a76ea03264c8c6765efd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829761, "uuid": "696f26d7-f4b9-4956-897c-00f2e632e173", "comment": "Malware payload", "value": "b3892990547cb6f60ef51bf0e967a05e0af5710f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829761, "uuid": "d30691dc-bd26-43e8-9e78-550aa89e763c", "comment": "Malware payload", "value": "ed4f8112820a2d740b572c6082885bcd7418dcf32e2abd3f3c341d3e6544138846af76dbd69cdbb1668753a7d17799d6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829761, "uuid": "a543eacc-f138-423a-869f-a2eeeca2ee7e", "value": "T1BDD3F1886A9A94B04B1F7568852F9C078A9DD523031EC8D0FECDDF997F225B1B1BD4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829761, "uuid": "045fdf29-5b93-4d5a-a6d3-1675cd62c471", "value": "768:ZMULEFx09vSaebqnSeoyKkDOASoFryboX+sWYFa6X6q6e6f6PAl9ekB8aedCOErK:DLJ7enTk/DhnOpvSD/ivY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829761, "uuid": "094511b1-6780-4613-853d-b674d6b40d4a", "value": 135156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829761, "uuid": "6d53fbfb-af7f-4e60-83f2-60ee2f4bd2db", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829761, "uuid": "27ccf6c2-d01b-41b1-af6c-68a6d809247d", "value": "Internal_Release_New_3888.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649e1268-46ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777819814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819814, "uuid": "e26f2ab9-d9f7-4587-abb1-02394af27319", "comment": "Malware payload", "value": "1cc9c3df1758a6286454eb87c0da1d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819814, "uuid": "33ecdfe9-9cb5-4a1d-8035-a8bd30580725", "comment": "Malware payload", "value": "7862853aa29be4fb42d4c1e980aee38e2688dbfdb7e58dd4065fa5816a653d09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819814, "uuid": "1a861ff4-c6e2-4ab0-9896-ea21bd091b5c", "comment": "Malware payload", "value": "f99f16284f5c6356fd605be0df8d86e1f0cad00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819814, "uuid": "7134fd68-f3f5-4cc4-a17b-a2ddaec6d669", "comment": "Malware payload", "value": "c8398f3e431414df8cad60945733561a77205cd8c3c997ab06158e4374c48df1c343fdf3b8f60c95f6833fb370bbc7c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819814, "uuid": "c41cc937-49ea-436d-96b6-eb3121b3107b", "value": "T10E156C4AB6A514F5D9BBC13CC942550AF9727C924770E7CB13A04A9B2F237E0AE3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819814, "uuid": "f4c6b335-72f8-4f4f-92a6-149882288cef", "value": "d9f6ec7f441273b078f270b21da3a7e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819814, "uuid": "1a8d3e56-f805-4134-8191-e024aea3c978", "value": "12288:/P9KeGplLyu3i5tSJpuWmYhjaGtfPOpD4NzhLqtxECEmY:X9KTLyGiDiuhwemi4NlOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777819814, "uuid": "95ddf09b-18c9-4195-9308-df2d8e45ee7f", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777819814, "uuid": "86a0578b-b7c1-4f40-81c0-c54d3253aad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819814, "uuid": "664ce53a-3a97-4401-a20e-eed8c18eba2e", "value": "checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839f72c4-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777814712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814712, "uuid": "3a65eeee-1249-4405-bcce-8da3b6de64d4", "comment": "Malware payload (DCRat)", "value": "27684be9ff80653ff12173e4a308b9b7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814712, "uuid": "a3b7c4fa-8d7e-406c-8122-a37b6904ea0a", "comment": "Malware payload (DCRat)", "value": "786e0c6687efdcbd8df6d684cec5cda3b73aad0665d1f6695e79ea75ba72b9c8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814712, "uuid": "d7fb14c9-1713-4d5b-8506-d0878d26a6d8", "comment": "Malware payload (DCRat)", "value": "bcc2adb3280b1641241d137af8cdfc92a985db39", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814712, "uuid": "43889eb8-defe-42da-983a-2ee26fc7633e", "comment": "Malware payload (DCRat)", "value": "05ce2039d79ae50889bf6154c6f2b621cfa807ade779b5e5fd053564813940e19fc16671b195cbe55067597168e1e75b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814712, "uuid": "5273c4c9-afa7-4cb4-b754-022070ab7f9e", "value": "T1EC5530342EEA102AF173BF7D8AE47596DA5EBAA33707985D10B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814712, "uuid": "4d6e38d1-ac9b-44ef-b91a-4263cbab500a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814712, "uuid": "fa8da29e-8f79-404e-8b06-724e7cbeeff3", "value": "12288:ON2N7N9FS18IHXlakldxx04Y6CVZ2ms78SZVACKDG4Ps4Em8V0w6akNDaIVAdPQd:ON2NcJlDxPFXZ5yl+06W7BQZxpuztRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814712, "uuid": "e7410db2-928d-4e02-8740-ac9029fa1637", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814712, "uuid": "20a7fce6-955f-4f51-b6f6-357ec5483f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814712, "uuid": "f4a131c5-5b6a-41cb-81dd-739f107dc86d", "value": "27684be9ff80653ff12173e4a308b9b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bc09d0-4748-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777851114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851114, "uuid": "1fa36228-3702-40a5-91ed-63914c270f35", "comment": "Malware payload", "value": "fcb9916678c8d7d66d7ed5def4e155b3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851114, "uuid": "d17875ff-6663-435e-91fa-aa96931a7f83", "comment": "Malware payload", "value": "78dd672bf760f2a5af9d9194cafb2ca514562baedbafe585f6f68d0fa34b421e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851114, "uuid": "0272b2fa-4530-4e7c-81ed-913ebd21ab79", "comment": "Malware payload", "value": "540a0a4df4cb770212e05212d2bef96fc59c437a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777851114, "uuid": "d49414c1-9afa-4978-a537-d18ca9115480", "comment": "Malware payload", "value": "7810d8d7d9ae33ef248f45fcf35354492e23416ea7d8f086ae8e606d52f868358211a589f5bc5367e8cab9b770fb226b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851114, "uuid": "804215ae-f2d1-481b-93aa-fa2f702523a2", "value": "T1BCD3F0D74E9D46E89FDF6124026F2C0389CE9633565EE9507ADFA9863F12D2431BB8C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851114, "uuid": "74cdb7be-2485-44a1-b20a-8e020d54973b", "value": "768:c88mIaFMWE9rDhjK+BXTOgL/U29690h5fryrbUl40A6eH2wuBbUEZ7ubQJIMwbyg:c88uFkhBzA6eH2PBjNIqrRv0p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777851114, "uuid": "981a5004-9c7c-443e-bfd6-7e2d2796109a", "value": 136918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777851114, "uuid": "adea2b89-5a2c-44b2-8f70-0bec8af84eb8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777851114, "uuid": "df46b5ea-6528-4946-b848-f49a3b0f3083", "value": "User_Audio_Stable_9449.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3d64cd-4728-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1777837278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837278, "uuid": "d3c6d2c7-1a6a-45b6-becd-6f8166facb03", "comment": "Malware payload (UmbralStealer)", "value": "9bc8ce31ca827331f6f4e1e3e3284f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837278, "uuid": "58f49903-2fef-4b46-810a-d875890fdd0b", "comment": "Malware payload (UmbralStealer)", "value": "7931a3b775d8abf1a12fc66ff74eef70a35099dacb7e58b019bbdad80df01305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837278, "uuid": "9d7b0412-c8cc-4933-a229-28ac9efc6683", "comment": "Malware payload (UmbralStealer)", "value": "1b2a57cde6d43e0bcc884684ecd33a93acb1d703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837278, "uuid": "de0f161d-74c4-47b8-87fd-d5626cdf8e69", "comment": "Malware payload (UmbralStealer)", "value": "7a68adf05d87d284ee5efd5b43fb81ee74d7f1424ad4b2e0167d0ca69f92cb7e33d4ed86df6aa7bad9111e8a6979b791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837278, "uuid": "e0b98daf-d366-4756-8b16-31b7cc233697", "value": "T1B0346B5933B8CB17E25F8BBED5B1158F87B1F103E90AF78E0C8895E82411B42E949E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837278, "uuid": "177f200c-a0c5-4b66-9458-5ce91042b468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837278, "uuid": "0e3a8000-1a2b-4113-a659-7bcbf6ffcedc", "value": "6144:OloZM+rIkd8g+EtXHkv/iD4QbQGMS1Nmtzus9x4dnpb8e1mEi:YoZtL+EP8QbQGMS1Nmtzus9x4vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837278, "uuid": "5ac122c4-fe13-4bb5-9507-b82afe2c6d29", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837278, "uuid": "0f6613c4-c39b-4062-8e05-c2c8a69a560c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837278, "uuid": "c2a322fd-aaac-4968-bb6e-547295af1b86", "value": "daldabe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58218b9c-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794453, "uuid": "c550f0d5-4405-431b-8c45-e94c261aae53", "comment": "Malware payload (Gafgyt)", "value": "b66bd20882a3abb68ec8f6ed96b7ea4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794453, "uuid": "0c67933e-3f5f-452b-8d6e-2152bfbb2896", "comment": "Malware payload (Gafgyt)", "value": "7bca6c64ecb974c8fc6671ac6e59f70c1d95006162098a89086606b0394098bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794453, "uuid": "3bd8e4f0-ce96-4ae5-a4b9-2de274ebfd31", "comment": "Malware payload (Gafgyt)", "value": "fd0dc1f7b21bb6940b885313a68936b905ef83a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794453, "uuid": "69219c42-57a2-4853-941a-dbbb86533739", "comment": "Malware payload (Gafgyt)", "value": "73e4679debbdee4609bf2da69f035135103f7afd52c97354674b1df8daa2007192427b5d0e85ff313576b55a10e5b078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794453, "uuid": "406e4fcc-6b0c-466d-9657-2937d21d4169", "value": "T1B3933A27BB238F23C0C9157106E30731A7B5EA5938BE6757B9E02DAC6F16AC035167D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794453, "uuid": "d59a4fac-a4b3-458d-a786-7b35e363cf4d", "value": "1536:egV6BIN95TrtytVxtfhHmXEFMXjpGtfe0se:4BINPYhtZHmXEFMX1Gtf1se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794453, "uuid": "af1f1dcb-7d8d-43af-9992-c15fbfa90e09", "value": 91522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794453, "uuid": "e71257b6-64f8-4282-b2c9-52696d6f57c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794453, "uuid": "7bef7a50-ea3c-42aa-8988-ec55f74028c9", "value": "sparc.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b53979-471e-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777833232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833232, "uuid": "62bbbfce-01a8-4b05-ab89-6aed6858a915", "comment": "Malware payload (RustyStealer)", "value": "f23326b56eb89d7481bddaef002a3424", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833232, "uuid": "a63aedff-4c69-4763-a3bf-860b4077a1c2", "comment": "Malware payload (RustyStealer)", "value": "7d45b7e10557bb1410830117e656802d5e4b85fb5827881c233b3072f9fd97f1", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833232, "uuid": "94016e39-022b-4891-9f12-5d478bce1276", "comment": "Malware payload (RustyStealer)", "value": "2ace95b5f60ddb72ec3b8103e6210dba0f911cd5", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833232, "uuid": "0859f462-ecde-4033-a8a4-56f6cf7313ec", "comment": "Malware payload (RustyStealer)", "value": "40699d0074dd0c1e550ad3a0c3f49602d0521d2ce61e376c3d9507493182478dae1246490f39a07b7cd9a35f217d1fa5", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833232, "uuid": "4ba191eb-37e1-40a1-8b7b-2baf9f05749b", "value": "T146952315BAA748D8D05BC43C96440567EA36B4850731B9FF12E007362E7AAF50FFCB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833232, "uuid": "e37500ce-e843-41e9-afd8-ff7fab3a72f8", "value": "37c0f06c6bcf342f91e32cbbe7a711ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833232, "uuid": "d8b942a0-7c2e-4706-a50d-f5bbf0e90abb", "value": "24576:lh2X/wOtAgbptHBEArqY+lr9CLxnUcflxTL8yF2BXBHlKv5EIRnYlKcwr3scB6r:lhe/ft6AWRQUS/8y0BXGvbcKRR6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777833232, "uuid": "47f2e51e-6b71-443c-942b-2028d7aade92", "value": 2045440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777833232, "uuid": "bcd99b1d-4331-4c02-9557-f5cf0314b5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833232, "uuid": "565247c9-110f-4a9e-a3d8-cc615a65ce7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d191951-4709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823989, "uuid": "a79ad0cd-1569-494b-b2ad-8eec2eedff31", "comment": "Malware payload (Mirai)", "value": "c0d33c3c1b3d3aff7c04d4c990b53876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823989, "uuid": "65c87092-c5c7-44f7-80b2-84e737aa4c0f", "comment": "Malware payload (Mirai)", "value": "7e199b7d270eb90f83948a05c345892b03bc42ec18d3c033d23f3cea102d7f94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823989, "uuid": "8e3f643f-6b9c-41d5-aa9a-460ce506f0ba", "comment": "Malware payload (Mirai)", "value": "0190918e43351d025b7f5667da28dc7a9800138e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823989, "uuid": "641ebbe9-72c7-45f8-8f1f-2c56b606b347", "comment": "Malware payload (Mirai)", "value": "0c8020dfe67a8d3de7c1d341d2ff59939baab4a1f0338b71ed3ff25489a8a318d0bcfda80dfbde524e4efbdd497b1d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823989, "uuid": "f79058ab-c27d-480e-b7b4-963c57525316", "value": "T147C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B11E27C86A671F4DE205F6D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823989, "uuid": "7346a885-5c57-4741-b586-a3a74763f65a", "value": "1536:Uc1FmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3c:U6FmSmviqS1Bs0+Nd6lAqktNMxSNbmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823989, "uuid": "f4ae5558-b9dd-418d-b573-41bd7c3cef22", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823989, "uuid": "15783d27-3ab1-4559-8b4a-02b8d3da4893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823989, "uuid": "d6f4e1ab-6c15-471e-ad82-30cf27b545a2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e77a2b1-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777794436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794436, "uuid": "b2fd1969-5b6a-454a-8186-0cdcaa7c5629", "comment": "Malware payload (Mirai)", "value": "e73610bb68cf9467f4b1f19a7890fb3a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794436, "uuid": "15694a88-6cf8-4521-a38c-113eab511468", "comment": "Malware payload (Mirai)", "value": "7ed2ce6d2ce3d7dc061977ee90fe41320e8bb910d9a6c52bbdcd13a60bc30186", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794436, "uuid": "87f12dee-a0ad-4281-9483-2135ed08c030", "comment": "Malware payload (Mirai)", "value": "31df2a5616cbfcde6a2381559bdad03ddd916b15", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794436, "uuid": "f4f76c32-165a-4ad1-a90b-15a0ed4a1a52", "comment": "Malware payload (Mirai)", "value": "7e778d86e62f5373789057cbdf554548c69476ac5c224bb358d2e08d8694fab0a1c43a6f47c17ea322959523e2c400db", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794436, "uuid": "563e1125-dd67-4b02-b6fa-df75db434995", "value": "T152F024DE0A74365245CCCA4FB7D38909104E83CE269F1BCD7EDD08A6E640BE9F044E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794436, "uuid": "51e0f1d9-1a01-4b97-9037-d6493f5c3a03", "value": "12:KSs6wZNzQNyHe0uNzRsHNl8OSYeJBONl8p5pB:KSKZNzQ6MzRstlle8lqpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794436, "uuid": "730c0400-d2c5-4027-a2e3-a4baf98ebee3", "value": 516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794436, "uuid": "2554f6e3-d36f-474c-a592-1b31be80d6f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794436, "uuid": "fe6009a8-281f-4cda-9c21-58fb18a768a3", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a05a107-46c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777793114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777793114, "uuid": "d11fe665-866b-401c-ade8-0f812f4929b6", "comment": "Malware payload", "value": "63c610620b039c8f05bc8e3d25aeacf7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777793114, "uuid": "f5efed78-98c7-4978-83ec-4b2444a4beff", "comment": "Malware payload", "value": "803da30b682d1f0cc0cdb316f2cfae462ef4b17146421768af60bbff17636339", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777793114, "uuid": "175c89b1-ccdb-4a53-bb5d-756904b342b3", "comment": "Malware payload", "value": "455fa561dfb222061b7c85e6356e792d135569b6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777793114, "uuid": "67859f8e-b0a7-459e-913e-7b60f95ddde4", "comment": "Malware payload", "value": "813886127c8f194952ac39de3b308229e05e0c149e37167270c5d751dcf1f1b20d109ac3f8b440091477628033ac09b7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777793114, "uuid": "f1b6b169-d718-4e21-827b-e08779ee23dc", "value": "T1C7573356C0721F1BED9B8C3498AA4341CAACBE361F734A1D2114B76764FBBF03176199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777793114, "uuid": "f3879a3c-6d11-4bc1-828e-92e197db34bc", "value": "786432:LgviMIjgNeZBFKdyIvItrYj+bF/BrZDi/2:Lgvij0xgtrPb74/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777793114, "uuid": "1b1cac94-0bfa-4306-96a5-71c4ed69b803", "value": 28901376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777793114, "uuid": "b4e546ca-1ec8-4e31-a6f2-0f455a0f4b44", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777793114, "uuid": "8097b8fe-7eb5-4a8b-94fd-827c9788bb13", "value": "Loader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8e0979-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818327, "uuid": "e25d24da-8caa-4a9a-804c-eced8e74496d", "comment": "Malware payload (Mirai)", "value": "67a31acbbefa11ff98bce4be38b2ac75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818327, "uuid": "ee94c387-c62f-438f-9ffa-3fd27cb0af51", "comment": "Malware payload (Mirai)", "value": "80eb6884cd0be934f31a22031b72e78d502eef1a9e0586a72e1d8127a5f4ef2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818327, "uuid": "ae99dff3-8a79-4cd4-aa9c-230d5af88cc6", "comment": "Malware payload (Mirai)", "value": "5ed445191498b449b63f12f49d92d83a009600a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818327, "uuid": "6dd2c7ac-7af7-4b88-83f3-f6efa31420ec", "comment": "Malware payload (Mirai)", "value": "dabffb6b4ab5ec7fb3a0d1b82c0efdd975d1244b90dbe882af56a9956c1c2d4bb6ba7ed6993be43897b9d723d2b480e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818327, "uuid": "89e78e7e-9d00-42e5-a9df-ee3f72d4e233", "value": "T1FD23F1A231416F50C9602532F9A648C07FD8DEF890CFF15992146E189D23B45A9ED3FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818327, "uuid": "3a6694ab-21ce-49ad-af29-af2d2b4dad78", "value": "768:GyxmFRV8LnKY3iqFnlg40VVjH9z9tqX5MeAPe6+UZPVJdyhnB1XzAlBfL9q3UELS:GyxkMx3iqrUxrqX5HAfv9T+LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818327, "uuid": "de01a30f-0e84-49d8-abab-406e18083395", "value": 45896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818327, "uuid": "7da0241e-7aa0-4f7e-8bd0-7788e514e8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818327, "uuid": "1b5cb7b9-dde2-4ce8-8b10-f7b92b276fd4", "value": "runningaway.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5615ec76-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794449, "uuid": "331a3180-bc67-4ca4-b3fc-2237a6503b16", "comment": "Malware payload (Gafgyt)", "value": "26fd20e6bc274c359c9065b4b589f59a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794449, "uuid": "a6982cab-366c-46b5-ac5f-972f15179f06", "comment": "Malware payload (Gafgyt)", "value": "828d0b8028d14d6d3d428156380e1976c9673321506e8271bc21c12db4450451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794449, "uuid": "a7ca5db5-5ce4-40f3-8ba9-06c283461fb3", "comment": "Malware payload (Gafgyt)", "value": "b4ee97b835dbcdddc25a6ce0781be857dd924f34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794449, "uuid": "4750c196-3127-4e2d-81b8-91820cfbe273", "comment": "Malware payload (Gafgyt)", "value": "a10bc9ca2eeca923b0bb608b098723bda7be98ec8847e8ceca9bc7b66ecb86d42b24e5275a25fee6e7f6b91605f54bf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794449, "uuid": "431ca9c8-1f4b-4d4a-89c8-93c44950ea4d", "value": "T1C3D37B87F6068D92C9910BF54B879B9C5BB351405F9BE7E77D0C26388E62ACE5C0B780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794449, "uuid": "4301bafb-4dc5-407a-a3fa-847a3d7f51fd", "value": "3072:3nER5K2LWeegsT1Wouteg4qcrsJuTIlomcdHTMu:3nEa2S+sTxVqFmkomcdHTMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794449, "uuid": "37228245-cdc3-4b20-b4b3-0874c2bf9e8f", "value": 135984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794449, "uuid": "d91c22a7-189a-429f-a203-250a873cc887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794449, "uuid": "c488184d-cb4a-4758-8f6a-43f29d94d88d", "value": "arc.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab0a3cb-4728-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777837568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837568, "uuid": "03fa4bc8-657c-4038-bc30-5c6d70a99d1f", "comment": "Malware payload (BlankGrabber)", "value": "70da693f659b7670208e448ce505c8d5", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837568, "uuid": "0aeb26c8-8526-4db2-bf83-759f392e3151", "comment": "Malware payload (BlankGrabber)", "value": "833b65a21b746a045df43b96765796bcf5a623844316f5794238978b534cfdb1", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837568, "uuid": "76e5030e-419f-4542-80fb-3118982d6c9b", "comment": "Malware payload (BlankGrabber)", "value": "8974d9fcc5bf3cc9bfc524df8d4bba3699728258", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837568, "uuid": "43c8e149-e62c-4a29-91eb-d411e360f2c9", "comment": "Malware payload (BlankGrabber)", "value": "226840526879ce302d1eff49cf755df47b54ea36665427717f69c4a25f51b404d4a6340ee5fb3b3ffd369cfecdd4d39d", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837568, "uuid": "398e1b62-989a-4f28-835a-b560d21c7f0c", "value": "T1D6B63366E35000F6E9F7523D8A46C07BE6B3BA325FE1D5CF4228452D2D63AF5583A324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837568, "uuid": "2bd342ff-ad9f-420c-9872-6ccedae7d845", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837568, "uuid": "7e6cde93-003f-446f-ad8a-6b6b61fde31c", "value": "196608:93udbcLx77bttklmujO2U3xP/hibInII7vQpBc1beHcQFBtpD8cTBCFx:93UbaZnA8uarBP/YkI0QpBc1bePFB4Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837568, "uuid": "8aa3d9e3-318c-4733-bbb3-f1e24e408f3e", "value": 10593915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837568, "uuid": "82ff5162-0577-4075-9697-d20783ce5b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837568, "uuid": "1e2cb1a1-1ea8-4bfe-bce1-892de39ac633", "value": "sevrality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02285748-4709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823944, "uuid": "c156fb9f-fa2c-4518-aa6d-706d61861bb3", "comment": "Malware payload (Mirai)", "value": "59a48ae11e32cf6ac3e6f80d9780e1e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823944, "uuid": "728c4c6a-ff71-4e9d-adee-0b1d4f447b9f", "comment": "Malware payload (Mirai)", "value": "83bc89c3b5a89641dbb601bbef60e8b41f3a651b8aac52b28e08f4d4cf1cd5a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823944, "uuid": "b1e7cf27-8765-4af7-b3f9-7c0d25712694", "comment": "Malware payload (Mirai)", "value": "fa7edda76a89661826d7622eb1e48cc6638bfe10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823944, "uuid": "498d4433-1ab2-4f31-b7e4-5dd0b24a8af5", "comment": "Malware payload (Mirai)", "value": "6bb5c0a2112719528d0308e7f48644778c4794bec687cfb6451d8e4dbdc7c915f8d82a57b24715fc9977d58c6a82283f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823944, "uuid": "833bc786-012a-419f-8a98-73dfb6f38969", "value": "T1A9F33A69BA0F6C41F2C2C3F9DA8C87E13E1735E3C67A8DB1790252EDDBA39D95940502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823944, "uuid": "5742a804-9e90-465c-bc29-4061bbd12d24", "value": "1536:RX7D//cneDHabMcgqIN+10Rw4b1X75zdm/Xa3yiIfMp9En5p5M/LW:VLqgqIRRjR7Ndmva3yvfMp9xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823944, "uuid": "856673b1-dcf4-411b-aefe-a94753d00c6c", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823944, "uuid": "5885fe06-6285-45da-aaab-bf2cd89ba0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823944, "uuid": "a4fe4a5e-e6f6-4ce2-bed4-c5ddd37e7ec1", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4092945-46c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777792969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792969, "uuid": "9b81c476-6e44-4ba1-9d0e-7c1e8f48ceac", "comment": "Malware payload", "value": "90d589c888c26ef486b615d4294e8abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792969, "uuid": "1b38ba27-3de4-47fb-b6b7-1957c7fb6c02", "comment": "Malware payload", "value": "8484c36fe4af701ba5526c9281cc42f6a107ad518b147f5496fd37adaaf686b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792969, "uuid": "af33b737-a530-4caa-8976-811bd17ec0d9", "comment": "Malware payload", "value": "c21830b465a24f43379304aead5b542e56219d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792969, "uuid": "31ddf001-4a3a-4f3c-9ec6-2b3fa805f77a", "comment": "Malware payload", "value": "3d03ee25f40be6dd166e47ad60dcc5fe3c65a90d910442e008d21e59e4c27ad9ad72a2c6536b282e2956b40ddf6c3054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792969, "uuid": "f0d30fe3-5cfe-4af6-a4b8-f5517fd0f7e5", "value": "T1D1565B0BECBA589AC4B9F17484736212BD643C405B322BC71AE0F7691F767F05AB6B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792969, "uuid": "f21097dc-327a-4f03-a6fd-343c90c038e9", "value": "0acd9cce08d4c60c133b69831e9e4f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792969, "uuid": "91b2cb5b-6dac-4e56-967e-c8beaf91f358", "value": "49152:NWi+fleykQPrk/8gLrJHcKztQAhz5xBPVJEgOjzxsYSLge3KQ6jYptxsHUrV9:NU67fsNSLgQQH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777792969, "uuid": "4ea60e4d-7a34-4731-9ea2-a4b405bc36db", "value": 6092288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777792969, "uuid": "c5044de1-afa5-4829-b6a5-ce6697d13907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792969, "uuid": "1f7dc280-3d6b-4a45-9d80-8d3e1d570a19", "value": "SecuriteInfo.com.Variant.Tedy.954524.32459882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf10a95-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823935, "uuid": "6b05a5b2-0ad9-4f7b-925a-e69846458bf6", "comment": "Malware payload (Mirai)", "value": "21cacc2f6ae4dcb6523219212abd77bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823935, "uuid": "f13f62be-27cc-49bd-a2cc-9f9c4175b62a", "comment": "Malware payload (Mirai)", "value": "859ca289f7e22eeeef4a4b9a388c1ed384fffd80fe4bb5e5d72d6cbcc5081610", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823935, "uuid": "713ccd9c-796b-4fce-84a5-ea604c7420ec", "comment": "Malware payload (Mirai)", "value": "4367d786ae644046edb2883501eee5c4938760aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823935, "uuid": "6bbbdc32-04bc-4149-803e-3bd68228ae55", "comment": "Malware payload (Mirai)", "value": "e15f3ae66f9217a7371fb8da6eeb5f7eb45d2e680eacd6c0a2a5180b8863b51809bcb369dad2d71a64ac029db957ddd4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823935, "uuid": "668e19f8-60a1-44b7-a15c-17caf4c71235", "value": "T154F3C6169FA10EFBDC6FDD3702A9060235CC954722A43B763674D528F64EA4F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823935, "uuid": "5e73663f-93aa-43fb-934e-69260e9e5fc9", "value": "3072:SFnGtX51a1jRnQKGMg2wn5tG4TI+xukAW:SFsXuWKGvjLvIlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823935, "uuid": "d5cf76cd-9ec2-42c0-aca6-2c284cb3f9dc", "value": 158152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823935, "uuid": "42f60e8a-50e1-427f-8fbf-c9d938545ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823935, "uuid": "d68c9d56-b941-4961-9c17-4ba2bd28b485", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf2ab9-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "b00fd10c-b5b3-43b1-8839-c3ba8ea856ad", "comment": "Malware payload (Mirai)", "value": "306635fae0226418d886a8b77fd10d3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "01d49a5a-5364-42e3-86b5-248fdd137ac9", "comment": "Malware payload (Mirai)", "value": "8652011d0d774b826a10abaeaef992374a58b6a56832d9d6ba36fcaba6c313b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "c4dd7080-31f4-4046-95b3-342b1619804b", "comment": "Malware payload (Mirai)", "value": "5fd318d757555c20dd1afe47df4474598bb91a66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "4ecee070-5685-4985-a65f-b0a2ba4ae9d6", "comment": "Malware payload (Mirai)", "value": "4c0064e5cb262baa65555a23788b32d8a32f70ea09678fe1cb38322ccda4990791744117e6aad95b060dc8cdffdbc73f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "4ddf0249-f183-46e9-b8b1-2e6820b52442", "value": "T1DC14D90A3B228FEFF16D877147F34A31976966D617E29684E26CD5102F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "ea0b5b34-fc39-4372-9017-c1059e2f4902", "value": "6144:+rfz0zIcNYcwumdKfEVVAhMNdp06GtCqjYW8nY1j20WI:mz0zf3fE3Xp06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823936, "uuid": "8f985e44-a2fc-4512-b9dd-b2b3d8630b84", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823936, "uuid": "76cb82b8-e133-44e4-b7ad-6a0a0404ba1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "df1e8e8f-0226-4a0d-a3bc-165962ba6fd5", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ba2e28-470c-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777825236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825236, "uuid": "6d8643b0-872f-4694-86ef-8baeca712f6d", "comment": "Malware payload (ConnectWise)", "value": "b941fbb54bc9600a32741359619f3f27", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825236, "uuid": "d969e5af-aa31-485c-9a33-1ec458aa6a70", "comment": "Malware payload (ConnectWise)", "value": "86ecbcfda60ddb937937bfdab85f6f4867c6219304235467bfc73e9b5f6428c5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825236, "uuid": "e6ad52d7-aafb-455f-90a1-b3390d49a5d9", "comment": "Malware payload (ConnectWise)", "value": "9e52778b80d229ff6c8e5facacdf539877bd48fa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825236, "uuid": "5e07b9a3-9a8f-4648-a46e-8c9496364143", "comment": "Malware payload (ConnectWise)", "value": "6178d7c06b00415ed51a69d59d476e5c44c1b70a130c80605bfe3792edd5b9cde44df39a78b6c1cc7326460501f1f5e7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825236, "uuid": "ea67957c-80c0-4ad7-8533-e153e79e73f2", "value": "T13D647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825236, "uuid": "08e50e7b-e746-49aa-9fe4-6effd413c4b2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825236, "uuid": "9b350fa1-f05a-4deb-9368-e0770f21fc41", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9O:J1iw7gryNkSV1hy1Z1u2JLu9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825236, "uuid": "7622b218-e670-4464-a3db-e6f91cc10827", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825236, "uuid": "aa2729c0-2a4f-42d9-87ea-2037141d6517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825236, "uuid": "48d6be1a-5694-441c-a04f-72de14e54b01", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f160ba08-4729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777838089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838089, "uuid": "457c4e0b-f604-4b11-ab95-8611ff6c3b14", "comment": "Malware payload", "value": "50d3aa955e8d6230bbccb36ea625f045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838089, "uuid": "2efd335a-bdda-4084-a44c-8dfe5a2926c9", "comment": "Malware payload", "value": "86f697c2c9f941a7caa7336879a42b61fe8ddd8a5d210bdac6d624104ad48907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838089, "uuid": "37c27400-bab6-42de-baf1-9bc8f2cccf5b", "comment": "Malware payload", "value": "59e83ba10753fe9f7ab1deed83043bf720e2f1df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838089, "uuid": "97403a1f-72e9-4cc2-9d75-5c0e21d4a414", "comment": "Malware payload", "value": "cdff0c1db93a39af667902167a918e931ce56a6db1e7108013e4ed503376a44e2fa94fcb63cb34d0c2723fe74810beb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838089, "uuid": "b8b3a4dc-d507-4ae9-a3ee-b20ff8abcb2d", "value": "T14B94C41CFE92F809CD5A3DB3CFE510005B7125C22E119256314AAFFE9BA53B658E267C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838089, "uuid": "b311df15-254f-4063-8c13-d546f5c9983c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838089, "uuid": "a770e84e-8759-40e1-b399-49d56a9e5e50", "value": "6144:86xUFQTHoI8R9H/+HTR+de6VlWT8b999WjudCiavk87n+NtbAlWO:rGFQB8LURSPVle8n9OdSolW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777838089, "uuid": "df56a473-d94c-4894-adba-ac66805f082d", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777838089, "uuid": "d9a3183b-c1ce-4fab-ad92-8e8a11587fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838089, "uuid": "1b435508-31f9-4765-bf51-6e3c913c1821", "value": "f1ae31a1_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f214c95-4714-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777828797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828797, "uuid": "959970aa-3b7c-4781-9030-6bdc8d1d0d5e", "comment": "Malware payload", "value": "861afd61688110caf7c31c5f786eb5c1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828797, "uuid": "953dc712-9cd0-439f-93f3-d72290170a23", "comment": "Malware payload", "value": "87ba02d6a28246bdc6c018a4c292b4bca81fc8688e229b5a65806e63f40b2d77", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828797, "uuid": "2520713b-6845-4870-89b1-91f455b5b23a", "comment": "Malware payload", "value": "495fb30bfe68aabb0f3e18b7cd6288d903a06b7f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828797, "uuid": "a2654667-1bdb-4a2d-aa77-3759f6c3e6ed", "comment": "Malware payload", "value": "1bb62fe6450456c93ae6d0e7d2897ff6fd7a99481ebdf3e5106d8e53019ff05183243f56e6ab54643b0b452ef7bbb96b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828797, "uuid": "f995c1f0-1b0f-48be-ba15-2b7cc90fd702", "value": "T1B46633C431D07D1EE10A2EB67DEBE8FC44476214A07619BFF2CE60D58E2A7928D8B518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828797, "uuid": "289ac20b-0db9-4888-b274-4f07f33d8299", "value": "196608:gyc+bZJcmbUcsicJ/aXF8r6iitFOIeNnuF2gfrlYsKmTA:gyDbDQ/aXGrqFOPMFdfrHjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777828797, "uuid": "441a9764-bd67-48c4-80cd-82fae33a6df3", "value": 6500565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777828797, "uuid": "b1bae8cc-2955-4418-8ad6-b48458d1c970", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828797, "uuid": "6182a5cb-2e0c-4cad-ab1b-7d7630b13007", "value": "87ba02d6a28246bdc6c018a4c292b4bca81fc8688e229b5a65806e63f40b2d77.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d95f7f9-46ab-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777783805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783805, "uuid": "6019241d-4ca1-4844-9f18-77eb398c32d0", "comment": "Malware payload (NanoCore)", "value": "61375846a3a226385ce959a2dafb0f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783805, "uuid": "3b1124c4-0d63-4718-a640-28aa40d114d4", "comment": "Malware payload (NanoCore)", "value": "883241babed5fbdf3d4ef6736a55353d4b1b69c2b41891cd7da1caee19ba5373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783805, "uuid": "e2767f1e-30b3-401d-8706-7ce059825d64", "comment": "Malware payload (NanoCore)", "value": "8c717540c9f5c6af53f79e0c4648d85d15859c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777783805, "uuid": "2b6e6ce1-e8ea-46a2-918c-8cbbf4c73b6b", "comment": "Malware payload (NanoCore)", "value": "275af60f001e7c89ff1b1f9c698c01802b2e8733fdaba21a9fc2e110c0b604fbf88dd992d00cd1572fa6469ec9c484ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783805, "uuid": "cdd14f29-47b2-4e3a-a75a-f10b38838b6f", "value": "T10F14CF6637A88A3FD2DE8679611202539379C2E399C3F3DE28D455B78B227E10B071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783805, "uuid": "23909cc8-bfab-4ebd-918a-54753102be30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783805, "uuid": "d12147d0-d395-4d71-97a0-bf2603a8d616", "value": "6144:sLV6Bta6dtJmakIM5SNLiVdjyTMyIdWuy:sLV6BtpmkDkjyIfMuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777783805, "uuid": "5f82368c-5021-4aa2-a95a-e35e061fff0b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777783805, "uuid": "f2daf5eb-bdaf-4a47-8dc8-1ce13f82fd07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777783805, "uuid": "25ed82fa-efb9-4759-ab25-633c13b9a42d", "value": "liawcubu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053a14ec-4743-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777848860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777848860, "uuid": "263f2cfd-e668-432e-ada0-bdeee14b3cfb", "comment": "Malware payload (BlankGrabber)", "value": "2b738e5d748769588152dd4346f13337", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777848860, "uuid": "e2feb690-2a96-49a8-b10e-e3012ef76ec3", "comment": "Malware payload (BlankGrabber)", "value": "886668d8107b55009429a7ad39b27c451307ea4fbd8673d317b6118d00d1476e", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777848860, "uuid": "d6011869-39a6-4619-8731-5d2131087122", "comment": "Malware payload (BlankGrabber)", "value": "2e77f10b8fccb9cd3af2e5fbc7718a532ec37e39", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777848860, "uuid": "7f2365f6-ccf6-43c9-a46a-788f5bc8990e", "comment": "Malware payload (BlankGrabber)", "value": "fdef10a6ff1d8113e11878f8776ff7d7de1814393159df5adec7928bb770a23b8de11c795f9ee0d324b0e620d4f634ba", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777848860, "uuid": "6868a4ae-18ec-47c7-affd-11503533a5e0", "value": "T10FD633666B5A04A5ECD6613D9E33C107FBB1B1112B61DACF0BB417256E2B9F1093F720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777848860, "uuid": "f633a42c-2e0d-498d-9192-d408c80dd4ce", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777848860, "uuid": "92dc8e30-3f6c-4390-b91e-141a61b64cf5", "value": "393216:hMf7b32oZasY96guQmQvEHsn4qSRcZpiUt42:h8b3vaFIg3mEWgzS+Zp42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777848860, "uuid": "27c53268-782d-4b99-b9c9-b8a8963ca1bc", "value": 13631488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777848860, "uuid": "76908559-1f60-4a87-be31-70cd0e88d522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777848860, "uuid": "2fcd498c-f4aa-49fc-bd70-52a932564656", "value": "Madium.v1.4.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a2afd2-4720-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777833823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833823, "uuid": "e9caf10c-6e45-4d0b-8cf1-b7276e78dddc", "comment": "Malware payload (Mirai)", "value": "bfb4e438d8f5f540d5672e9defecd4da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833823, "uuid": "20385775-a5e3-4624-b3ea-84c39770d0b0", "comment": "Malware payload (Mirai)", "value": "899c4224d505bcae0735a499cd4b8489ee833608a441ee660a8108aa6ba89b24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833823, "uuid": "c202f94b-dab1-43de-91e0-c48b95209c78", "comment": "Malware payload (Mirai)", "value": "54d20bb1a13232ee902298a06bab9da00e28ee88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833823, "uuid": "ae0c6766-7a73-4f57-88de-a4092cdb6fac", "comment": "Malware payload (Mirai)", "value": "7029c0b335c722fa65b49c6948c9f8fc20f0aedf4bbc248514429415ba3f1cf52585c5d7fa91f752010bafa505436914", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833823, "uuid": "7a5b76e9-703a-4cad-829e-9fdc2814d6b1", "value": "T18F93B30E2E314FADF769C23A87F78A359758778626D0C688C26CFA015F7024D641F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833823, "uuid": "c77305b1-33bd-41db-8266-fec5c66aaacb", "value": "1536:W+yy5RE0V/t3ddZ2qjPQi6D/vsRMbiGgagRYD19pgjMOZh2ahWMAQ0Mu8OJIiMZG:WXqDdZ2WPQHdbiGg5RYD19pgjMOZhHhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777833823, "uuid": "4bb47d95-b5a0-4c3f-9ce9-ef69b77a7ff1", "value": 91180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777833823, "uuid": "9605373a-19d4-4ede-8274-70a2e4c43713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833823, "uuid": "7fe1ec66-11cd-4d13-8a69-da821754734c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60fb7fd-4685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777767552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777767552, "uuid": "3b94b241-67fd-4b23-b156-4c0f677a449c", "comment": "Malware payload", "value": "e85ece55429e6f040e72a58049550e8e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777767552, "uuid": "8068065c-b32e-4ad4-bf8d-167d44cd2fdd", "comment": "Malware payload", "value": "8a77ac760f5204c74ec3d3c6d0f2580868b824fab3c14d7c091accdee60b9320", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777767552, "uuid": "9f7d7c22-9c18-43d0-b7f3-c3e52f07a848", "comment": "Malware payload", "value": "44edaf9e63e6e9eba74a30ea46171e2b6f016d23", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777767552, "uuid": "a00e315a-ad0e-4b6a-8b8e-6aa0a5f5a0a3", "comment": "Malware payload", "value": "db2650139a31496ea47981630829d1fcfb5930704836059056b314f3e3bd7546bf9b371046806e4b2dd9fa41be2c1877", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777767552, "uuid": "4c0433ea-0943-481f-a414-1fb785d5d6ed", "value": "T1D5178C1762E501D8D57AC0388B279517EBB1BC1A1330ABDF16A0A6562FB3BF01D7E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777767552, "uuid": "dd05a0d0-1ce4-4109-a2c6-2b9648facc5e", "value": "9bc2c620b7c66ab1d6a3d71b0ec7d288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777767552, "uuid": "8e28aa11-ac3b-45fc-aabf-185facf3b2bb", "value": "393216:l5WHh2WS1z7AInuYlK6yygKFdu9CwJsv6t6cr:lOeHU5yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777767552, "uuid": "17fe3374-4a7a-48b9-9511-360b754417c8", "value": 19407312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777767552, "uuid": "5e8554d9-3590-465a-b610-5fc9c6ac7641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777767552, "uuid": "601aec74-838d-47a7-a0ce-bfa19cf16432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e179ba73-46e2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777807568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807568, "uuid": "129ce155-9232-4256-9adc-6702d5c6b838", "comment": "Malware payload (ValleyRAT)", "value": "882171c438e8742749fa5fb7140532da", "object_relation": "md5", "Tag": [ { "name": "Anonymous", "colour": "#4C475B", "exportable": true, "hide_tag": false }, { "name": "AnonymousRAT", "colour": "#989DA3", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807568, "uuid": "b681aecd-8446-4f65-9bb5-dfe8853af1be", "comment": "Malware payload (ValleyRAT)", "value": "8b319742f9437db2f6c5fbd8d4ab2592e842e5d645aec2a02fce0bbb3bca64e8", "object_relation": "sha256", "Tag": [ { "name": "Anonymous", "colour": "#4C475B", "exportable": true, "hide_tag": false }, { "name": "AnonymousRAT", "colour": "#989DA3", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807568, "uuid": "4b493622-e7ee-4cc1-9186-74ed39aa149d", "comment": "Malware payload (ValleyRAT)", "value": "c036ceb82a8881c8a493f60679aa5a68024976c3", "object_relation": "sha1", "Tag": [ { "name": "Anonymous", "colour": "#4C475B", "exportable": true, "hide_tag": false }, { "name": "AnonymousRAT", "colour": "#989DA3", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807568, "uuid": "d7f5b63d-66a1-4668-a857-33a19d30915d", "comment": "Malware payload (ValleyRAT)", "value": "29c4dd42c4086735c8ee25b1eecdf3d6cc21ddaaf58006f818360123d248338fbed4bea5484ae75725472635cfe86a08", "object_relation": "sha3-384", "Tag": [ { "name": "Anonymous", "colour": "#4C475B", "exportable": true, "hide_tag": false }, { "name": "AnonymousRAT", "colour": "#989DA3", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807568, "uuid": "61fea8f1-94d8-4cce-9f97-28814bdad3e9", "value": "T1E377333176C6C132D1AE0133AAA8EE6E5579BE33073005D7B7E5B97E59B48C1A234B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807568, "uuid": "0b8c6742-be5e-4f5a-ad8c-8de9017a8fad", "value": "786432:fejBWTQ5a23qGvud63pWztgieY17h7YoyLjkyF:fGb5a2a035WuZY3DIjky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777807568, "uuid": "9251ea13-6117-4118-bae6-5780f95ba272", "value": 33925632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777807568, "uuid": "e374e866-9e28-457e-8b33-08786994620c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807568, "uuid": "80b7f62a-7c22-44f6-92ba-9e54fe975608", "value": "\u706b\u7ed2\u5b89\u5168\u8f6f\u4ef6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1963fb66-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818399, "uuid": "e52f9254-b212-4888-9720-9305d0515f7c", "comment": "Malware payload (Mirai)", "value": "af8e2854e8a469cd08dca4a59bb951e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818399, "uuid": "b367f9e7-2397-4acd-b7ef-956a4d721d0d", "comment": "Malware payload (Mirai)", "value": "8cc0d34da3949007fb422c7267b1bc6ac0fcad3f9d19f09d747c479f1c916fa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818399, "uuid": "8dceeed1-93c0-4d1c-8db3-75bc3f45fca1", "comment": "Malware payload (Mirai)", "value": "2ecc7f7f252ce102b4730703283debbb07e47525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818399, "uuid": "994a5f28-27aa-45ee-8df2-10db47e99202", "comment": "Malware payload (Mirai)", "value": "2fe3361efc8e8a2d7abfaef38aaaacb6074544bfedda36fa74332c26146171fa7e07fbf43ef32dbfb676176978da5754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818399, "uuid": "6803ea61-d50c-4296-8e87-e9962963c6b0", "value": "T177933AC5FE8B81F6C51788305066F33FCA32D96940719B5DEF9A9F36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818399, "uuid": "837478ef-8351-4c3b-a782-e32ac725aa40", "value": "1536:Qitrtqtmf7tKN3kImxXkBme5CWFikPhnr5w4vNy7q/An:3t9jtKN3rm18mCskPhn1w2/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818399, "uuid": "57cc11bd-8bbf-47cc-b655-a0f8db3fd5fd", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818399, "uuid": "37496757-b2a4-401b-81b6-fb976afb6fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818399, "uuid": "404434df-3601-42c1-b311-07fbb3eb8d0d", "value": "runningaway.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede44938-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818326, "uuid": "c2978cbb-89ca-40a2-9c30-c0d59d2fa703", "comment": "Malware payload (Mirai)", "value": "0800b09bff77775bf6fa49326e6a405d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818326, "uuid": "09e9fd17-36da-4bad-b2ad-fca0ee4aebee", "comment": "Malware payload (Mirai)", "value": "8db9f46f0d378287d2232193125965f36976f570182c47dae2ed7e63027cabc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818326, "uuid": "157dd88d-0e77-42af-8785-d34e04a2dadb", "comment": "Malware payload (Mirai)", "value": "2e3704ee439ad65acec20f2d5ac3e8c4af4cbede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818326, "uuid": "dc3b48d5-7b2f-430e-baeb-4b1d38f0afc3", "comment": "Malware payload (Mirai)", "value": "b98e17d7bd53a1f30bca7aa9f4878cb34a2eed53e6913d0a02abd8a89b3c1a2e3274b2dd855c48fb6259e719586323d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818326, "uuid": "9feca520-980d-4828-9a03-c9281ef72ae8", "value": "T187935C22B8391A27D4D0947B22F75322F1F6478E14A88B1E7D710E8EFF256D02A477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818326, "uuid": "de838bc9-861d-4203-a269-ddb9acf2c4ed", "value": "1536:TbGL+894qMlK0RuJeG/OanSWnd+XatbRYm5Zcnxs0tjyE:/Kv8qFRYOS9yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818326, "uuid": "87e9e319-2d12-462b-bfb8-13591cc3120f", "value": 96080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818326, "uuid": "086a4e3a-5d57-45b6-a88b-23d89a7d7062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818326, "uuid": "3e9fbb23-f825-4537-ad90-6ac92b5ae499", "value": "runningaway.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27eb231-46b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777786497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777786497, "uuid": "d2b18de0-00f5-4b46-8890-ce416d915f4b", "comment": "Malware payload", "value": "e9a52172afd58cd86d2d2866196e46c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777786497, "uuid": "09f976db-07af-41bf-b0e8-3afb46256196", "comment": "Malware payload", "value": "8ffdf472d53e3acd4a441cb0253872105d24e311a095f097e07d85cb733b502d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777786497, "uuid": "89815584-a493-461e-8c75-65cbd8891de9", "comment": "Malware payload", "value": "43cfa800e3175582b077df73f0f0203b6b4adca4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777786497, "uuid": "cc4abb19-69d7-4612-924c-2f2039a0cd14", "comment": "Malware payload", "value": "9d43d10ebbaa90ee38c54b792c6c13686967e1feb78515d23e928bd6646b54c88f43739a46d005720fa28aeccffee2a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777786497, "uuid": "3f5fb424-97e6-426c-8f51-4235f826311d", "value": "T145136C6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777786497, "uuid": "a0638cd3-285d-411a-b10e-f342ea7ca419", "value": "768:b/XRWNGxVZc9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b5lxLRcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777786497, "uuid": "bfb7d96d-d9f6-4c4d-ac4d-e3550d20452b", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777786497, "uuid": "170a486a-0cfb-4070-a897-127f44a2baf8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777786497, "uuid": "d23c6eb4-cd8c-4aff-b82d-ffdcc1b71567", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cebbe20-4722-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777834780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834780, "uuid": "779d2fc2-4ad9-4ae1-b5cd-1dd22498f965", "comment": "Malware payload (Mirai)", "value": "443c704bdc2ea8154b74c5a6a5ce7daf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834780, "uuid": "b2f997be-a436-4c1d-868b-184dcabf0626", "comment": "Malware payload (Mirai)", "value": "902407e5f106b3618456d5e8cbd7730bd366fe6335017d0ab4b0866948017e7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834780, "uuid": "2c6c26d1-f6cf-444c-adb1-f3148c8b66d2", "comment": "Malware payload (Mirai)", "value": "d001aa3dd076659811c45eb5a7837529c5e14d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834780, "uuid": "00e5f684-f5cf-488f-b0ba-33b4b18bea9e", "comment": "Malware payload (Mirai)", "value": "fa540dea0b629101487e154d4ff33c91b34822a08a58542e9204c66786bebb8779b7935578125cb468ba2cb3cb11e3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834780, "uuid": "76170132-18b5-405b-97e7-8ec53a648ede", "value": "T193B37DC4F243D4F5E85305716137FB369B32E5BB102AEA83D7A9AE32AC61501D606B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834780, "uuid": "0b30aede-e41b-43e5-b863-96b9e179a590", "value": "3072:nHo1RetMc6H0EBsO5A0D0nvw2hBKRk4egVv:nHo1RetMcU3iO5S14eUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777834780, "uuid": "4d16a788-a9f9-4b0a-9a01-9d357645845c", "value": 115844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777834780, "uuid": "beb06da7-3d7a-41c2-b2c0-8c342d1295c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834780, "uuid": "625777d2-5fd2-4e82-9cb6-5e2fc191102c", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017d8b86-4709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823943, "uuid": "c7835012-74c6-4d9e-820f-2b0f9b3486f3", "comment": "Malware payload (Mirai)", "value": "c25c314a178a78eaa8a4c06b9e9a7522", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823943, "uuid": "fc8ff603-2de2-442e-9241-0600958cb6ba", "comment": "Malware payload (Mirai)", "value": "91edaa3c8070ce2fe95b8db50036782a1d510dcc01cfba9a0c2cc1c3ff168f90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823943, "uuid": "23b2d69f-4e90-4ba7-9c65-04e53b9f0f6e", "comment": "Malware payload (Mirai)", "value": "d360a5d00beb6b0c1dbbdddb5c9c616f85bc20c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823943, "uuid": "98c7e872-eb5d-4e58-8f64-b4ea1819bd04", "comment": "Malware payload (Mirai)", "value": "d17cead3b372d2266c204120c288321cc5dfce91ce70e94ea0cbfb05d0c0e001055d7e48d0595f178e5b4647f243a982", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823943, "uuid": "8fe31780-7f6a-4406-858c-1ac7616f8e5e", "value": "T1FDC39CABB24F1451C82607F41BCB5B9D2E3325019D2B9AE77C6E323E2A369DF58053D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823943, "uuid": "8d64ed62-277e-46c6-9366-b0a0940192a9", "value": "3072:WXGmgEjHTV5LdRlU9+WODKJDdqobEbgiC9AJDiXYPgqF:WXGNkvdRlM+9q0oInC9AxiHqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823943, "uuid": "6db33aab-bc08-4c2e-b001-022fde708d3d", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823943, "uuid": "7c0cd625-995d-43d1-8111-4cbb990d12bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823943, "uuid": "121a4c1e-6e81-4074-803e-e6e730dbdd66", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ce9e84-46ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AZORult)", "timestamp": 1777819811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819811, "uuid": "274808ad-3905-4fe6-8c51-ad5b29025b81", "comment": "Malware payload (AZORult)", "value": "089d6c3725074bad9dc8759ff8db50e0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819811, "uuid": "8a35f55b-f442-4ab1-93f9-4a74bb565b5a", "comment": "Malware payload (AZORult)", "value": "920f61f352e162a9a76251841246c8b4caefe8cd9e671be1784dbe0bfc265309", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819811, "uuid": "d9c9d013-160e-4e6f-bf35-ba6186f337ca", "comment": "Malware payload (AZORult)", "value": "a30a0810963881bdefe4186b6604ff5bc7f1b4f4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819811, "uuid": "08f101c1-2282-4d30-abb5-e39d5194d8e4", "comment": "Malware payload (AZORult)", "value": "435408f753c8b70bef2e451b916b546359f4a2219a05187f38bbd3956c4db651ef7f4be875cb05b98f28bcecadf10609", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819811, "uuid": "fa713d65-736a-4cbb-889e-8000019baa02", "value": "T18FD40263B4A9EDBCDA3186B21B17C70EE6EB5FB55142A4EED305B0A30AF30D59330525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819811, "uuid": "df277e23-4163-44ef-b22d-d8c3399e9a08", "value": "ee652883d6cf722ddb85537fff2a8467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819811, "uuid": "30ef3e46-99ea-431e-bbc8-24648ae07400", "value": "6144:3+Gyr1HJFZrfP3W8D5jNG13KHPCEzBwXWYv2F2s+HyjEJAwHzgzeae:3jyrRPZrf/JnO3KHPC7SsSjuNgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777819811, "uuid": "948af912-1bd6-4e24-bedc-4ebca5d8a04d", "value": 597932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777819811, "uuid": "6e8fba89-9fb2-4b8c-a8d6-a29e87e86438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819811, "uuid": "4c0ab6d7-18f8-467f-8ecd-e8c52461a4d7", "value": "089d6c3725074bad9dc8759ff8db50e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1c7a26-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842456, "uuid": "7bb403c8-f090-4b3d-b533-94ad55d354de", "comment": "Malware payload", "value": "2cd8fdb79e5c2a065412b98dbe56a4b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842456, "uuid": "9d7c0be6-2b3d-4714-86c7-2b5a45f135a6", "comment": "Malware payload", "value": "9339e5efcc224f5e12358b48078bfd25f74e8a812321e08d52416484f31f915c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842456, "uuid": "180f5156-9503-4e07-904e-1dbd2acfff12", "comment": "Malware payload", "value": "1ebd42750ec0ba4e6d2ee2b8615e96488acbf606", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842456, "uuid": "cc28ecec-f9ae-4608-a910-aa249b730f3c", "comment": "Malware payload", "value": "662ff93c520c9ec94c4ad74bd0a1d0b2c647041d548fe0d1ce53d6afc10f852c3732ca8d8c02578845fac58b1c0c4d11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842456, "uuid": "6f4486bf-3f64-441c-8a1f-e56fd2e2ae5d", "value": "T1ECA32A55F990DA32C6D4257AFB5D128C33230BB8D3D932029D25AF3467EB96B0F3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842456, "uuid": "6d510164-f77a-4caf-83f5-9c160821b626", "value": "3072:KsCWi5wgKbM+lgUuqFB5YM28CcMNwfmLXK1I:KsA2gx0xuqFjEzcMIt1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842456, "uuid": "f64f3b3d-e640-4ca9-9282-24e3452bcc2c", "value": 103940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842456, "uuid": "8d494b3b-31a2-4d85-873a-fca7ec1f53a3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842456, "uuid": "07f8c576-2271-4dc0-b510-61f808865d9b", "value": "35fc4b37.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f86e69-471b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777832080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832080, "uuid": "055d15a0-0eb5-4b6e-bca8-d9e3720b95f0", "comment": "Malware payload", "value": "45d4006d9140a5f13ac12a2aa9bee069", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832080, "uuid": "f2cd1fa6-02d0-42ed-b9be-50c7cd052b65", "comment": "Malware payload", "value": "948b86fbc52043cc29142af945ca5deb0eb8fa639ab6e6cd8cf6902c6dd21ce9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832080, "uuid": "4083756c-205c-453c-a195-b39d1e2a6e23", "comment": "Malware payload", "value": "81302aa6f3761bd3e2523305fbcbffeeeb81dcfe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832080, "uuid": "c24c4228-e3ef-47c7-a3d2-553e2c30542a", "comment": "Malware payload", "value": "ea60b011b588f412451891f8200178a20df81f00303f9ceff17959714e5516fe9a12778bc821f0190fea309e33e1a1c0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832080, "uuid": "afe86ed8-4200-4635-8e3c-837e00a4b7be", "value": "T1C45733D3D0B1079BCC3B88368A78EA9E01A6BD559D41482FB55CF36984FF6E1B1FA005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832080, "uuid": "1c8e4d26-046f-4b3f-a2c5-351eb31dfe8c", "value": "786432:iawzXArEkqe39/QzABRaVgEjyTeMu8Ewd/w:ialrEk13VQzA7EjyqMxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777832080, "uuid": "273e272b-51ea-4127-84f2-1f8b8ef41061", "value": 28901376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777832080, "uuid": "57d0c2e6-072c-4c6d-bfbe-66fb33f41a42", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832080, "uuid": "4490c908-d9b0-45c5-894e-45388e3eb4f5", "value": "GRANTED YOUR FUTANARI FANTASY.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80897295-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777814707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814707, "uuid": "7f6a0ff2-49ec-4189-b8de-aec06e793782", "comment": "Malware payload (QuasarRAT)", "value": "1cc7539eb40736973f6974f6e294db0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814707, "uuid": "f2e671d9-1c39-4abb-be72-7524a9492a28", "comment": "Malware payload (QuasarRAT)", "value": "94b3610234806a266b77b547e75ac4f364b2ffbabe1421a94fad5ff3b7207b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814707, "uuid": "f606adf2-7bbb-4d21-9adf-75b83ec6400e", "comment": "Malware payload (QuasarRAT)", "value": "ff167356395e5574349d9565d64caa1f07f11dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814707, "uuid": "45617763-cd47-4f19-9359-e90e12b2bd18", "comment": "Malware payload (QuasarRAT)", "value": "480533605ffedf951963196ee31066bc9c82c84bed794fa98b41bfcfbd43f1afbef7ab2f67b6949f5c53045abdb5f0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814707, "uuid": "28d5a3e1-2f03-49d8-bcc0-09eb13e92e37", "value": "T19A66BE25531D81E0CEE6753960462752DA30FE0C903C67658FF4CBA669FFB6069AE23C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814707, "uuid": "9c4b499f-0466-48c7-b6f1-6db42df84fb8", "value": "092e7fdfcfc8705a24bc0d24c8f6d4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814707, "uuid": "b7006b9c-2da1-47ed-9682-00ad6c6a13c8", "value": "98304:7qfBDxTzxa4Gy9H0gdWyuWo8h4/zaxk68Sd4GNR04:sBDzaa9HcyuWox6FuGD04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814707, "uuid": "e2d0b038-a542-481e-a749-a0760c86f2c5", "value": 6835040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814707, "uuid": "33f52879-b573-4c69-b625-462044e136b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814707, "uuid": "e9ea2dcf-0063-4b07-8ecc-0b5c423686f8", "value": "x94b3610234806a266b77b547e75ac4f364b2ffbabe14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8c88ef-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823939, "uuid": "adfb2846-d261-4105-ad7a-f5a8e1c5346f", "comment": "Malware payload (Mirai)", "value": "fc7f82ebb9432dfa9bc460bed9449a85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823939, "uuid": "6033f0da-6df9-45c9-9a2f-3e8e1c4112c3", "comment": "Malware payload (Mirai)", "value": "959faf564e30b02e29d4099c6d92307742e917feacaef52755db01cd4ddd6ece", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823939, "uuid": "37b118bb-e420-4392-9390-4d262d79ac89", "comment": "Malware payload (Mirai)", "value": "1d2eaa2ece1800e3c4bed10ac2e08533ee7ec0f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823939, "uuid": "62c9e52b-7b80-498b-b497-3c51de79d899", "comment": "Malware payload (Mirai)", "value": "31fa0e1e0dbfc126c4b872408815341359b6b060f631021bbecee2356589560b585ea1ed742961b5d0f08c268343cb2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823939, "uuid": "7e3cf43f-9947-4ea4-8114-804a7d3d1ead", "value": "T187333B4DF783E0F0ED4B0571115BF77E97349E024124DE6EDB98BE66AD32A02B11B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823939, "uuid": "53302519-b655-4731-a355-e32fa539a31d", "value": "768:kwzbCKlqWC9wI4pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV988N+Er:kwX96cpOzwLMU431ANA0BLBCgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823939, "uuid": "83c424e2-0570-453d-a894-2e4d83b6b5b3", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823939, "uuid": "729bd905-5da7-428b-8287-1073c9590fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823939, "uuid": "bd976bfc-7859-4c0d-b917-8947a61a95ff", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d53af8-4709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823941, "uuid": "5e578e24-050d-43a8-a99c-6101748c5b52", "comment": "Malware payload (Mirai)", "value": "891f112dfb3ae387ef571c4459d28f6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823941, "uuid": "722fc97f-94bf-4d4d-9ac7-2d7d0f753740", "comment": "Malware payload (Mirai)", "value": "977a81a1a94910a87c6011a5aa2fe281f1725b841d725fc4ff1b980cc1d5c851", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823941, "uuid": "3ba34f32-315a-4576-ba9a-9a3164f67f8e", "comment": "Malware payload (Mirai)", "value": "a0cffe2c606dc36cfab5612a9ef9d4c0bbcc8b30", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823941, "uuid": "330397f6-6919-4520-a5a7-6865c439c412", "comment": "Malware payload (Mirai)", "value": "46f2682dffc1cc2e247b92f4b543a098177a8afb53c698eaee895bf7b3752ac8e6cdc5e6379956e1e7a0be85d7d48e5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823941, "uuid": "b428a8d6-7ab9-42a5-862a-048e31a08238", "value": "T160B30945F8505B17C6C252BBFB4E438D7B2A1768D3FE720399256F20379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823941, "uuid": "44eed381-3a26-483c-a4c7-410efb99b929", "value": "1536:TQtUqnn8Pd0z4VJtKT13v/vy6OZ5OZpqrcElOgwywXvqTVFnXYPqmp3j85vB:w/nnxz4JKh3PPnkzmpwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823941, "uuid": "26a4f4ac-0311-4eb2-bc8d-62299a86c629", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823941, "uuid": "5e98aca0-37e9-4e5a-a33e-c0085e8cd8a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823941, "uuid": "cedea0d2-e7b0-4a76-a668-36281ca5827b", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffdcac3-46d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777801096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777801096, "uuid": "4b253d7b-b05b-4c35-9bde-a63d54d066ab", "comment": "Malware payload (Mirai)", "value": "422e3a2b8fa351698772a2125ae61c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777801096, "uuid": "94a4881c-08de-4191-813e-af338dbd92b0", "comment": "Malware payload (Mirai)", "value": "97ac484aa74fbe17a47ef1637f00374d3ebd2dfb783dc569fee50725c21a1373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777801096, "uuid": "67bcea9e-f98f-4eaa-a178-84ebe4a98962", "comment": "Malware payload (Mirai)", "value": "202697efc454299328066b7ac3511678f5dc48e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777801096, "uuid": "e528af61-776f-46fd-84ff-fda066b84a11", "comment": "Malware payload (Mirai)", "value": "51af089e4cb4f4267d1e5741c0cdf8a569ec319444361eb86509c1271bc4a7735ea1da0b1c5e8456b28282547cecdad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777801096, "uuid": "c3d2b351-d3a8-4b4f-8dc6-26acba60d5a9", "value": "T15D13E0AE130149EEC466D2B45AA0CFB61D328A77F502CC4A6017C9B77E95514B863FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777801096, "uuid": "507e7be1-d629-4a5b-85dd-900142aa6e96", "value": "768:KGsIIBLXeSJzBHj+wV1smr+oEGj7XwABRIezqwH6GJ2fnTJgGlzDpbuR1Jv:KGsIIBzeeRb1drBse3ueIJVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777801096, "uuid": "e39ae668-9406-4851-9120-314cfc050829", "value": 44280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777801096, "uuid": "3af6f65e-162c-4443-a4a3-12fec65e6c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777801096, "uuid": "d8022b6a-a202-4e1a-8fab-ca9b1c3e9b3b", "value": "97ac484aa74fbe17a47ef1637f00374d3ebd2dfb783dc569fee50725c21a1373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2199b4f0-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842465, "uuid": "6c50701d-648c-4df2-baa0-0f67927cb96c", "comment": "Malware payload", "value": "4b0aa5515c18a7385fe858714c2af0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842465, "uuid": "0109b53f-96aa-441f-adc9-6906219d7f2c", "comment": "Malware payload", "value": "9891a50ca93bf0d02b9316e9c658839a7193d9887be7af872f9a6d08d3dbc066", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842465, "uuid": "f2be5f0e-097b-4181-86f7-abafc1c4435f", "comment": "Malware payload", "value": "373abf59c4266c88efe175300fd4d04382fa4fad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842465, "uuid": "75cd03cb-deef-4c4d-b6f8-66b1bc5075fd", "comment": "Malware payload", "value": "d4dd72ae303541eea072d02ac24e196bdd4cb50664d6a96971310adc669dadf68c46df9b33f9c1e8223a02b1b53366a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842465, "uuid": "f0006d4a-524b-48d6-aa81-4fef6ec19d0d", "value": "T1B1E33A46FE904EEBC05ECE30462E835716DD98CAD2E5A33F727CCD8C396A24649D3994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842465, "uuid": "65282932-9d2b-41e5-8d6b-123621efc787", "value": "3072:Qdp1LjZmIUkAMMj8I3jw9eBt/iYCcixsfR6C1sk9z:ap1LjDU3uCt/iY3esfbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842465, "uuid": "276367ad-0210-4c64-bb88-3a29b0576df7", "value": 150596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842465, "uuid": "56921a17-6254-4b15-b8ba-f3bc46297318", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842465, "uuid": "98b12916-c23c-4cb1-ad15-4cf547c0d757", "value": "35fc4b37.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5427dd4c-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794446, "uuid": "73e8f819-0422-4ac3-a373-4f170581eccf", "comment": "Malware payload (Gafgyt)", "value": "933f4405b3fdb52371562f45a439ce92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794446, "uuid": "7bab9b58-8027-4e0c-b3b9-0ba96f73259c", "comment": "Malware payload (Gafgyt)", "value": "9a804601f61bed111ab7bc6029790b8acd1c1ff193bf172c912eeb6f5c1dffe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794446, "uuid": "eef6b07c-c7ad-43a0-9f0f-6fb334ec9847", "comment": "Malware payload (Gafgyt)", "value": "e5d91ba6bbb1f86f207622c6f7e1695404895236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794446, "uuid": "36ca0f90-7ee9-4f83-a57b-ffd142e68130", "comment": "Malware payload (Gafgyt)", "value": "d56fb244ab372c4c4b67a4e1b698459c3f8a554916cdee113170cc1a97b56e0fad919d80b3aacf1fba7282129fc9b42f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794446, "uuid": "3e86e4f7-bdd7-4fa4-a322-9d39a34267dd", "value": "T11F93F893F801DF73F40EE77609D34B257230FB614A932666632739AA9A362D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794446, "uuid": "ddf01837-6830-4e6e-bebf-9d39b5deb133", "value": "1536:HkV2MlUqyW8FrMNvbfeM72KVLHEJJG0JzvAyBc4Y3BMV/bmXEVMXjpGtfLLe:HQJty5cbeJifezvAyBc47JmXEVMX1GtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794446, "uuid": "aee69a6b-22a3-45a8-91c6-6188d4fa776e", "value": 89174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794446, "uuid": "0e730923-ae55-4741-8206-c27486ae2c24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794446, "uuid": "517ae1ea-2766-4b95-8f0d-79958d5bdf4c", "value": "m68k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2002d59-4729-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777838009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838009, "uuid": "53614558-5b81-4bc0-9934-60b02a116c17", "comment": "Malware payload (BlankGrabber)", "value": "3c56baadfec3db5e52b48547cd72bdd2", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838009, "uuid": "4bceb3c6-b427-470d-a64d-aaa92f465105", "comment": "Malware payload (BlankGrabber)", "value": "9c0885ead4d68e9ed74f01cda1bf1c6b43d06d4b95eac664866592161331924a", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838009, "uuid": "6ad5024f-0d0e-4c64-a652-148789a0279f", "comment": "Malware payload (BlankGrabber)", "value": "457f8668aa201a2fc2430dad9c65be2feec5fd2c", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838009, "uuid": "743b742d-1d2d-44c6-b69f-4acde54ced03", "comment": "Malware payload (BlankGrabber)", "value": "d1622b917e76c60fde5b6867d5bf96e0a24a94c757c6c7869ae43004962458c9819606684cf8c618fdba18429288a4bd", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838009, "uuid": "3f314bc7-c3fa-43e2-a9ec-13ed433c1ce4", "value": "T1C7B63356E75001FAEDF3427D8942D03AE6B7BA325FE0D9CF4228452D2D63AE5193E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838009, "uuid": "d8ceaced-3ee4-4b8c-b5a8-9d603f6954c8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838009, "uuid": "45cac753-3571-45aa-9514-9524f548f19d", "value": "196608:C3udbMs7bttklmujO2U3xP/hibInII7vQpBc1beHcQFBtpD8cTBCFq:C3UbMsnA8uarBP/YkI0QpBc1bePFB4W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777838009, "uuid": "191975e0-18d1-4005-b437-fd7d3d051b87", "value": 10602370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777838009, "uuid": "76a9556b-13ef-439a-bd33-84a1e2305a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838009, "uuid": "bcc7d0b5-2197-4198-a908-dcc66259949a", "value": "TwistXc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c477473c-4718-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830712, "uuid": "1d80dc92-bd3e-4022-bf02-ef5448832697", "comment": "Malware payload (Mirai)", "value": "ac01fba551eabb78b919829a2d506e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830712, "uuid": "0f227d44-ec27-473a-8cd4-0138ca1964da", "comment": "Malware payload (Mirai)", "value": "9cb77d407cb632c4d22fce416793688e8bce174f274518087737bd684612835e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830712, "uuid": "cf2ea230-b528-4ebf-a2ba-89ab52f10077", "comment": "Malware payload (Mirai)", "value": "1efc6ed754d3bd8e23271df4cf7d47b6f2192336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830712, "uuid": "20f608ef-9a5b-476d-ae97-b6d7b00e7b21", "comment": "Malware payload (Mirai)", "value": "3267d10de4e449ad7ba3b27e54ca1bebb321625ec03ba56a9a7ad73981932e6ee3c2765687d32a799d2878a73163e80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830712, "uuid": "42694fb0-77c9-4cab-a4af-6b60201d59be", "value": "T1FB33F795B8819A16CAD0537BFA0E81DD3325739CE2DE3213CD226F6537CB42F0E6A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830712, "uuid": "d8384c5d-12f4-41c4-970a-3db44522fb2c", "value": "768:Sg4fvh5kHVXD5S7YwInDTGS/vFeeUTbBCoKfRZh9su6i9OzZWVMYDLIBYXNYmkbC:vAUHc1kTGQWBgZXiWUyjLMt1bN+ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830712, "uuid": "da7f6d1e-6a64-47a4-a1ab-c80ce2786d1e", "value": 52360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830712, "uuid": "f9746742-802a-4417-86a4-17dde4c24bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830712, "uuid": "4676f2cf-d70b-4323-a76e-2ac3f1899443", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b9b4d9-4701-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777820725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820725, "uuid": "af8d5dd1-49f6-4e3b-b414-e787d151e1e2", "comment": "Malware payload", "value": "f384647fc44d546efc4cf72330125fe9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820725, "uuid": "8cf8fe2f-3616-4170-a21f-54d2943322d8", "comment": "Malware payload", "value": "9e1ad01c68da96f30f680dc0a872defd75b5a97f41c711cc2a5640fd538cab06", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820725, "uuid": "5615730e-3ba8-4c70-be3b-503329a2bd1a", "comment": "Malware payload", "value": "d4596c9f0201e9411b8699731181809797f87bb7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820725, "uuid": "3f299f10-fa90-4172-ae72-1608ce474333", "comment": "Malware payload", "value": "2a62dde8426e85406bee58b9379de1d056bdb62586c26259f645cbfd7c6c0102d78289015f6b9102bacef5b67febfa81", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820725, "uuid": "946fcdeb-4de3-4d61-ab80-030905ee7af9", "value": "T16C56014EFB0DD23FCDBA24356996036232265C0A49D2D7471550B22CBEB76C89F2AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820725, "uuid": "d5cc1be5-95be-4140-b8f0-b3af344c2b4d", "value": "98304:xd1HBsdVvBPsFx19KI4fJ7h1I9h8jJTQfRBjFdaNZtmVkX34iPAZgAFxZgA0F4ps:X1HBsDh09sfJKh8F8fLFANZKGPAZgQxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777820725, "uuid": "f508d517-6213-4685-8369-fe6805be40a7", "value": 6257181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777820725, "uuid": "2dea7e91-a58b-482e-ba20-2d3656a4e1a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820725, "uuid": "54774f9f-5864-4d6a-853f-fa857705ad12", "value": "com.clean.optimize.manage_1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d54ed4b-4709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777824016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824016, "uuid": "50df302f-4e83-4622-aadd-76c63b84a73c", "comment": "Malware payload (Mirai)", "value": "2787adb848aefa5bc9fc54fcbc08188d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824016, "uuid": "79a6dd59-7da6-48ff-bf62-02bd42742ecf", "comment": "Malware payload (Mirai)", "value": "9e37232005140e8ccf2865636b1281b78534b47b40e2f49e3c1f8be20e9a8f3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824016, "uuid": "3221bb68-6c51-493f-8ca9-bf7e52a3473e", "comment": "Malware payload (Mirai)", "value": "a40cefa3a4b700206b0cad0f1a42813d2fd6707c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824016, "uuid": "acc64498-119e-4788-9880-16d6e66b942a", "comment": "Malware payload (Mirai)", "value": "7c279966a8f86253396952cfd59c41a5e7947beb7f83204f013c7c311eac3227811eaae58b4839309969d4f7c913a031", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824016, "uuid": "b8c36c09-df71-491a-aed0-78d1c67c2876", "value": "T10FC30956F8819B12D5D151BAFE0E124E77131B3CE2DE7312AD246B307B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824016, "uuid": "7b21771a-25dd-47ef-a9f9-1808a64f8e39", "value": "3072:LIkKYKu/fXKqhawotDDVThSYV3ppZctiYjjlC:LI1pEXVaRtDrSYVfciYvlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824016, "uuid": "d914e5d2-ed5b-4518-8d10-84d8262ab5cb", "value": 129308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824016, "uuid": "0b8960c3-0c78-4804-8790-037c9d50d87c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824016, "uuid": "be166945-c76d-4071-be1d-839c36313f9c", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12486b9a-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818387, "uuid": "b3f84183-1a63-44c7-bb27-5db6bade5d8d", "comment": "Malware payload (Mirai)", "value": "1a6c00246086a1f98918bc38bdc4f87c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818387, "uuid": "fc1b258c-1068-43e6-9863-cc883fcf681f", "comment": "Malware payload (Mirai)", "value": "9fa717ce42bb3987d2683991a65306d58a6844ccbf673ecf9ef5dc0cac965cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818387, "uuid": "fdd1dadc-88f1-4298-a010-85aef570df39", "comment": "Malware payload (Mirai)", "value": "0bfe06a3e574cb24e361cdb4e9d984ab5c3b3ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818387, "uuid": "75bbb91c-fcdb-4d55-98ba-609b670d8f67", "comment": "Malware payload (Mirai)", "value": "d64d5d40602de26466d9497e2397e353b14433a2801c17b2a8839a57b5c1c8bbc1f452d58c4e6b1f1872b1d5d2c0ad89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818387, "uuid": "224a2b53-f347-40a0-a662-8c75c4977e75", "value": "T1D1C3C609BF614FFBE89FCC370AE9270124CD692625A93B35B570D818B64B28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818387, "uuid": "234bb02d-b743-4ca3-adca-a5a986f85461", "value": "1536:rUu2Dxzcbo9fd9/BFhbqkIrbJAoQ0WttnQArlaYxYsZ9scYtNfEY209bb:YuX0fd9/BFhbqMrsYxYsSqebb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818387, "uuid": "b1bf2224-d83e-418f-b57e-a7f6a55817d6", "value": 126172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818387, "uuid": "a5e88773-2705-4056-85b7-83eb073d79d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818387, "uuid": "771db60c-9246-4d2c-a308-36ca48725656", "value": "runningaway.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad969f8c-46fe-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777819507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819507, "uuid": "3865d0d3-401f-4791-9789-87d49608e3c4", "comment": "Malware payload (NanoCore)", "value": "5567a15853cb3ac49574215ebbe9ffc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819507, "uuid": "69e104cb-4733-4fbf-8667-484d1892e7b5", "comment": "Malware payload (NanoCore)", "value": "9fcd6a10e2cb0f06e588e8dfa7c109fc9a55f5726703f1ce3d05828b35f4b2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819507, "uuid": "3b43539d-ba44-48ef-a0b0-0e4bbf42070a", "comment": "Malware payload (NanoCore)", "value": "f71a60f4c2eb65543126aaf1578b129b9cac5d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777819507, "uuid": "44188a05-1490-4872-bb2c-84a869a474d2", "comment": "Malware payload (NanoCore)", "value": "d72008337c1585617be884c1c89842674e698ba14af5b78d84e48c111bf1f8acb224c5dfbd0e8ad5629c9cea1a20fb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819507, "uuid": "ce19959d-beb5-4b0f-b0d1-d6a60793ae8d", "value": "T1CE14CF1A3BB84A2FE2DF46B9612252428379C2E398C3F3DE58D455B75B663E40A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819507, "uuid": "fd358992-de0b-48c2-9e3c-0e23ccc1bcb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819507, "uuid": "13417dc9-17fc-4da9-b2ba-c11f915bfbc7", "value": "6144:wLV6Bta6dtJmakIM5oKcXD+tGrXgP159WRH:wLV6BtpmkvKcH7g1vIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777819507, "uuid": "611387d3-909e-4738-849a-0ae58adaa855", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777819507, "uuid": "c49c830e-ba31-4825-8319-e223aa32efd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777819507, "uuid": "b09629b8-2864-4935-a984-c60346174299", "value": "1.1.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4907fe23-470a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777824492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824492, "uuid": "8fc2690c-b156-4cf1-b2c6-d1461744dc80", "comment": "Malware payload (ConnectWise)", "value": "6c07ec17d831d2fa1e42831bab55f7e1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824492, "uuid": "c893b4f6-ff86-4a26-b5ad-6c9bd40e2496", "comment": "Malware payload (ConnectWise)", "value": "a04e774417e18fb1ab0cf011c0c5942890c19416eac626d623107592a9686543", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824492, "uuid": "7209900e-e94c-4ba5-8591-6bccee768c26", "comment": "Malware payload (ConnectWise)", "value": "6877e5b60ec4aa609acac3910bcaef27f19c3a7c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824492, "uuid": "6e61dee2-4e76-4ef1-936d-6adfeb64df65", "comment": "Malware payload (ConnectWise)", "value": "2235fd823fea720716ac6fbcc0388b3ac687ad40a575ff0aa9b2e63ad949f2f9cc2c5a7cde272ab0be2e68515f696754", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824492, "uuid": "3fa50273-1ca6-44c3-a14f-a666c25e0150", "value": "T15946E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824492, "uuid": "33ba3a3d-8230-4f08-9206-0892d3899855", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824492, "uuid": "8726d1de-5ae4-494b-aeaf-0f9c7fe202dc", "value": "98304:PzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:PhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824492, "uuid": "cc456ac8-170e-45f9-9e86-c6bf10f060ac", "value": 5642904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824492, "uuid": "8f4157b6-f7e8-4c44-aad4-094a981b4d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824492, "uuid": "56af685f-3054-452c-9378-07ed0c63c6b3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b9754c-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818319, "uuid": "62a3b081-e157-4dee-913e-b597ba02bef3", "comment": "Malware payload (Mirai)", "value": "2c866759aa7273ece13751027bf66a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818319, "uuid": "0d14ce65-7ce6-4822-841a-585be487162e", "comment": "Malware payload (Mirai)", "value": "a422461b7167cb33800acb20c618a603537afc109048fcdc5cccce56fbbd7981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818319, "uuid": "964c43c2-8692-47da-9cbd-36aba66172f6", "comment": "Malware payload (Mirai)", "value": "420fc71c3e873189cd5682c486fda12f3805a15c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818319, "uuid": "4faf47ac-0343-4f08-9738-753428d9a02e", "comment": "Malware payload (Mirai)", "value": "8316b0ee147203d78138daaa256abf3c525cbf0cbb459f846d7cda80101a2da9b4ed0bcd0ef39a467cdd2b348fe0124a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818319, "uuid": "5918c249-0f82-4ecf-addc-9cfb4d22428d", "value": "T17903F190F88A48FAEB7E3D3C44E496957B7B89563B42DDE7F0D8971099060279134CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818319, "uuid": "cf755fbf-46b2-43e5-a860-d1d8416c62d3", "value": "768:CeyUX5xK3I6ue3Ll7FiUHujjedwdU5slTtJhp/7WUdoG3w/4uVcqgw09+:CeVKY03Ll7zAjUsFtTp/7BiGm4u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818319, "uuid": "0fa1e5f3-6759-4227-9280-4549721d4a9f", "value": 40984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818319, "uuid": "1630729c-ab7c-4bc7-84f2-603c2ef03088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818319, "uuid": "0800415c-e667-41a2-9d65-0e181d9815bf", "value": "runningaway.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40c0884-470f-11f1-a769-42010a9c0008", "comment": "Malware payload (UmbralStealer)", "timestamp": 1777826900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826900, "uuid": "8238f867-fb7d-4afc-aa2a-1e5a3777d7aa", "comment": "Malware payload (UmbralStealer)", "value": "f1965680c86e07084b3954552a2f3240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826900, "uuid": "4e8761d4-9cca-4f5d-9bec-07e599d8743d", "comment": "Malware payload (UmbralStealer)", "value": "a4c68613a9c6718fe737a671897e41c03283a3cbb1f241142f0f6eb33f84f890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826900, "uuid": "b77afec8-28dc-4c79-8f8e-69b841b34772", "comment": "Malware payload (UmbralStealer)", "value": "e41f40ea121ace3e7c57d79ec410eb2529dbcc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826900, "uuid": "93984988-8e18-4997-97b8-9eb28dd1a2e0", "comment": "Malware payload (UmbralStealer)", "value": "680645f79af2166b721f5b1a854dc174ffec4489d6e7013e155fd3eb2b943c95f9fc099066d29b127f1fcce6cb417d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826900, "uuid": "eb6c05c6-cc76-4f76-ae83-baafe96a6ba2", "value": "T173346B5933B88F17E25F8BBDD5B0158F87B1F143E90AF78E0C8899F82411B42E949A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826900, "uuid": "1771f28b-d8f0-47ea-9efe-b67f64026856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826900, "uuid": "a5a5de21-c41b-457d-9c7e-3b46a7a33fe2", "value": "6144:RloZMDXU9Zx0kt8X0/PSCsMALA2LxCqVzQhTuOL/1b8e1m0SYdi:joZnf0kkPlLA2LxCqVzQhTuOL9dSY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777826900, "uuid": "66a6728e-278f-4ac7-a0bc-1ecf29133abc", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777826900, "uuid": "741fb195-27d4-4b1c-8df3-fc22fd4d1420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826900, "uuid": "5ccfb172-3202-42ce-8d1b-deb06d347428", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b72bdc2-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818456, "uuid": "e365b45b-b734-4bcc-b660-f723d062c6f9", "comment": "Malware payload (Mirai)", "value": "659d34b28afbdc632be0aedd2217d24e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818456, "uuid": "8c3a5bd0-a218-4558-8750-100424ad0e7c", "comment": "Malware payload (Mirai)", "value": "a55a88d94ecf1580dc26c82a4c7eda0a3069cde9c312dc16fee1aa8bd0ff3a20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818456, "uuid": "b163dd32-9c9e-40bd-af58-8b580f0ee422", "comment": "Malware payload (Mirai)", "value": "395c02425197a932482444d520016fcb3efdec44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818456, "uuid": "3afa032d-12a8-4f45-9a2d-bd5a300ea692", "comment": "Malware payload (Mirai)", "value": "6aada6fd8d0a73a8490b8743137bc37e48c574a9577e2b8c7b097f5bdc56207d54db537eeeba7aff2b68df6f66e6c521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818456, "uuid": "f7eb1c06-382e-42a3-89f6-c92728b32d03", "value": "T18813F14A91A49AD9981661B80AFFE04B4974F3499FCDB0BB138CB57354CBF036B983C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818456, "uuid": "265ec7a6-ab42-4c4d-a531-fca391e990d8", "value": "768:AAYtVt4DqyUHLAquHkt5xBo1wmm+uvz4h4u8W77MC8WdDln3Cl27nbcuyD7UGQRj:Ej4Dq/AquwxBWm+Sq4uf7IC8GDlnSl4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818456, "uuid": "becd6e2a-d3d0-4483-a641-0044143e93d9", "value": 42916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818456, "uuid": "078cf96f-e7c4-4635-929d-2233d666cab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818456, "uuid": "d863039d-4056-4857-8508-dcc99a550e3a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54faf9da-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794447, "uuid": "8633ed73-9ac3-4224-baa3-94a98ea27513", "comment": "Malware payload (Gafgyt)", "value": "b33c95705ff36fe3b40c015789d324c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794447, "uuid": "91d40d8b-121f-4dd3-ad41-6b61274cc53a", "comment": "Malware payload (Gafgyt)", "value": "a61f2c1401e122ae2e5fe8667f1a423ab2f51fcefea6fbfccba3280f20afb08b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794447, "uuid": "63bed337-83e6-4775-91e8-5c5cddb453f8", "comment": "Malware payload (Gafgyt)", "value": "06592f9e4a159325ceae984a55c0eea8625dc5ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794447, "uuid": "70b927bc-632d-498d-af9a-03950dec4dfb", "comment": "Malware payload (Gafgyt)", "value": "5a3a807846b44d0fadcc1e4b4284772e33e50935eee23fa9c9bf1d5835825c188e6c0d6196dd48536426bd52bb2f4caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794447, "uuid": "3c23de57-c3e5-4291-8bdf-9b8c8c6e5688", "value": "T15AB3C807AF61DFBBD85FCE3306AA8A11208DA55612A97F2F3234D95CA74754F08E3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794447, "uuid": "71f0db2c-5dc4-41a0-a092-af970de417b5", "value": "1536:KzqO8rWkK6ZQiLgdYw2Qw02xImQCgVlNGlfjwlm22/FLflEi8C0e:JrWkZpKCd9slm22/FLf6i8C0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794447, "uuid": "4d036bba-0395-4c72-bb05-2d2c5c953538", "value": 109342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794447, "uuid": "d7124731-d458-4748-b15e-d9ba235196a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794447, "uuid": "2883c443-f033-4bb0-ab6c-801237b450ea", "value": "mipsel.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a4573c-471f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777833585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833585, "uuid": "c8214d64-b9c6-4eee-8f87-dfb7ea331148", "comment": "Malware payload (Mirai)", "value": "8e45635d2964b7770e6d0e089fad2693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833585, "uuid": "fbf9c8a5-e323-4f4e-b0c7-04ebcf41ace1", "comment": "Malware payload (Mirai)", "value": "a67b56d59447182cea06360ff5c3da3cbfe8adeba52663680c298a65002497f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833585, "uuid": "2a1ec61b-f284-4345-a648-8d5cb5b6b320", "comment": "Malware payload (Mirai)", "value": "93841307a85f01acf08bd10689c38d7ea728a25d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833585, "uuid": "2e2cea1c-f640-4426-9bcc-65511b1fdd22", "comment": "Malware payload (Mirai)", "value": "9119637e29428cf7adb3048bfbd8b489abf5e82e6ad64b44b571ee69e6e1431b43ffb95a0460addb7d8b315a822d34bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833585, "uuid": "234d4ec9-a845-4a4e-bf5f-ec28883405c2", "value": "T1F4A3185AF8919B22C4D056BEFD1F519D33231BB8E2DF3202DD08AF2437DA95A0E6B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833585, "uuid": "cd1f340f-0baf-4ee9-828a-a9513fc8780a", "value": "3072:P5zs2uHS6ZclZZPMEd719UzP1YOPIx8AWveh7hncc:P5zs2ibCZZldh9spgxrWWh6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777833585, "uuid": "bed36a31-603b-46cd-bc5e-c97ab6a2fc25", "value": 98964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777833585, "uuid": "76411495-4330-4936-a45c-c9e31593d05e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833585, "uuid": "4446f27d-6e45-43e1-98c4-246899dd3194", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0862a2-4736-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777843663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843663, "uuid": "aade047b-9fd7-4ac1-a3f2-e879d8ee68c5", "comment": "Malware payload (Mirai)", "value": "1e7b1fe622c69468311cec0f4417fda7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843663, "uuid": "6e6bd8eb-9f8f-4716-891b-562dfb8ad640", "comment": "Malware payload (Mirai)", "value": "a8526e4caf12c8c19ba19a568b390d7a1d6ff17e18628a68c6187c14f5edb12b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843663, "uuid": "e876b75b-7845-4696-a1cb-5b227c1a0440", "comment": "Malware payload (Mirai)", "value": "58f7e8acbdc42182898544fe8f9a9aefa94396e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843663, "uuid": "a39a2d2e-a96d-42a8-a521-e36160ea52b8", "comment": "Malware payload (Mirai)", "value": "d502ee4309c016d9883223100da8567a4c3977eccf44aa7427eed8458d016aa7e097c12d2409f6dc0740908c9e2bc017", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843663, "uuid": "9b6ea36a-96f6-4ea0-b532-f27c295f39af", "value": "T15AE35D86F802DE7EFC0BD57E44670E19FA30A7613243172E569BFDA3AC321651D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843663, "uuid": "64bfcf90-e154-4c82-8e76-6e9e7b2a9a73", "value": "3072:TowRJaJQMUmfh6qnTcdYS4ikshvXMMBqrTGQAu:B0QMUmfL3SDhXMMsGQAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777843663, "uuid": "48ee9f54-7f73-4609-8037-ae23e1698746", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777843663, "uuid": "d5fa2c26-54a0-4f7a-b8fe-a66ae7955ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843663, "uuid": "2fdfe3c1-f883-4a98-a043-f49a84faecc6", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ed8d38-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794451, "uuid": "5fda3987-03a5-4328-adfa-da1c857613c0", "comment": "Malware payload (Gafgyt)", "value": "cfd026402fb6619747cc29fb1e0e8c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794451, "uuid": "420fec76-e237-40c6-885c-194849f17769", "comment": "Malware payload (Gafgyt)", "value": "a8c14fc78fff811732692f66b1ed6ad223049cef02638e376af2de2001ab6ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794451, "uuid": "f0d2748e-8bd9-4680-9a21-090ce5598de1", "comment": "Malware payload (Gafgyt)", "value": "e429a4e1db7129cf667aa4b0fa475864865a002a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794451, "uuid": "b4da53a9-b903-4735-a5c4-cb5da2a48156", "comment": "Malware payload (Gafgyt)", "value": "fc72fbdb74f7c7e47f47a297eaaceaba6c8cbcf9dcbd3944e81b6e96e93c266b590fa6a8a452e1524700aaa56a8a4c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794451, "uuid": "a524e814-1909-4686-b601-49d0458eef70", "value": "T1F8732801E693CBF3E5831BB502A7AB290A31FC151A2B9F65F72C7DF4DB124886217758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794451, "uuid": "5e37be2b-0abf-410f-be06-64623c323ee2", "value": "1536:gUBrl6E69xWMuCEW0lXuZS7siS7UxCt0Um6IjVYCjEGmf4Rk:jB5X6+VbWsXuA7sxUxCRm9jVYCgGmf4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794451, "uuid": "7a66f416-2f3a-40f1-89bf-1bd30058dc85", "value": 73563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794451, "uuid": "b7d2f9be-fd20-4e2c-b1d3-bb91ff1b32b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794451, "uuid": "da677d6e-3027-417d-ae4d-f9db0f216893", "value": "i686.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe5ed8d-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823940, "uuid": "73a1251f-e823-49ab-bcd3-0d9066133cc8", "comment": "Malware payload (Mirai)", "value": "62ce1721bc5e27b9167f69b1d90a8140", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823940, "uuid": "28a19017-10e5-4b66-8499-f68980cb89f9", "comment": "Malware payload (Mirai)", "value": "a975e955e2aa23a4839fffc01b45b80319df512225e37ba956e2e24784ef5f20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823940, "uuid": "5cff4a88-ea15-4567-aabb-d3e69cf458e3", "comment": "Malware payload (Mirai)", "value": "4277de26a5ee0070228d6307dce590980ee8e673", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823940, "uuid": "a4a40e09-ce27-4ab7-9252-fb2045a95fcc", "comment": "Malware payload (Mirai)", "value": "65bfacb3f58a93435d6c1f3beb985e11360079b64dfd6ebea22c0f04587492919ab108846bf536f291b131bacc32f976", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823940, "uuid": "ddbda853-f93c-4598-8ce5-082c870b7f3e", "value": "T106B3F845F8409B17C6C666BBFB4E438D7B2A1758D3FE720399256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823940, "uuid": "8b47ce66-b098-45ab-a8ea-eca11d3aa340", "value": "1536:l2uVnPJ86wi4VI8RTUUCvyNOzju+m9wYeFZdmlV9MwywlQ33m3Ds2dgoYakJc+:wu9PJ/4VRwUSi+IxebcNhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823940, "uuid": "5d48f1fb-1b5b-4ec1-9f69-203e4c607562", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823940, "uuid": "284eb0e3-4982-4340-a11d-53525346c359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823940, "uuid": "69de6007-8476-4e3e-b673-f050d4cce423", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d724f9f-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842458, "uuid": "6fe2d3ab-5892-4f3d-87c1-fb516921bdac", "comment": "Malware payload", "value": "ef1419ce4439fecc5e63cc4f68fd5033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842458, "uuid": "397c4f22-c7f3-430a-a7e4-68d8f266f80f", "comment": "Malware payload", "value": "ad736101a3e60aa4c0ccfd9afae69a5ff993ee661c43161d94062b3122d5b70d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842458, "uuid": "ddf63f34-0f6f-4766-862e-9a9ea970cca6", "comment": "Malware payload", "value": "7edf3067e7700e7a09f99a0f379fe0ed7997e82b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842458, "uuid": "5983545d-d16b-46ff-bdf9-5de9e8943446", "comment": "Malware payload", "value": "6087321886d5b59253869250b96e977458d45646213d96a3bfb68ec8fefe0e11bba066888e8fec08b1f7e709bda53ed9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842458, "uuid": "d8ccf9f5-14a5-4f5a-853f-3506b48abd7e", "value": "T1FDE31A567710DFA2C369C13009F3C792A7E9269226E28549F32DDE1C6E31349692FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842458, "uuid": "20e7d91d-b335-467d-b10d-a1bd4dec8d79", "value": "3072:47v7b/fmG1KY+lyk6GbikOcQRnzlrYhjeKV:Mv7b/fmG1BVHkRQRzxY9VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842458, "uuid": "1ccde85b-da26-4a02-b90e-1f72a53f943a", "value": 153652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842458, "uuid": "45a72a71-4ba9-48a7-8784-aeda6679cb11", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842458, "uuid": "ef4d024b-c2ce-41c2-93bb-efa7ddb7fc25", "value": "35fc4b37.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad948b6-46dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777804738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804738, "uuid": "d908e50a-4ad3-445b-8f25-f3e7610483de", "comment": "Malware payload (Mirai)", "value": "8393c1823632f19e23f7fef28d25a5e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804738, "uuid": "7c0fbec4-4924-4b01-8108-b396b6fd807f", "comment": "Malware payload (Mirai)", "value": "adb3346a4d9e068d030a0724eb496058c6b8a369586bc31fc822218a8b6650f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804738, "uuid": "3c210338-7b4f-4308-a5f0-f153c8bc14c2", "comment": "Malware payload (Mirai)", "value": "96844db275530ea932b72829fcc7be1e1f0cbb06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777804738, "uuid": "6ccc8085-5906-483d-a049-6ff1cd078904", "comment": "Malware payload (Mirai)", "value": "ddbfc7e450f85778bb33ef850172cdb2a7e4690158a84bdbda470b5571017e23b1b627cd04a4122c5ad6a885ee38a369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804738, "uuid": "5fa98602-7410-47ac-8d14-ed277c902186", "value": "T18C93084377094F03D06329F026BB5BF087AABD6118F5B284B55AFEC99271EF16042F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804738, "uuid": "a16769e2-c317-4276-a613-45b7a26d6ecd", "value": "1536:uLMm0jisRhf6Y4aK33rSCWlT1nfH5jATqSPvFFqTItVnrTWPN18J:umvR4YoTCJHSFqT0rWWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777804738, "uuid": "6c5c26f0-8567-41b5-ad57-9d3a8f1f7c19", "value": 88804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777804738, "uuid": "0ed65cdd-3e4b-4f29-aecc-f8894613a35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777804738, "uuid": "439cccc3-5927-472e-9903-9802fc1ce349", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed306450-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818325, "uuid": "9683aaf5-74a8-46f9-a0c3-25a71d9cba66", "comment": "Malware payload (Mirai)", "value": "0f309cab4c70eceb4ef984edd1ec04c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818325, "uuid": "768dc537-5ba0-4e6f-adce-affc4b1f0c3a", "comment": "Malware payload (Mirai)", "value": "aeb87d989b47b8d9c3196d16b5bbea1a0eac94676a3c7aabb8686941592095ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818325, "uuid": "5b6bdbed-5bca-43de-93a4-e61ffb434c2c", "comment": "Malware payload (Mirai)", "value": "c5b8a73792dea0e46184623ae38efe47dc57a785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818325, "uuid": "c4e78cab-9868-48cd-b31b-f74904cde070", "comment": "Malware payload (Mirai)", "value": "52125bec8393c32d74c72e632886f86a72b39c4a0f8bff18d88b0f4b817249255116045d3097d782a802ed58d423bd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818325, "uuid": "3e19f017-821c-4f40-b88c-eba19ccbdc9f", "value": "T13223E10D2594BECDCBDCDC3E618D16A319796899B297330782254EC3D93BE3F7449864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818325, "uuid": "e6e46d89-44b7-4daf-9587-a63651741d71", "value": "768:OHo+r6CRYG2pM916H9osANgJuL+t+IdLGOejd0DWI:OI+Z2y9PFgJC+3pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818325, "uuid": "47875a94-fb07-40fe-a73f-533c933911dc", "value": 45940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818325, "uuid": "7d42b8f8-04c3-4f37-8a3f-905ba6b7d855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818325, "uuid": "875be8b6-70ce-436d-b1a7-b1c0df742a31", "value": "runningaway.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8c4a2b-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842461, "uuid": "f23306b3-0404-4f38-aa14-57be39032b1b", "comment": "Malware payload", "value": "9af7c65c4621b18574864af6bab47f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842461, "uuid": "6bb0ae09-0ccd-45e0-9d83-e619e1982016", "comment": "Malware payload", "value": "aeffada0964ff9433df2d904ea964ca4e4b02c021d11a68c24a06bed08f7605f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842461, "uuid": "91399508-3096-4a21-b361-98b2bda6e413", "comment": "Malware payload", "value": "30e6be4a5299d1478c593627eb34d97f5cc3120b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842461, "uuid": "cf034a29-ae72-4800-af29-43bb55ce4fbe", "comment": "Malware payload", "value": "49037e1e315c46b387f1998402267bd20532a369877ed59f5726d5c699411fd4d2eaf9b3992159d6753c2f3c65063184", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842461, "uuid": "542e5b0c-ad4f-4fca-827a-2d7261c44144", "value": "T1E6934B06B5A294FDC0D6C430869FC537EB36785523117E7F2794AA312E36E261F0EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842461, "uuid": "b00eba84-7156-4def-9bd3-d2f950d57941", "value": "1536:XeumLoldNtuzfhDOWkrv3PowB7NyJy/FR48orc3:0old+BkbfzxzR4tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842461, "uuid": "eb857ad3-e1ec-4ed2-8f89-5a5617e86b69", "value": 92544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842461, "uuid": "9fc77614-2165-414d-8ab3-5812d1293ac3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842461, "uuid": "67e6a3ee-6bcd-408a-8de3-9099e33a1f4c", "value": "35fc4b37.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6c830-471d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777832882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832882, "uuid": "b043976b-40a2-4bb1-9dea-2c6102d9de7e", "comment": "Malware payload (Mirai)", "value": "79c4572fca869681ec25f0dd81ed56c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832882, "uuid": "78a44954-48dd-4656-87cb-c9ae56f03c94", "comment": "Malware payload (Mirai)", "value": "af1622d29a4285f9e26a48439707018b090834e753ca1a1b57cbbfe5d958339e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832882, "uuid": "38bdd83e-437e-48ff-96a1-e7e4f100183e", "comment": "Malware payload (Mirai)", "value": "7d2241324ade119dbe43fea96fc85c3bfba80b07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777832882, "uuid": "5c730af3-8119-4f22-88e4-87b55b34e555", "comment": "Malware payload (Mirai)", "value": "f6fe86c770342446c37565cca4dbabf26ca4f99f2bd71536d4e421a5f701fdef680ca3f2b73a65da44bf190f07de01e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832882, "uuid": "c3c14b06-44d8-4bc3-861f-1fc1168dcc49", "value": "T17FF34A07B5D180FDC4DAC1744BEFB53ADD32B5AD1238B19B2BC4AB222D49E205F2DA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832882, "uuid": "2eca513d-8198-463b-bb84-658eee71c370", "value": "3072:AuY/PtuDYmRHWPMuajG5JSt7M4/4j3fQFlbINeuskhU0avwou:AuSPtuDYmRHWPM0NQ8IHPVvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777832882, "uuid": "f9e840fc-2160-4ebf-abfa-fb255b24332f", "value": 158648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777832882, "uuid": "14de8e26-0989-4009-ab21-9efb8d6e8cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777832882, "uuid": "4926b29c-fc2b-443a-98e4-c0088b3e58f0", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2420582d-4728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777837315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837315, "uuid": "1b06ebf4-7a6d-465c-b236-6775a18225b8", "comment": "Malware payload", "value": "ea43495787fe5dec37b873bcd0ec5eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837315, "uuid": "f65bc3f8-fbaf-4bd3-9a07-3e13011c9c84", "comment": "Malware payload", "value": "b072107ed67d3e6cb9ab818f885af76d62d356c2cc7ac35a489b4c5fdffc3e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837315, "uuid": "00c0f79b-f6bd-4390-9a51-c705d0aff3e2", "comment": "Malware payload", "value": "6409645972b9ebca7fcbf67d62f873b16f382640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837315, "uuid": "776b720a-bfe4-4c29-854a-0b6019acc121", "comment": "Malware payload", "value": "c33e25d51bf55b7e577ed0d0022a7afb8ed9854dd7358defc947eb7134ca856a7ae10f253d48ad414ff1cc63a2b1e2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837315, "uuid": "e6d64db5-e9f9-488f-9235-4723b5a3706d", "value": "T1FE08336A2034D9BBDC21E8FEAD425473D293D386B9390C6E054A2052B7F43A7627D71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837315, "uuid": "d04f7b39-6186-4c57-aed5-03c1504b111c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837315, "uuid": "1f8d9c1b-ee5b-49ed-ac0e-7cba0a3a319d", "value": "1572864:bt9IKP/zmdpovRsOA8nRhq/gGa4A/F/WCTjJP+BoSm2gI+ff2mgOPU+Wc7:bUKXEBl2RhqzajW2lssI+dcXc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837315, "uuid": "d112b977-e0b8-48e2-b0a5-551d0cac328a", "value": 77592139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837315, "uuid": "ada8499f-397f-4e9f-a512-9713d79a4eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837315, "uuid": "adb30fad-ec48-4cac-82c8-56cf2accb888", "value": "Activator1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38e9f34-4716-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829878, "uuid": "a7374f5f-bb38-45e4-9942-1dd9b2a60a6e", "comment": "Malware payload (Mirai)", "value": "61f7e1a721fb89af6c6128d8c84371a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829878, "uuid": "1bfa97f7-1089-4770-9c69-febb197ec896", "comment": "Malware payload (Mirai)", "value": "b0984398ea071338f424f2513f7399e80ea7a012ac824230867830e422cc570d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829878, "uuid": "918d013b-f217-4293-ba7c-a1a1c89f3e4a", "comment": "Malware payload (Mirai)", "value": "441ce3b4003e1dba918cd9d86e13997e85bfc34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829878, "uuid": "b0397f4d-b464-49e9-827a-c8afae5ac359", "comment": "Malware payload (Mirai)", "value": "d5130cacfad1cac9bb037c265016c459f1b327762b74eff60e4cd6ec36bd93cd9bd8d2cf5ff78ff091bd28cd3a3e9259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829878, "uuid": "9e67e308-7d80-4284-bf55-3da11d407b64", "value": "T13863B70A2E258FADF76D873447B78E31A34823C627E1C585D15CED001EB438EA45FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829878, "uuid": "7e4e9c2e-0118-48ee-a932-8a2ebb628f1b", "value": "1536:tMnls3N062RtscqlmjaeLeNx4nWBc32fEKXIOUPD:qfRHqlmneNw2fEv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829878, "uuid": "05d0f276-fc99-430b-b161-ab731c906a83", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829878, "uuid": "3e265139-d2f8-4656-bbf8-7ce6cae68d24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829878, "uuid": "fea2ef5e-ded4-4d95-baac-2c097ef8c3aa", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e754a5-4687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777768469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768469, "uuid": "a0f57c8b-b82d-472f-93c5-439d61e40e0b", "comment": "Malware payload", "value": "fe8647d9fea54992a3f7f46aa6b7458a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768469, "uuid": "0a7a54f1-fd38-465b-bb65-4bd7aa4349f1", "comment": "Malware payload", "value": "b46984c13ecac7de987aeaae7de8257bd94584c34c60ebdebfa6046e63b0b773", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768469, "uuid": "a9fb4a06-062a-4a14-85ae-60cc0003b91b", "comment": "Malware payload", "value": "880d93f023f1c6cd8283388a71489ff00f65ca9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768469, "uuid": "b14bba9f-8533-4a63-b493-c60ba1b3f296", "comment": "Malware payload", "value": "9defe90745068ff7a583d6ddbc7a7513b618c04bdd3d4dea8f31be4ee7b4005df9936bc31d398133cc5489d17f300448", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768469, "uuid": "049627f3-2bc7-4792-a4c0-8f83f088b5ef", "value": "T164136D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768469, "uuid": "4a0e78a6-1dc7-42a7-9289-0d61fcb5c894", "value": "768:bJs9NyXsZztC09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b+HusZ8cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768469, "uuid": "6bf15890-74f5-458e-9722-cf12d833ce02", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768469, "uuid": "aaaf4f23-11a2-471b-a5d4-9b92b57b0ab7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768469, "uuid": "e3029876-2236-43c5-a8a2-12f1eeeead95", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5bcaef-472b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777838861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838861, "uuid": "ac7a1e28-833c-4921-b38e-e3f834e56fd3", "comment": "Malware payload (QuasarRAT)", "value": "163cc9d2e1e7bbb414b62a9c2b207a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838861, "uuid": "0ca063ea-585a-4088-9291-33bbe3b04a72", "comment": "Malware payload (QuasarRAT)", "value": "b5b6a5431aac5ef2fd7ab06583a30d77d76c9d98e165d99773694d6c1a395bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838861, "uuid": "70fb63d9-b770-4dc4-b0be-2ecbb90292a0", "comment": "Malware payload (QuasarRAT)", "value": "c4b4557761db60859297e1fca7aa519125929880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777838861, "uuid": "f4cd56c3-c78a-41e1-bff2-ebb6a03cdad3", "comment": "Malware payload (QuasarRAT)", "value": "be94e0b3f7a64f958210d0f5132c90d5c7131481d7d73777a0a1ff60886ed45c9953d9f10983d6eacf74b144e58634d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838861, "uuid": "0d1728cc-b41d-40e3-9ba4-736812600ea8", "value": "T122850250B7F58116F2BF1BB8A4B744490B37FA13DA36C78F1948906C1EA77809E913A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838861, "uuid": "4a6f64cc-bd7c-407b-b815-6728a5ed44a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838861, "uuid": "0a21c8af-151f-4cf4-b1fb-91951a3bb5d8", "value": "24576:ERbjQmpSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkz:ExjQSTYj77wRGKKm77LrwCB6hqanD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777838861, "uuid": "87691d7b-94a8-49a7-8670-06251926f24f", "value": 1839104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777838861, "uuid": "de034dda-1ded-4f75-bc21-2b6fe7b01945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777838861, "uuid": "a787ff32-9701-4f72-a74f-ee4cdd7359c7", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ec0ae3-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842464, "uuid": "f7b24834-98d0-4f33-b24a-1afee3e01a0a", "comment": "Malware payload", "value": "b87137212af38f7feafeb4f1244c18f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842464, "uuid": "dd48f467-af21-4df7-aafd-c0b6843f347d", "comment": "Malware payload", "value": "bb59d95da6fd81886b4f014d9d144faae4bf0656e55f6226e9562b3e3058990e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842464, "uuid": "76c733ac-0cea-4976-a2b4-9a88dc9c8303", "comment": "Malware payload", "value": "9331d4c98cdba7d9108f36ce17acd186d394e25a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842464, "uuid": "5008d032-36e9-4881-95fa-8411df2cd602", "comment": "Malware payload", "value": "ec260f391436e980cf2232031fc4648e1ecdd782a003e07a10f6c40f28aa0dab236075bb163f84fbc769436661b8c0d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842464, "uuid": "26fdd99f-149c-4728-9984-fb64e75eb32c", "value": "T1B1938D81761D7FAFE1972D7D86024713AF0C9F10A843256261EE75471AFB6A21F2B8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842464, "uuid": "397b9098-5aea-492a-a512-f28ae369505a", "value": "1536:PHQTWwmjDRpO2OW6IDAAWj3iHa7I7TvaA0J+4/oGB20vP4atXQrW13N:PH8mjFOxvjsTiB+4/z20vHRoWpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842464, "uuid": "83042846-0dde-45ec-b7dd-c5c5d33bbf3a", "value": 92460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842464, "uuid": "a1bd9f04-6b10-491d-9ddc-39dfd39ab5e7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842464, "uuid": "50d9abb0-87fb-495a-b8de-3ebdd047cc92", "value": "35fc4b37.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8f96ee-4729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777837755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837755, "uuid": "f60d4638-3a80-406f-a4f1-513ccd6e9b00", "comment": "Malware payload", "value": "7d1d0545958d3edea92a687381373134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837755, "uuid": "b9fa541b-8d82-4e14-8927-f3a6a94688c0", "comment": "Malware payload", "value": "be578f42ec4601a6a3c90acbbf26450aaba7288c4a8019fd4dbd23924326bfb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837755, "uuid": "c4327d3c-efb2-4947-b0b8-31886d864ffd", "comment": "Malware payload", "value": "96bd4f463a2fcd786c031b5cf0e970e99e204d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837755, "uuid": "35c6a5d2-e7c0-4196-bea5-ce590c119de9", "comment": "Malware payload", "value": "a974b08d3f5ef49001a3ace91785f66e6beeb9876679be372977fb1df54e6e4595798b8b1af26e1ac0e99e5d47cd6cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837755, "uuid": "91bcfd1d-4543-41e6-9c48-faeb358565cb", "value": "T18306234B33B1DD4DE75FC6B20807C0F16893DA53805B2F9B4DD460798A66D4AAEE016F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837755, "uuid": "c2932236-8bb7-425a-8538-eb19158493e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837755, "uuid": "f3778df8-c634-46c3-8e5c-d405500fc4cd", "value": "12288:vh4x5sv1puMlEZzU+8hAMEeg7WfZGVYipZMQXzexSh:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837755, "uuid": "8f9a4a5c-4ae8-4d51-aa36-52efdfedfa2b", "value": 3812352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837755, "uuid": "69117b95-2dfd-4bdc-b545-fa11a4dc00bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837755, "uuid": "19e90d11-918b-4bf5-a767-fe4dbb23d1b9", "value": "6wwlmfu2pol6wqop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e22a47c-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842459, "uuid": "24fd6b5a-b4d3-4867-a9cb-8c20163fc89d", "comment": "Malware payload", "value": "4fc0e4d3568d1d140675d20d75106bb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842459, "uuid": "fe6e1f63-8822-4a93-ac83-af64c020bfd5", "comment": "Malware payload", "value": "be7cb22e7e199e37267cb8f750d5cdda633185cc1521ea0bf361515a362a53d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842459, "uuid": "2f7063e4-b382-40e9-b013-85ca9a3f4a28", "comment": "Malware payload", "value": "7ac7c2ecf67429fb844dbb5e16a3232aa772cfb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842459, "uuid": "6e56fe46-0a41-409c-b723-126e1fac750e", "comment": "Malware payload", "value": "a0f8460d342276cbe2e96e1e589fb79a7dd3336c0df2d5da3d1491d138a2b385e88bcef0ba01b248213c2c6d73aa57ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842459, "uuid": "14ca0103-2a5d-4354-b381-6621b50af9f9", "value": "T1C683D090B9A67B4ACDCD923971C40A947311ECB24A55E71B04A2B9312C7E1F86F4DCFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842459, "uuid": "09f55d08-55d7-4c9e-b576-c77ac3b20aec", "value": "1536:U70cDP9ODCJ/S2irITNyJQbf9g2wu9XOdsP3+s+K4QIr:Gf+u4u9VuE4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842459, "uuid": "738e3b25-4457-4bc6-b926-423784579961", "value": 88016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842459, "uuid": "88dce423-86cd-4446-8bbd-7a2b60ef157a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842459, "uuid": "9a9bf8ca-7757-40d4-add1-4fe0a72a2085", "value": "35fc4b37.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25509116-4731-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777841183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841183, "uuid": "d62b70e6-360c-4c2b-b4f8-c2ebeb9a4466", "comment": "Malware payload", "value": "bd35db55865f27c4db05b88c68bba777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841183, "uuid": "ba555eb2-b706-4b06-b037-c5f21afce49e", "comment": "Malware payload", "value": "c19e828e2d9be6df6afff5d6272bcec0a1046189ce4b94612b9bab39b1ebfda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841183, "uuid": "2120576a-fe80-41d3-b20e-cecacd39ac82", "comment": "Malware payload", "value": "85b2e5e283cadd4d051e65d91454cda08ad3a40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777841183, "uuid": "c590900a-e49d-4d37-a00b-fee8e95a27b8", "comment": "Malware payload", "value": "621e9b11237b6341503c5ef6f96d3518c7bcaeb5201f38cf1ffa35d4f45c5e859017f1c8ab99da5227e31a68fb9350b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841183, "uuid": "f91b5cf5-1373-4fca-8efb-78808aa6dde7", "value": "T12A34130BB2BB81A9EA4C15B1913392D1537FEE25F923AF7FC854324E97B81028B55731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841183, "uuid": "f1f84404-4c1e-49cc-b470-bae91bf6f5c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841183, "uuid": "0ce98a61-5490-4de5-ad16-9547f750414b", "value": "6144:wKE5L0ZXFPiqbi7pQLTDy4JvVUSwoDjajcdkkHxC:kKV9ry4pVUSlOjUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777841183, "uuid": "bb521c54-30bd-4713-942f-c95c064b5bd9", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777841183, "uuid": "89799768-ed43-4fab-bab0-73ebbc62fc02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777841183, "uuid": "1f959d87-a7e8-456a-855c-ced2c604a3ea", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febe523a-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "58f8688b-51b2-42b4-aa82-159231266d4a", "comment": "Malware payload (Mirai)", "value": "90897efd73a07fdd5848518b25aa4f40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "58e762c0-35a7-4851-939c-95af5d0b5ff1", "comment": "Malware payload (Mirai)", "value": "c1c7ba1181419ce5022d726b11a330ab3b3a615c612f71cd4e5aa05f861537a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "163bc39f-631d-4616-b781-0a55d084380b", "comment": "Malware payload (Mirai)", "value": "7e4ee5983bcc0aa5016b4830f162bd52a96b8a2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "f2149ab2-5edb-4c20-9ac5-5693fb2121c5", "comment": "Malware payload (Mirai)", "value": "4466ae39d61567df54dafb77e45411efc574005199d8d55b3a55421e2dc7326aa7b963e15c67b82f23d306673b13c5d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "417097a4-9e64-4abe-b954-7e32fe59f3cd", "value": "T14793F749FD416B10D8D635FAFE4F024973934B6CE3FE7201AA245B2123CAA6B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "21cdb557-f7c4-47ea-8bc3-322c02f15075", "value": "1536:YAnwVsWc2zgUdtS0tFbvacgzafVAweBuqKlUI8HiLNRIbT2gZ1Y6B:MsWsUv5nTacgzafVAwe5YNRIbT2gXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823938, "uuid": "1f7a4fcd-8def-4994-ad98-7e2e5c81f5dc", "value": 93316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823938, "uuid": "96342923-0ef1-4202-8cca-37f67a23daa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "91cca9f0-a47d-4326-9868-9e0634eaa94f", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6935e7-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818320, "uuid": "50b33ae9-8d7b-4241-883e-ae636ad8adb6", "comment": "Malware payload (Mirai)", "value": "f0a50a23afd54bd9d1451586b09e0bb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818320, "uuid": "bef04510-9f71-4dac-aaf7-69be43201938", "comment": "Malware payload (Mirai)", "value": "c277d2fb689f4cdd1a9a99dfea9990f38c024bc90d7e57e5435fea2910ab4bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818320, "uuid": "97c9a3f4-b5d2-4a0a-b2ff-d6f6291374c2", "comment": "Malware payload (Mirai)", "value": "bb87f0a261b270dc83e898c27d51a0b90057890b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818320, "uuid": "2cbbd530-3084-46b4-a549-c2b095fc369f", "comment": "Malware payload (Mirai)", "value": "251d214c0cfdaa7e5c074eb53c7cb42977397027c9bdfdf2c627a9647e2d49ea35d87a658407c0391f648d076f37baa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818320, "uuid": "c427ef29-9aa6-42f8-86b1-0994be8248ed", "value": "T170A318CAF401DC7DF80FDABB4463590AB930E36116A31F26675BFD93A8721E45826F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818320, "uuid": "a03bb760-836d-4685-87f1-aa0a695ff3c4", "value": "3072:p8RwquhtSZgPFxk/81C7sIVo1qJTI9azcwO:nVhXPDO3VaqxzcwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818320, "uuid": "055fae46-4705-4947-8027-170f2ba820f2", "value": 100488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818320, "uuid": "99045659-57ab-496b-abda-bfe85041902f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818320, "uuid": "ab644e2e-14da-43f6-b750-94f5842e679b", "value": "runningaway.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb9b696-4736-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777843665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843665, "uuid": "866c5b9e-8a58-457b-a4e5-360979e9ba7a", "comment": "Malware payload (Mirai)", "value": "6ff6ae33cc7e402561b4dde457163f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843665, "uuid": "f9b1626f-0eb9-4776-bcfd-96632126bd0c", "comment": "Malware payload (Mirai)", "value": "c31514561ce99ad3bf0abb588eb01067004f2372e6e2b2baed64ded792a56a17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843665, "uuid": "bab590e7-2870-4571-9947-c443c13427c6", "comment": "Malware payload (Mirai)", "value": "cdb7610c03ca23f8cf03c38c082a40999df114e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777843665, "uuid": "9fc5061f-d8c3-4d9b-a453-b357108e1264", "comment": "Malware payload (Mirai)", "value": "453f143423547e8987e6d020cd09fcaeaf13b78c7d90ade2c28ad3e74809c8a66be1c160b37a96f707c0db168fca2f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843665, "uuid": "368c81ab-799f-401f-bcb8-759fa0f6811b", "value": "T17CD35C0673180F17D5A35AB0263E1BE083FEE5D021F4BB89691F9B6A4672E371581FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843665, "uuid": "9682120a-12c0-40a4-896c-76920a549949", "value": "1536:Gom472eUS/FXyFQ+16G3m/2kcVJlVAzWXcs3Z7AUneMG0Dl/wnBy5Z2o1jaq2ViS:ZXUoyzm/5sJwzWXbZ7AUrRZYy5ZfV76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777843665, "uuid": "f9d55c29-e090-4f16-a872-a4fc4a618b14", "value": 136760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777843665, "uuid": "72c3415e-337d-4021-82a3-5e8b2ec21bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777843665, "uuid": "a2e4c078-f2b9-4212-bc1e-1abb76e4b1bc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab45886-470c-11f1-a769-42010a9c0008", "comment": "Malware payload (Urelas)", "timestamp": 1777825327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825327, "uuid": "419522f2-eb04-45b4-bed0-6ea0750261bb", "comment": "Malware payload (Urelas)", "value": "71e9f87cc89c58a28b3c224ffef08e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825327, "uuid": "5707c538-b33a-4d08-873e-aea85b60c670", "comment": "Malware payload (Urelas)", "value": "c4ba1826b10d7fc307214601cdab3dc0e3d59106246d35c7c0ea92e46a83236f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825327, "uuid": "e4ccb06a-aa87-441a-9386-24020f4c27f1", "comment": "Malware payload (Urelas)", "value": "d1b560a0d481d2c09f4e21befa5172ac5b3caf7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825327, "uuid": "8bffb4f9-98ed-4334-844f-9701ea38fab0", "comment": "Malware payload (Urelas)", "value": "3618f59cf05351c7404214278c2a8052ff54360cf6289a895930aec083301c552d79cde488975f882ad13d36c114a254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825327, "uuid": "4b87254f-5b66-4ffc-aa6b-6f70ba30d2fc", "value": "T1A3E4E10E3629B4E7CA354E78AC1446959233A893BF5116F369D4634E8C672FC8F67F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825327, "uuid": "439f9e75-6a87-46e2-900c-af9e8b66205f", "value": "a8ea87858989a31364a8c3dc2829b64a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825327, "uuid": "308a7e48-f37b-4495-b9dd-80a2c2bb2f45", "value": "12288:1kZvus5C6S1r2n0ByIbMetloDVue/9c9RShvTEaW8er5+nZocer5+nl:1Dp6SBbMo2Vx/2LShvTEaj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825327, "uuid": "2edc76ca-3b53-4be3-90e1-d512438e01a0", "value": 691862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825327, "uuid": "23cf8c01-5114-4381-a8e9-36e3fdeb088a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825327, "uuid": "89cb9a60-f9e5-4e42-aea0-cf87b7525692", "value": "c4ba1826b10d7fc307214601cdab3dc0e3d59106246d35c7c0ea92e46a83236f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e465bd-46e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777807767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807767, "uuid": "c2a8c3f2-3b6d-4f0d-95f7-36763e194325", "comment": "Malware payload", "value": "78c3075b8bd0841a7b01da4fb9b2c80e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807767, "uuid": "35c9ae90-c822-4f50-9b3e-e0f502dd8157", "comment": "Malware payload", "value": "c52a8e03f12b1e301a04ce1e92accb8cc0da9be81eb5e3b3a4917a4cd9568e6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807767, "uuid": "48924963-eb85-4252-a1e5-943c289ae9c8", "comment": "Malware payload", "value": "8d416ae31bcf781a39c49e36eb709cd0da6a6780", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777807767, "uuid": "352a551f-e2d8-4f0a-b417-0f943c1fe645", "comment": "Malware payload", "value": "fca2cdb62220dfc4fcf722bac69173ac6f3e3fde4c786a1b1e8b7e5117f61570d3865d5fc2a0bd4d8362d234068ca4bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807767, "uuid": "582bf791-278f-4c72-8ad0-32a507ae9c03", "value": "T1C2136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE718B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807767, "uuid": "6454fe25-0fc3-4656-a55f-76ceb0ac765b", "value": "768:bps9NyXsZztCuq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:beHusZx/cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777807767, "uuid": "6cd2c2c3-f672-4a7d-b6ce-ea3b400b9901", "value": 45417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777807767, "uuid": "3e9f09c7-e635-410d-a617-d512713317bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777807767, "uuid": "73a50256-d042-45cb-a56d-51acec5f4001", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc56e68-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842457, "uuid": "76ce9a55-d1f6-4859-a1e4-bde675829a62", "comment": "Malware payload", "value": "d5d62ef5767662a2c5913068142a5dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842457, "uuid": "9be18518-a9d2-4821-a837-b75252e3a05d", "comment": "Malware payload", "value": "c542254c60a32c56b85df3b40896bafd260b34043595a7498c31356462e7223b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842457, "uuid": "0b481a43-ac2a-4c5b-b6b4-960e9720f4ab", "comment": "Malware payload", "value": "c0404c4eba8c18c608be0978dcd7b45886715eab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842457, "uuid": "d920ca9f-843d-4f2d-a624-c020e4c82237", "comment": "Malware payload", "value": "965529533b2ba4680fd8960b62cff9d3b0de30486bd5a63e702c6ed2efbb4680870c2683c7e4245f8d9ea380e1ce0ca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842457, "uuid": "101a41fd-4070-4713-a26c-f03005aaa7be", "value": "T188A35D89FB83E1F1F5A346F11027D3AB4B34DD254011FBA5EF0A7A31BCB16466A5A21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842457, "uuid": "6f043057-3f33-4be3-ad5e-6d923d845a67", "value": "1536:WMEiStKrtJYCNrrO3ZwCPCRXTMgi0UuocOwQG6aVXtMPeZQVcmorFEvLq:vSoEeOZhPCxTri0jXQxaVWmyVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842457, "uuid": "aca7917c-9b3a-4be3-a0b6-9a94bd404cd0", "value": 99800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842457, "uuid": "9e68b7f4-2314-42ea-93e3-4dde4705340b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842457, "uuid": "b160bd89-817a-4699-bfcc-47da721aac37", "value": "35fc4b37.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2762f7-46e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777809383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809383, "uuid": "5b8a8781-c954-4fb5-9673-843735c40d75", "comment": "Malware payload (Mirai)", "value": "751e3ed672d9b58dc612e9798f3e5650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809383, "uuid": "0754be2c-6c7f-45fb-b80b-14ff38457695", "comment": "Malware payload (Mirai)", "value": "c632463211c9b0593b1ea64ed8b1733854069c907163af9cd5c7db6e2c010847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809383, "uuid": "5c8cfdfe-7b65-4c12-880d-f0edab9ddbeb", "comment": "Malware payload (Mirai)", "value": "685d3f299da76539ab057fa98d58614cd1de3656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809383, "uuid": "3f5a68f1-a128-4f5f-b6fd-5438f5b57d31", "comment": "Malware payload (Mirai)", "value": "2fdc97cd186a0e80fa655fb888ccaba16a0b7911400fa8e8811c9b699478d0c1c1872b4dd2a5c472f6422af7e27bde6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809383, "uuid": "b6e91439-e6ef-4082-a179-f91157dad4aa", "value": "T1D2C3B91E6E21CFBEF65A827407F78E31965877D62AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809383, "uuid": "e0d932e6-9e67-469e-afdc-1847f33296f4", "value": "1536:tw4lPfv7d7Y/YLpdYo1fpNeHvztsi8ZPDoM1ISWlKnKevNeThmF:7lPfDdMKdYo3wHvzt2ZPDoMCsnShmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809383, "uuid": "08445198-3135-44d5-8d55-7260cf262c20", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809383, "uuid": "a1ca1ec2-e3c5-4742-9263-5d57de095831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809383, "uuid": "077599c7-b4fd-41ba-baba-d543f46a4e23", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd75765f-470b-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777825117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825117, "uuid": "c4962589-8d71-403a-8da2-72e2c559f40c", "comment": "Malware payload (SalatStealer)", "value": "9391b88d8e72bff1ad25257481d6fcc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825117, "uuid": "82f1d308-2d6d-4aa7-afae-4bb7cc8cf625", "comment": "Malware payload (SalatStealer)", "value": "c858477fb65819f92e07c322a1d4a76cfed3d2c459cd60a1d8f07f208a2943de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825117, "uuid": "2e516ff0-fcb2-42c4-be95-4f25a900a1e2", "comment": "Malware payload (SalatStealer)", "value": "975f0fbdea4479c9d2185ec7d10552c29caa8417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825117, "uuid": "ec0c1728-7ceb-444f-b14d-262868a0456c", "comment": "Malware payload (SalatStealer)", "value": "8b26af774e631f4853dc48c4a10b22a3db167278ace3938b6180626ed577a379215784b94156fc16d8b450613b1e6ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825117, "uuid": "03f280e1-dd7d-4a02-8988-851075b68ee8", "value": "T1F8D65C41FA8B54F6F9075831506BB23F23315D049B24DB9BFB887B2AF877A91187A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825117, "uuid": "70e909d6-07ef-473d-a605-84745470056c", "value": "98304:ZYKmKX8jTvC2r7VSM425a+ETlpCBcOYyHvQSNwCCh4d3HVdjE:CKerrJD0hWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825117, "uuid": "4a4183f7-f80a-4170-ab2f-3c6eeff56595", "value": 12920320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825117, "uuid": "387a6e0c-e96c-4a92-9776-ebce9b2d7416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825117, "uuid": "0689b6a0-a2aa-499e-9ab0-a1db4854e80e", "value": "5v5iig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef410971-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818328, "uuid": "ac18e414-f456-4ab7-8ad5-510e7dc87a58", "comment": "Malware payload (Mirai)", "value": "3f129bcfe68569647bddf58e332bf035", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818328, "uuid": "2429b1db-0f0c-4523-ba63-05b35907e3e7", "comment": "Malware payload (Mirai)", "value": "c8f85a30c8bb2727770f8967bb92eb91df4744ccaa5bd447eff39a98eca4b5b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818328, "uuid": "899cebd3-1237-430a-9d72-5c1e10c76515", "comment": "Malware payload (Mirai)", "value": "c5a420feab1dd4ca1149d52b87ec49d150309af9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818328, "uuid": "62d2c5bb-607d-4905-80bb-545ddc083ff3", "comment": "Malware payload (Mirai)", "value": "ebc65facc1154968189c99ac3b6782e69d9e48f57d959b0dfbc612a65157eb20a07ef771a5627e116987196f4a9c428d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818328, "uuid": "d46e1d03-a8af-4dd7-9dbb-dd2843e9dfc0", "value": "T163714F8F100F5BB05D969EA372EF035C2D9690A7ECD69F03548C2AE4084BD19BD79973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818328, "uuid": "ccede9e5-1630-4053-bc10-c1e988524366", "value": "96:imd1msjmrRm0TmW/mivm/RmxNmSTLmVBm8zmYH3mP0om/VmUvk:vdEs6rY0KWui+/YxMS2Vo8qYHWP0N/kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818328, "uuid": "59687422-3152-4242-9322-f23e30bde2bc", "value": 3704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818328, "uuid": "09eec3be-1d01-4de2-a7f3-5e4473dc6559", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818328, "uuid": "35bb1399-99b1-4b8c-9736-67d88dd78643", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b656cb4-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794458, "uuid": "f5104590-b61f-4669-806f-d39bd4d6e29c", "comment": "Malware payload (Gafgyt)", "value": "11f595dca660c5d22c8e3b330a790171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794458, "uuid": "4b9e1b6b-d441-45cc-b82c-4f799fe6a2b8", "comment": "Malware payload (Gafgyt)", "value": "cc4e6e7913791778ff622c7b983938bd9d519ed561d23a1bca6b6bcdba349bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794458, "uuid": "3ef236d5-80de-4e6f-b1d1-b29a22e47dee", "comment": "Malware payload (Gafgyt)", "value": "d3a5bde62e70bca39398e72e4c33006f0e7be65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794458, "uuid": "05e6bb1e-a5b7-440f-83fe-44638e420a86", "comment": "Malware payload (Gafgyt)", "value": "d4879ad8af945d2bbfbbdcf9540c179b001a1c0f660c30e998f5cd297645a38ed3c72d029954fd3592d52c4bc6a3d64c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794458, "uuid": "11eca7a1-9f98-451f-94e6-67d5f5748a33", "value": "T1A3931B41F9418B13C2D327BAB7DF475C3B366664A7DB33016A297EB42B867C81E35620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794458, "uuid": "ce78309a-6c06-43c8-a00d-9e2e96ebe9fa", "value": "1536:3txf3sKYdhf/qfXXza4JI7sGT8OpOAtkvGIilnseh4wlVkSOmsm30rQOFW+WDXpz:37fvYXqfjEt8zGIi8wvkRvm30rQOFRWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794458, "uuid": "055c4f63-42c5-4cf7-95cb-b9d0a391b690", "value": 95949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794458, "uuid": "cd6f3b51-1da3-4afe-93c8-d55bac5500fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794458, "uuid": "ee10a26e-2f03-4a9f-af64-0e6a9472f3d7", "value": "armv4l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9800b7c-470e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777826506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826506, "uuid": "3892758e-28c0-4a71-bd0e-4e43988a4da7", "comment": "Malware payload", "value": "623d6816f8984b9e33b326943b08e3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826506, "uuid": "c7aaa250-689b-4ef5-8eb8-3da3245195bc", "comment": "Malware payload", "value": "cdcc2b3acde239f38a8a0d5bc34701d199ea7c839330b9f85c23483523d34425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826506, "uuid": "6ae668e7-d19c-42a7-93df-695e442a34c4", "comment": "Malware payload", "value": "4fd79f037056491af019fe13ffbd5e4f345f0748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826506, "uuid": "9295a0e9-8164-47ae-953d-08d0f22e8b35", "comment": "Malware payload", "value": "62bc5869bc8e74be1a28dccefc2c0205b80ba63a9e83b693957fb2f9b57a4204aa327c5d760a93b02f752c28ccf0c200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826506, "uuid": "e67ebed2-4d9b-48ad-a700-4d4adec767ff", "value": "T1F9648C5813ED8A26E6FE62B4E83D440D47F6F61A612EFB4F1A9410FD6C13B8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826506, "uuid": "e5e01f1e-063f-4db4-b7ee-b4ffd0c873f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826506, "uuid": "b0500b6e-0287-4bce-b42d-25569de1fd48", "value": "6144:bvqcyxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:Tbu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777826506, "uuid": "712107a7-193d-4969-adb7-c8eecf228875", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777826506, "uuid": "b02a9c69-063e-4526-9fa6-7528d73f8892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826506, "uuid": "3f0ea652-a64d-40d3-b3bb-05bc385d23cc", "value": "Sdlibrfpb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56de774-46df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777806179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806179, "uuid": "3b7ba0bd-7326-4d83-920d-04e53c717d2b", "comment": "Malware payload (Mirai)", "value": "5a7e5acd2eead1dce8ec0af900a4430e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806179, "uuid": "7d13eb50-1427-4480-90e7-234a4ee5b294", "comment": "Malware payload (Mirai)", "value": "d0c15e6b6bdd89757a156a6cf63005648ce22dbd048f416dbc648c4e9fe04106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806179, "uuid": "a383c8ca-c159-4c06-9b4a-e72a95366172", "comment": "Malware payload (Mirai)", "value": "fa13aafd328e5d8f1aef324ed92f63a2fa1b881b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777806179, "uuid": "30e191ba-616c-4172-ba4d-a06b401fba2b", "comment": "Malware payload (Mirai)", "value": "e7b8d83f49a702d1cba7d9ae12dfd78434a1b508f5993027406264bfce4a2a34f238f4ec7fb6cf9acee92a83542b3191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806179, "uuid": "0fb882fd-e8ab-4d5f-9251-90158a7105b9", "value": "T1C6831A0377090F03C16329F0267B1BF097EABDA519B4B284755EBEC59271EF22186F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806179, "uuid": "5ff44b22-f953-49dc-b03a-4a248bb18f2c", "value": "1536:9L7tgTewtH/OoQQ9F4ZcNAHeS+/PqU+mmJKlhv2qMQXrzspSl:9af2oBKf+DmXqrXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777806179, "uuid": "04029e84-c5a7-48df-a92b-c0d28005f1fe", "value": 88724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777806179, "uuid": "1b5ca35d-76ba-4475-ade4-f3e0ada77d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777806179, "uuid": "04f2b7da-066b-4095-8e9f-0ad72af65c5f", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ded8d-4716-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829762, "uuid": "cb35e947-86ca-4dec-aaa5-27ba3a600c80", "comment": "Malware payload (Mirai)", "value": "5f73e178892f84b5c0a469566053ca86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829762, "uuid": "cd246f77-757a-4868-b5e2-07aa4b1e5bfd", "comment": "Malware payload (Mirai)", "value": "d1c2181c879c326b2da2d533ad2623f886a1e984c03dbca55d7bf17acfb374a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829762, "uuid": "b84795ef-719d-4adb-9819-5951ab679f3a", "comment": "Malware payload (Mirai)", "value": "7470075fdc8522a065352e867c6e2f857295e3b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829762, "uuid": "1196b44d-4dce-4461-96fc-5cc13491b0ea", "comment": "Malware payload (Mirai)", "value": "dcd151aaf2af9585b1ad4f572b0154182358c739d139be8663ec179727e03a6ec413edebd905f9e46953e1028c0111f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829762, "uuid": "eebe3724-e7cf-42ae-84f6-d0985962a0fc", "value": "T1DD233AC1A602D8F6ED724AB550771B515B36E43A5629FD82F3B83636B802F109A1F2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829762, "uuid": "f40c917b-4949-49fe-8ec4-987968b9ca6e", "value": "768:Q9kyQZbji4UE9VBE7iAeYWuTMmc9Um1wcGmryml6Sw3zZFQpBskmQT/:6kyQZbji4UEEiAeYWZUDhofw3z3QpB9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829762, "uuid": "ffa385a3-12f7-467c-9175-195d11e98f32", "value": 46544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829762, "uuid": "d74a1f52-d778-407b-8c37-c3c390ddc251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829762, "uuid": "0604d282-3351-40e6-af5b-f4e080951864", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e835b6ca-46d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777802425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802425, "uuid": "66ed2fd4-c249-4613-bdc8-98c9267c4dce", "comment": "Malware payload", "value": "851a7ad7d67f97d03ffc23b5db12b9ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802425, "uuid": "d0a3d795-42ee-4e2e-ac9b-0a80f53562cd", "comment": "Malware payload", "value": "d1d5704f16091fb540e55b00330cfdf105848ad63324ef82c4185477cfdc4dc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802425, "uuid": "e561eec0-90b6-46b3-9b10-248e27c1ce17", "comment": "Malware payload", "value": "9d89f1688ef903f69d21f8c7430b280526db6508", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802425, "uuid": "098af9a7-a5ee-46e9-a636-6401f600a117", "comment": "Malware payload", "value": "936640e73a88d1e1e1a1094588726b487c7dd65a3e1c2985133b29f7956689d8abbfbb1ec6c8b22313f837e5a2cfdf47", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802425, "uuid": "cb29c8d9-ec1e-479b-afbe-d24c5a1dea38", "value": "T14C060873E59541E4C1EED174C6259223BEA03C8B173423D77FA1A7A11B76FE46AB8320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802425, "uuid": "30a4f9bd-57d4-47ef-8bb0-fb9c23e8d0d7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQu:cqYUQuVDt0TZER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777802425, "uuid": "d50a50da-bd93-4110-a5e6-06283e369933", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777802425, "uuid": "c125c4a9-cfc8-4621-b7f1-531ef694d673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802425, "uuid": "94942ba2-1bb7-4090-9d97-abb9520522b7", "value": "d1d5704f16091fb540e55b00330cfdf105848ad63324ef82c4185477cfdc4dc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651bde36-470a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777824539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824539, "uuid": "026d70b8-b415-4fb0-b619-e652f11afd8c", "comment": "Malware payload (ConnectWise)", "value": "df20927279b9b4e91707d49fc3763026", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824539, "uuid": "74205d5c-5f17-4ff8-a8f3-dfa515ce413c", "comment": "Malware payload (ConnectWise)", "value": "d3519e90bc94dac255e7e315ad09dcaf45117d06c30a06c940e26d292d86d287", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824539, "uuid": "ec59bb4f-ab8d-4685-8a88-0811c73d928c", "comment": "Malware payload (ConnectWise)", "value": "688f5a8d768c6e143e667515ae2ac396a6fc094b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824539, "uuid": "ba0a38e2-7986-44e7-ae7e-a8938486052d", "comment": "Malware payload (ConnectWise)", "value": "caca160b407450be97d81d09c01808541a9b8140448e0f29e81cb6c2cb1654a5a91cb61256d1e778c81735a0233933f1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824539, "uuid": "b7b1c739-d9a7-4b4b-92f9-9d38f2cbffc9", "value": "T11946E101B3D695B6D5BF1638D87A52A56634BC048312CBBF5394BD3D6E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824539, "uuid": "e37035b6-4335-4703-bb35-1f9fe0f9c7d2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824539, "uuid": "6a51a100-bf78-47df-901e-c3c03c92280f", "value": "98304:ozIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlI:ohfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824539, "uuid": "8fc9caff-b71d-45ea-93e0-500809bde52d", "value": 5720672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824539, "uuid": "3dd3fb2b-8af2-4a1c-aa43-598304d72b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824539, "uuid": "2a803c78-ce51-482d-8cbc-abd06e2cf9ef", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16927106-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818394, "uuid": "2a47ecf8-6a1a-4593-b354-fc7a92832e08", "comment": "Malware payload (Mirai)", "value": "fb1e0b4a13bce8f677683167898a065a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818394, "uuid": "b096d56d-2783-4d47-8e37-bd895e534dfd", "comment": "Malware payload (Mirai)", "value": "d41eb7e681ab3a709b48ea8f411fade077417e61cb9fec983f94afd2fc85a211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818394, "uuid": "aaf66a4f-6846-4a36-8715-13408d268f80", "comment": "Malware payload (Mirai)", "value": "c18e98e4a807a2a9639eda5c098b45dd82efa08e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818394, "uuid": "631ce7c8-6bea-4fe2-963f-95134f2fec6e", "comment": "Malware payload (Mirai)", "value": "8d4be31f0ac298d9ee9a1bc561938c2c59c9a6aa5ae6e2dc95345305260e558d816617382b44277f8bf526f3338238fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818394, "uuid": "c5c8129a-113f-4af1-bf35-e4b4958d93f1", "value": "T11FA32A46FDC14A21C5D512BEFA1E318E331357B8E2EE33229E146F2173865AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818394, "uuid": "50cccdc3-c461-4c9d-9240-f5c3952f86b3", "value": "1536:gAniwV+M3q8YxcgSIJU5P2wWKTlUBwV7sEhNPTLeaedH3XfDZARiFxLHR88o7vpF:J+KSD+ZnlTLeaeBxLHR8bbpILy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818394, "uuid": "58b4ada3-26ad-4208-bd5c-bf0a544c30d7", "value": 103900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818394, "uuid": "ccedebed-87f2-43a8-a275-de938afe88ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818394, "uuid": "84cc4380-ba90-45e2-bb8e-21cd7922e757", "value": "runningaway.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453ac66d-4708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777823627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823627, "uuid": "a7fea93f-be9c-4ab2-944a-f686c8d5b952", "comment": "Malware payload", "value": "eda5e27d922c3c57ff3dbdd3ae098a6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823627, "uuid": "ab3cb21f-af19-496a-bf4d-912e53660aca", "comment": "Malware payload", "value": "d5220e712727e51f471e4f3f524d51f4636e27164a401d28bea767c76fc439c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823627, "uuid": "89a69af5-fa26-4850-a835-c3c146d581c1", "comment": "Malware payload", "value": "d7d1e7828048b27c6d9b81077cd44c9f233b0201", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823627, "uuid": "9d45472b-3e6d-4cc3-946d-a172a36e8289", "comment": "Malware payload", "value": "8d1a6b921acb26ffd856d6aed2274460b57c2a7ecedbf23f3f99796a842a6e9eda949a4ef267e8ff812781862d213c47", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823627, "uuid": "e7ee663f-51a2-41d9-b91e-88a8a355269f", "value": "T106B65C06BCC42BBAC46C4A7484FAC95522B05E140AF1466A6565FFECBCB72797F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823627, "uuid": "af8425f8-fa86-42e2-8228-2383e64e402e", "value": "98304:CdHCDtuM9EY/UsF82c3/e0jJwcIGCX4Zcxz:CCsMuYRCnG0jJwzJX4Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823627, "uuid": "90e8e43a-2778-4814-9bcb-c8cb5ddcc009", "value": 10897541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823627, "uuid": "3a0f9492-f0ed-4d64-aaea-a793c760f680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823627, "uuid": "0df0cc02-8317-4c04-b3f7-8294e0a6b711", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e6dbef-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842467, "uuid": "7fb0f95a-f9a5-40db-94b0-7294f72f618f", "comment": "Malware payload", "value": "0d51aa88f440b1e86c048641a5c43351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842467, "uuid": "77e853f1-92ff-442b-b62a-e36160c9d8e1", "comment": "Malware payload", "value": "d5cea11a80393a4aaaa276138a80bf2711eaacac5e8256bb2e1bd38a64da5a92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842467, "uuid": "0d18e62f-343e-4e72-9c69-d2c586466abd", "comment": "Malware payload", "value": "2f323adfe28133b9c36bcd2af0c6c0b45cf0b072", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842467, "uuid": "1ba37b93-a6c9-48b9-88b8-9b98dee436ec", "comment": "Malware payload", "value": "58a6eb013371c40b948fc8fb8eff0ca15d94e35959977f9faeb556709ad956671ff37bc6d7108aef07d04c061183f620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842467, "uuid": "95b23c31-d52f-408b-a6f1-e1fb1f4b8150", "value": "T1F3D36C02FB0C4563D4836DB05E3F076BD359499208F9E109290DBF5A1672DBB9AC7BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842467, "uuid": "316aabef-57c3-4212-b10d-8480aa1a0f59", "value": "3072:8hS5+Xycycuc+PD1BpmtJ112p4F0O7y1BUhbmroEg:75+XLbI1BpmtJ112p4F0OOcb1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842467, "uuid": "3aa11b33-2151-41e5-b508-12da22a1a3fd", "value": 132612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842467, "uuid": "35ac7ee0-a633-4fdf-b710-9e185546dc85", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842467, "uuid": "0e8f052d-dcd3-474e-b435-cec78d2f73e2", "value": "35fc4b37.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed66b93-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842460, "uuid": "96491855-e02c-4ecc-b678-3fcc0339f2ab", "comment": "Malware payload", "value": "e7ebfad91b833c0a42803957d529bc93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842460, "uuid": "313155a9-18bb-4546-a6a5-599cfd3784b8", "comment": "Malware payload", "value": "d624ae0f4731963f9c9ea221c5ab2c980cedfcae8e915e1ff68646485b356f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842460, "uuid": "14ca228c-fd55-4c9b-a588-e8b5c7c04365", "comment": "Malware payload", "value": "c6448e03ce668ba0b701b9d48d72d1bfd98bd219", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842460, "uuid": "e1252ca6-de4b-472b-b374-30f72f7953ef", "comment": "Malware payload", "value": "3f64c34bc1611b0d56a58679b3583b9064ac6406f5527eb85a9dedb2001c1717740c5bb54304fd601235af3f24e7f8e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842460, "uuid": "5314768a-55ad-423a-886d-dbcdcc6f8c12", "value": "T174B3F9CAA224D285D8711E33D17A77F28367293605856E1CADE9FF2B58F73064B24F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842460, "uuid": "2013351e-3a6f-420c-a76b-349c80fb6006", "value": "3072:I2iq0lnxe1DdxE565gNCv2vRT63E3yxCAgoQT:7iL/eNy65gEr0CRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842460, "uuid": "e52e0eef-daed-4377-8bf2-374e844614c0", "value": 112632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842460, "uuid": "fe7fbbd1-b188-420f-b167-7d4cc9b5cf37", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842460, "uuid": "f2387783-8f8c-4584-a9ee-63b3bfb98c90", "value": "35fc4b37.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6392e4c-468f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777771928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777771928, "uuid": "7e0ce0f7-d012-4067-ba48-4e70de8e06e4", "comment": "Malware payload", "value": "f839acd3813d6fe5fae8569ab9de896e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777771928, "uuid": "38314f47-9736-4f41-b495-0c49781af754", "comment": "Malware payload", "value": "d7f6d22c05867264f359b31ca29af8e20e0859a0d2d10a0114278b67a69f1140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777771928, "uuid": "109b030c-cb49-4fde-b914-b05da90ed578", "comment": "Malware payload", "value": "416d82bae203eb53571fd287498904174dde3295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777771928, "uuid": "0beda6ef-0056-40b5-8e2f-3f1bb27cb91b", "comment": "Malware payload", "value": "74222bfe6ec3642d54e001f085846ccd48726bca1669d1e312092f90ad72853efecb46622fe138d567d3323e96083264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777771928, "uuid": "aba7dab4-af89-4abe-984b-b1f4b97d696b", "value": "T124368F17BCB95869C099F1308477A647F6A67C450B2217CB6A70F2242F7B7F05EB9B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777771928, "uuid": "e9011731-d2d9-4c45-8197-5f3608c81422", "value": "067359022f03daf0ba19b197bb46629c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777771928, "uuid": "1905b6d8-5120-4ad8-82cb-f62c8580d781", "value": "49152:0Kd7uDU6sd9QLodFiaSb5yFSwHYmR5u43phTRjhbijMd7eLNq1Jdfx9QY7ca:0XMLO1lm7njtaLwJGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777771928, "uuid": "2ed467e6-92ad-458c-ad6e-5f42a29cf498", "value": 5301760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777771928, "uuid": "f5106e88-8409-4901-9409-627d6846be95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777771928, "uuid": "9f2ea0e9-dc79-4409-a8ec-25132c337110", "value": "SecuriteInfo.com.Variant.Tedy.958009.42426386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdadb814-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "ca88c7e5-06dd-48de-82b0-d7f6fbecb6c2", "comment": "Malware payload (Mirai)", "value": "a255de64064993866c13d0bc49843e28", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "049d02a0-2b52-4e70-8b91-54bd557b5b66", "comment": "Malware payload (Mirai)", "value": "d9221997e65ac5030b44a46bbac973f8561d571cf88dc5bb091f6222f7eea30e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "dd935822-2823-41bc-8e7e-99b6614ce9aa", "comment": "Malware payload (Mirai)", "value": "6251d30f45722f74047f4d9953f4efcfd57dc7db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823936, "uuid": "0e0dc757-7c34-4a73-bc56-7e0662c1303c", "comment": "Malware payload (Mirai)", "value": "26fa6c1be1626d233718240f0627f084d570e3ae691f64c281c42887ec8dc36a1a6b1dd25c815ca1ecf0d3d83deb1a4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "57c2b1fd-558c-4977-a739-372d57094cab", "value": "T190E3885A6E228FAEF67C873547F74A20976D23D623E1D684D2ACC1141F6038E541FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "408ec77a-d92a-4b7e-a98f-abc7e5d69101", "value": "3072:37+qDHvC6+S0OUI425eNjZKcwumdEBfEVy:3rfz0zIcNYcwumdKfEVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823936, "uuid": "06662e1c-32f5-49d5-9bb3-9d898c6123f4", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823936, "uuid": "ac107579-22ae-40c1-a544-d10eaddeeeb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823936, "uuid": "cf255a0c-12e1-4d2d-b75f-f6f73384c63b", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08f3827-4700-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777820478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820478, "uuid": "2b207fb6-c30e-4a04-8307-6f1e3b7dd453", "comment": "Malware payload", "value": "ebfa9d602700053c5d0e60cfd0b51129", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820478, "uuid": "cff6248f-c4a1-4805-88cb-e3d9ec55fee6", "comment": "Malware payload", "value": "d94a1bbf4bd294da462be6155627ed438cdf10561da00c50935144e9a8d41b16", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820478, "uuid": "318bc418-8118-44a0-8b3c-869d5086f135", "comment": "Malware payload", "value": "f765ceb9e1360c6ee78a940a4981e18889dad766", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820478, "uuid": "cda13834-b9c3-4d38-b40a-162eb8cf7b03", "comment": "Malware payload", "value": "4dba02e170f68efec0db4df2a1a2b4cd23d92c22c9af783c4a7ca14695e938b8b38d5d8b7441585453ffb50db8426c2f", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820478, "uuid": "2c09e311-c6bb-4219-a64d-dffa3f31ae23", "value": "T1F476128EEB0CD53FDCBB6435A966122132271C464A82E7536550F63CAEB72C85F1EBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820478, "uuid": "defd0566-9d37-451c-a5a1-549fd6329c78", "value": "196608:6P3A/4OtI/cVrRftTfV9eb4ljbbIGTvK2g4HB3RTj1eRTn+:6Pm4sxVrfnK4lrPkyBo7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777820478, "uuid": "541ef4ce-6b96-4211-8a7d-3eca9f6860c3", "value": 7783466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777820478, "uuid": "f5c8696f-1664-4d76-9018-749a392a9c08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820478, "uuid": "896d984e-6ca2-4aed-8c88-d2ca2d6e523b", "value": "com.messange.sms_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd0878d-4718-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830590, "uuid": "44454661-4c71-48fa-8609-72f499b520dc", "comment": "Malware payload (Mirai)", "value": "672a3b2f4365cf2255d9e67bf50fe4d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830590, "uuid": "765e1975-d719-4732-a2d4-4e71002dc039", "comment": "Malware payload (Mirai)", "value": "d9edec0f728897c08cf06e12e7457a6ad245e9e1e03f35dcb345ac1f8f152b17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830590, "uuid": "359377e2-3a8e-4537-954b-e58ea48a6f2f", "comment": "Malware payload (Mirai)", "value": "315767a7a2e19779eede26713ab11f8da8d86319", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830590, "uuid": "49a14473-561c-447e-9dfe-ab3acff489d1", "comment": "Malware payload (Mirai)", "value": "66fca7085c8daf22cd282513b8af823b600a76ac708c56fb967a548734aca876c7cf9fda9307b82faeab9ab04c12d171", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830590, "uuid": "95846e87-e5b8-4b81-8c56-f267571a7f44", "value": "T14041FFD512BD02757EE6ADA7F1A6D584B1846BB719C5AE3C5CD8BCF4814CE082083A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830590, "uuid": "7742210c-d4fb-42a6-a610-fda0072f6e29", "value": "24:vIaOIwOOvIocvI5Fy3Ijq7JICeI08F0j1IkSIo6IrYI5+V:vcxlCY+5VE9SwrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830590, "uuid": "7b7e113b-d45b-411c-bd24-08e2a610408e", "value": 1910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830590, "uuid": "f12b686b-e213-44ec-a219-b576834d4545", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830590, "uuid": "33e1a947-b396-4f8d-8abc-462f6617e624", "value": "jewn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc544bf-4717-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777830352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830352, "uuid": "048d263d-1b90-42dc-b438-543b100a3703", "comment": "Malware payload (Mirai)", "value": "c05af0951f89cba2483d191e4e8fa518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830352, "uuid": "59d227f5-71ab-4bcd-8d92-81cb238184c8", "comment": "Malware payload (Mirai)", "value": "da695280cff16a7964db2bad6a6298c284b0b174ca9cb41ff2917b93ba51b31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830352, "uuid": "caa29549-d81b-4bc2-afc7-263161ebd61b", "comment": "Malware payload (Mirai)", "value": "b0a1db2d868c3165853bf5c0b911ebbd3cd85617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777830352, "uuid": "c0fd32b6-5fa5-4e68-9b9d-d43646700199", "comment": "Malware payload (Mirai)", "value": "bf1c905fbf041896a37fbf01e6126767375a1e89d83acb8bcf3f20dffe767e1f52906a0e875f8227e1474dee2faac894", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830352, "uuid": "7ecd123e-96dc-4fc7-8530-f50fe9508fee", "value": "T15D230942B3280547D5631EB4353F47D0E3A7AE8121E4F249760FAA4EC171E77A506EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830352, "uuid": "e3007e0d-3ac3-4c79-a270-1a857797bd31", "value": "768:NwtFRH3tXqq0YRsvrfFRsj92repnD3grZMJInBYgV/oXnp+kjLSHMkXPZHhJ:eNq1EsvrTsj9yeVDeFnqgon0oLSH3PZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777830352, "uuid": "23ec3eb8-3d8e-4836-8e13-1697777efad4", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777830352, "uuid": "845b71e8-16c7-4538-bbd0-b9b6058b7a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777830352, "uuid": "57be34b3-8d03-4669-880c-aa93ec5bb78b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dd256c-4721-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777834424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834424, "uuid": "b5799054-8732-4b60-a5ef-09cf8a6f2c34", "comment": "Malware payload (Mirai)", "value": "4507181227423badb39af9511a0dbf75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834424, "uuid": "efbd6c08-52bb-440e-b882-2b3ae076001e", "comment": "Malware payload (Mirai)", "value": "db737535ed1a15c38798e25280d7cbc8758cff4fbb0fb5c5742bc3a53ca040e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834424, "uuid": "0c1d8b0f-215a-4af1-b500-1b63cbd75234", "comment": "Malware payload (Mirai)", "value": "d7d5371e429d305d50733c0e847ff1d10a3310f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834424, "uuid": "282fab4a-4f9c-41fd-91f4-e258f877aac1", "comment": "Malware payload (Mirai)", "value": "8d10ffe73f910675947edf0b9e7f3503c7749a6328bd5c69bc6f73416f59217fd339240c39f2015dc74c55c674a4d5bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834424, "uuid": "6e1e1db4-f79b-40eb-88e7-85ecfaa1f217", "value": "T1FAE32B45FC514B27CAC622BBFB5E428D3B2617E9D2EE72039D256F20378685B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834424, "uuid": "fbb6d58a-1283-4264-8e20-6b529f077731", "value": "3072:x2vpxn2xSoK6Wv5PfBhUWIZ4clsAMG1QOGEmzAxRsx:x2RxnJBfBONZ4cuAMGxfmzMRsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777834424, "uuid": "4ea7e34e-e2a4-4906-aa9f-a093f7428005", "value": 149280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777834424, "uuid": "09e0b442-8182-4148-9dbb-6530c8d4708b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834424, "uuid": "cc74599f-124f-4007-9e39-8742e787c4f5", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9e6cb1-4713-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777828634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828634, "uuid": "c76bcc99-5b44-4d17-9cd8-b1c9c6a83b23", "comment": "Malware payload (QuasarRAT)", "value": "e2aafabbae84d258998e1b8bd64923c8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828634, "uuid": "eddfa06b-5441-4fb6-ba54-213fc1cc8d85", "comment": "Malware payload (QuasarRAT)", "value": "dc2905b5e1cf7f50de6ae5e0996f97e02b4f6271c0fceda8fa8624c577cd11dc", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828634, "uuid": "6b383c97-3387-4824-b359-dd8488da4e9e", "comment": "Malware payload (QuasarRAT)", "value": "86b5c064a47d85963335a0ccdced874e0d872af0", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777828634, "uuid": "d5e3fea1-f831-4776-8bbe-16db42f51d1b", "comment": "Malware payload (QuasarRAT)", "value": "0e1f6c56e5e0daf8b5a6b9de88321615615038bf77e1f2b418a4ea343aa62334b67076b8599518a24f3651a15bc786d2", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828634, "uuid": "7e054a0f-eec6-45df-8638-cf80e91f0f38", "value": "T192867F4DE8E7B051AD2199C31F9EE7F1091E6316B89A1C12357C074847D48FF2B8AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828634, "uuid": "00d6898f-f9a1-4fc8-be65-7ca78a8eed82", "value": "2ac0c4d3fec4c7e9ce9158815bb62c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828634, "uuid": "c000b785-3644-4486-b880-0fc19368dce3", "value": "49152:Oio/vzRUAPN+Jq/Kf+WXfl5Arg0Ha1wb3JLTJry70i7NjaLH0oW2m7vx0KypKq8w:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777828634, "uuid": "aa1e8832-b84a-41c6-a4be-1f8ffcbcaf12", "value": 8069104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777828634, "uuid": "b5f73f34-83c4-4d9c-8801-b86903f81571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777828634, "uuid": "10ae50ce-acd7-4b94-bea5-196eea2315a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc70a65-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "8eb886cc-040e-46c4-81b3-1378e132501a", "comment": "Malware payload (Mirai)", "value": "ddc4ba60a191e48ace5fa33a14219da5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "405fd9e8-bc09-4d71-aa24-cd397d3a9d6d", "comment": "Malware payload (Mirai)", "value": "de6d93c7ca452bd8f92112fa868227ab8e763bf5f9554ee833cee7a2941162a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "12d625bf-c598-49b8-91a0-d569d10030e0", "comment": "Malware payload (Mirai)", "value": "d1747d67be06505a6a340445b2578f11dc85344b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823933, "uuid": "c00bf690-cdbd-4a79-90ad-03a70694873a", "comment": "Malware payload (Mirai)", "value": "32109380c4b29c29fc9ff80f80d2e94d481a3ee38820a2c6feb67885cfc7159c625fd3912f14992f25f35b6983593e8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "34904976-1106-4ef9-ad03-9d0b169d109f", "value": "T1A1A33863CC666F58C628D5B0B0B18F796BA7A96081875FBE1977C3748083D8DF5093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "3e9733ba-fc18-4f88-a45f-baeea1949e30", "value": "1536:7/On+VXqG9tACAKPMkN7FwzFInCGmqYMyWZfyXxIZjwkm:TtACPrYFIAqJyWByXKekm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823933, "uuid": "10201557-e5ba-46e8-933f-9df37b936647", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823933, "uuid": "8f9c627c-e2d4-4314-8b24-5130e9dc7c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823933, "uuid": "c492d3b0-e6a1-42a3-8f21-1d4310e9df3b", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820ede93-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777814709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814709, "uuid": "4cfe5396-3e4a-4c9f-b8ba-6811dd4e373b", "comment": "Malware payload (RemcosRAT)", "value": "1f5fc9a1198588972cca04ac422d04c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814709, "uuid": "09e8b8ad-f9b8-4593-8f64-7023358c9c95", "comment": "Malware payload (RemcosRAT)", "value": "df7ab70c74f2c0c147746fbcde0fce30a5ac6ddc6dc884f952e23be4fa3af37c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814709, "uuid": "a405cf61-ceb0-4656-9593-4104e68db49e", "comment": "Malware payload (RemcosRAT)", "value": "6ab5a19adc72acb66c3f917a4752d3f3beeca8b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814709, "uuid": "a7371d1d-21bf-4e08-83e8-916bfae51b69", "comment": "Malware payload (RemcosRAT)", "value": "4c215a0f3126a711dd9bd98c9fcbee7c011d152d954525fc32a9a81c0b93e6c4f0466032225c2d3072d64c2e757c5c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814709, "uuid": "a976cfb5-c672-41f6-a315-2e461f6cce72", "value": "T1D68412023765C957CD619BB2C8368AF95AAD9CADC639A30783503F7D3DB23411E0D3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814709, "uuid": "dc7a1959-d9e1-4d58-b66d-6b1594836d0a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814709, "uuid": "646cc15b-7e5c-4bcc-8554-5ca3bc86b4a7", "value": "6144:4VGdx6xzX9fpnOdEQT2AdO2ATLoCx7+Mh9wDW/PqBN0gb/7HspH3h5e/kTcBbyy3:UV9BnOdEQT2iO268Cx9wDW+JbT2XHcBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814709, "uuid": "27e96e9a-62ab-4956-926d-1209dcf0f754", "value": 382648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814709, "uuid": "9d2d2b22-7cd1-4b9e-986d-0e3b77763089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814709, "uuid": "d75d8551-0a37-4544-b638-cd52811c1719", "value": "1f5fc9a1198588972cca04ac422d04c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8cfc2d-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777794433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794433, "uuid": "a18ae787-df50-4988-bcb1-373537bc3369", "comment": "Malware payload (Mirai)", "value": "44541221a4981b4af025322d3beb51e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794433, "uuid": "42db64a9-b42c-4799-a032-d82f83b21b86", "comment": "Malware payload (Mirai)", "value": "df94e452c31158897a048226c4f26ec94ba6d2dd1a48f9f89f00158d2c1e50f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794433, "uuid": "5cc65547-355f-4ffc-a496-77c95ca5ccc5", "comment": "Malware payload (Mirai)", "value": "9ee4950522c234a69f29fad7744e835584e5414f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794433, "uuid": "28aea93f-5a29-4f86-a7bd-ce33edb1b658", "comment": "Malware payload (Mirai)", "value": "288d95bb1fb7251db017de5eb894ef3a722848dd36ddd2e407c51c618e14a254a4aebe78e1d25cd1d4787331f6566e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794433, "uuid": "504a761b-ba0e-4f24-9462-55b3b33cb4e2", "value": "T1C7A3185ABC919B22C4D056BFFE1F419D33231BF8E2DB3203DD14AB2476CA95A0E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794433, "uuid": "79106009-6bcb-4e23-a889-8fb646bf155d", "value": "3072:uvVW1wLJsCKvfYYPuQwk/KVwfmXK1kSMAb8AWQuhPdnc5:uvVQwK5hPuQ5/0wCKpRbrWvh65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794433, "uuid": "d5cfb61a-4f61-4ac0-b5cc-09dee731d45e", "value": 103060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794433, "uuid": "d6439e4e-d8b6-42aa-98c3-cdd11170d28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794433, "uuid": "8b7aa7a5-ee08-4feb-b582-b1ba2f787043", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe936b1e-4708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777823938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "b8ac71c6-30ec-417b-baa1-6f149fe20d38", "comment": "Malware payload (Mirai)", "value": "b38aa99239ec37d489b38be268ec81c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "544684f8-df0f-424b-b75f-8b637a3ef17f", "comment": "Malware payload (Mirai)", "value": "dfb4189909aebf8f7add0ae24c93bff8ae8a6538415a4a34753cd83ca6e5a5d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "a1651893-44e0-42f2-9d87-0d8cfe16ee0c", "comment": "Malware payload (Mirai)", "value": "a52302aac83d037034fed401eb204bec296e61c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823938, "uuid": "8eab9679-253a-4e34-97bf-2c8ade6147a5", "comment": "Malware payload (Mirai)", "value": "53be4b50036d4bc239afbf520029586821eb0e5c072ccf72f9b506d8b64f87e5b970d55b63f78d937c86926ae87cb192", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "f9828357-0836-4077-a46b-68490463aade", "value": "T1FBD307C7F900DAF6F80AE33748530906B230FBA509925A373257356FED7A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "d39f7d63-fd65-4e14-b7ec-e48f7cbe31f2", "value": "3072:8DIWHH0Z7WygIut3lBm4604iCcFOjZcFLV1jbirLwXrKT/:dWygftVBmPi8NcFELw4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823938, "uuid": "34912e5d-54b5-44dc-827e-6108c4454e54", "value": 140416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823938, "uuid": "d69af779-6519-43e4-af7b-ee949ae2a3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823938, "uuid": "f32a4737-3903-44a7-802a-85cfa7435028", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca025ee-470d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777825974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825974, "uuid": "adfe7b1a-c685-47d9-a4df-f11c1c9b8168", "comment": "Malware payload (RemcosRAT)", "value": "e2ad1bddc8d34238225a5cfbb456bef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825974, "uuid": "d4336dd2-226e-47cb-b48e-234c76a8e71e", "comment": "Malware payload (RemcosRAT)", "value": "e0be0a8c8c741e821bea2b66c2aea511e33da9aaf9199a30f6df4dd1ba36f980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825974, "uuid": "389723ca-7f7e-4362-9a34-6d0a88854629", "comment": "Malware payload (RemcosRAT)", "value": "a1087b7f46cc33dcf794bb53bb180f7e4796fd3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777825974, "uuid": "f7666d23-0c55-4c45-9ae7-44bbf9b09712", "comment": "Malware payload (RemcosRAT)", "value": "01623c9627ae9d9c8d14086e172c4478c3723ec0480594bbd82c67ad9b6d7e648c81b3c0ae5be5b8c1285749c7f35bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825974, "uuid": "dcde9838-1648-49d4-87a7-24d592650528", "value": "T1C2F302B341F48266CAF9F4F66D6EE3400BE5F11BAF67895D04EC9860BC7509980F22B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825974, "uuid": "96fe6351-6ff3-4af3-8cab-c4936ef9ab8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825974, "uuid": "c582994e-3260-4f76-8622-6f30da3ddb6e", "value": "3072:y9aH7fFuyMf1pX9VHQy3+T9V6ys2IEEUAzMlzriX5ZUblMq9Cb:y9aHjFF0zB3+TDNNlriXz4lMq9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777825974, "uuid": "8ae33077-c878-4b0e-97c9-ae8e847077e1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777825974, "uuid": "258eca09-7e41-45d6-bf30-ebba5f7dc0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777825974, "uuid": "3c733ed3-4ca7-4e05-8f85-bece86902848", "value": "RC7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373b0bfe-46e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777809000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809000, "uuid": "1831c25b-272d-4357-807e-49eba50c1088", "comment": "Malware payload (Mirai)", "value": "24cfebc6d113284e76e2c065525da035", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809000, "uuid": "f2ec10ce-d98d-4498-bbfc-0cf6ef94f2d8", "comment": "Malware payload (Mirai)", "value": "e0e927b070e18cdf75ba2183f958df968ae94680b872b39645f073b9db8ffafd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809000, "uuid": "b45a98f2-897f-40c8-b998-4182e85d2ffd", "comment": "Malware payload (Mirai)", "value": "1d187743e4c3649b38595a9e04ccce3c245ee046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809000, "uuid": "8a199cbb-0bc7-495e-b207-421858697053", "comment": "Malware payload (Mirai)", "value": "43c6a0f6aea5e190fc802c6143cfe49b86d48bc741d33dbc5ab38056431c13a57b8831962ce9d2a98fceb08af351e21a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809000, "uuid": "233c36b6-a7a4-47b8-95f0-47f80a677711", "value": "T1A65423C1BA2847F0CE2570737B74651865A138F212E532C6E63A2ECF54F7459708ABE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809000, "uuid": "d7ad373b-cf8a-48bc-a332-b84e07476d05", "value": "6144:FJHtnvs7xfHYfd7sSalKBwamYZU2Pdgihn8nHn4XXdsCMM:DHxs5oNoMjpZPKih8nH4XXdMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809000, "uuid": "1607fcf3-4534-4768-930e-e954a44cc392", "value": 293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809000, "uuid": "2a206e7b-4caa-42f5-94f4-5e0de88e0645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809000, "uuid": "18471dbb-1e63-40f4-abfc-3a5e765c401a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512cf399-470a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777824506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824506, "uuid": "f4306bf5-b1d1-42cb-a612-3ffd48d81577", "comment": "Malware payload", "value": "d5ea6434b62ca06bbf74f928f4e49ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824506, "uuid": "ac60c06b-7d0c-4515-93ad-a2878d49ed90", "comment": "Malware payload", "value": "e31231dfc95b3d5649214b06ee7d1ad439fe563d63a4fb545adbd8df8778aa2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824506, "uuid": "46d8726c-e143-4c21-bb40-38fa9aa427b8", "comment": "Malware payload", "value": "b0f55129729e8cccb63eae37fe47592de6646fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777824506, "uuid": "b9f284bf-ffef-428a-8fa4-a37478392539", "comment": "Malware payload", "value": "51243dbacb1e7d17716a97143d7aae639953e8b498d7117bf8391a93d1a78e9684e167823a3c44e0b2d485f70c9b1002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824506, "uuid": "97d912eb-fcce-4367-83e3-3ee18c553520", "value": "T100F6331573A006FAF8E7A5B9D5C3C01992B2B4004F16DD8B0B290F662F6B9B1697F35C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824506, "uuid": "20f7a4a1-3507-426b-9c31-9861d3be9853", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824506, "uuid": "c7b84307-2227-44f1-85be-93b3ecd610bd", "value": "393216:v977KkDDz2e+b60873+9/pWFryTR6TSLZaPTiiok:v97oe+b6XD+9/pWl1TSLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777824506, "uuid": "83ad0183-6b82-4e18-97bc-0f4b86469c11", "value": 15528873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777824506, "uuid": "f3cba3cd-1beb-4d8f-9995-c3f03acf7015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777824506, "uuid": "bf97e19d-98e3-4d2e-bf10-7475e28ebdc3", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd75307-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818323, "uuid": "5c05192f-4e6d-4ac7-a8b9-a37786451601", "comment": "Malware payload (Mirai)", "value": "f8f18e2aa05bba60fedf4349d0766297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818323, "uuid": "9f84a2a2-3c00-49fc-916f-5411e0ef0e2b", "comment": "Malware payload (Mirai)", "value": "e40922de45ba21f8f8077965a3b9597e46fac1d54d30827d5e4c932b50e0ea78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818323, "uuid": "75729b3a-51c9-4dd2-babf-705d8ac85cfa", "comment": "Malware payload (Mirai)", "value": "fc596e35d9bcc8394ac63e9c36a0a9fa246492cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818323, "uuid": "31a37379-3da0-46b6-87d5-7def16c68274", "comment": "Malware payload (Mirai)", "value": "e981579bc856d72d25c1e919035c7e0c67e721c9b457799675ee11c5553338434943a72f8db6aa639ff0f10b09999fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818323, "uuid": "3814abf0-6066-4df1-ad16-8efeff95dffe", "value": "T1BE13F2221709B872C9B34E3AE5314B8E15EB4184D2DEBAF8571CC334939566334FE99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818323, "uuid": "4ecaf0a1-7585-4ae1-88f2-eb176b3860bf", "value": "768:UvAC/1R4A+A052aP3mGmiAs2HFaqvRkZQBvYhqpBBa/eOus3Uoz+:Ul/1kAzG3xAHFaq5ksgwpGTz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818323, "uuid": "6737757e-a913-4482-8ae4-e9069f70657a", "value": 42828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818323, "uuid": "eabc3d0c-2a77-472d-a97a-0e391e76205c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818323, "uuid": "8df5047b-7777-44ef-92cc-09d636a83ffa", "value": "runningaway.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017946b3-4716-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777829526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829526, "uuid": "3b073dc4-cdf5-406f-90b6-3899ed56de5e", "comment": "Malware payload (Mirai)", "value": "b7a47d7ce9c0f529ee8685841deaef0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829526, "uuid": "655e3d8d-f237-408c-a1d3-ac0889989ada", "comment": "Malware payload (Mirai)", "value": "e40bdce26a24f2680169b2bb168706b482fb4d19df5b0541c9b89f40a83e1bcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829526, "uuid": "3255e506-362f-4e61-b38e-15c56c74f2c7", "comment": "Malware payload (Mirai)", "value": "a5d54d5dde6c15ef0bdb963a7e83b740e6d32266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777829526, "uuid": "e0f064b6-f6cb-4cd5-95dd-2345862280de", "comment": "Malware payload (Mirai)", "value": "94c5b3268125b00b72240b698789ff9f614f2d767f80e86c03a4223f0339f02b26822aee7bbe68af283ef92fd19875d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829526, "uuid": "3d07a7d0-a985-4030-a53a-ddf2a7bfb0d9", "value": "T16293F659F8C19F11D8D525BEFE0F519D332317A8E3EF7212EE246B24368691B0E7A811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829526, "uuid": "e66d67f0-bcfc-4de5-a034-61463c0897b0", "value": "1536:CUnJV9IZ2xhYBNRL4vWCk2jXQxHBaFQIdqiC2cVtC6mHhM0OyXf3g22k20ep5GlV:4Z2x6BN54vfQHBmQI1Cf4hM0OyXf3g2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777829526, "uuid": "0d91db2f-8427-44c4-a289-b2dd2ec08b3a", "value": 92164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777829526, "uuid": "0fb8c461-28a5-4253-a352-1ad97b4d3b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777829526, "uuid": "b0788477-f785-43e3-8591-904f0056b98e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092a3ee7-46fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818372, "uuid": "64796d93-e693-4609-8493-c46cb321d1e6", "comment": "Malware payload (Mirai)", "value": "321d69723f3cb6b6767101e7d06ed538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818372, "uuid": "9e853f0a-fd4e-4daa-b34a-0ead32410698", "comment": "Malware payload (Mirai)", "value": "e562aafd203e8032f714888239567bc7e7e93e02caf38ad4b9ee3e725d5895c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818372, "uuid": "49ee6437-b215-47c9-9f62-e60a70403dd9", "comment": "Malware payload (Mirai)", "value": "842e8f4f964ed932f40d2f0a2af39c172c4e40bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818372, "uuid": "1e4f168d-c9a1-4a39-ad09-a518081d8c11", "comment": "Malware payload (Mirai)", "value": "1c01cab3fbe71b712e3f3a4d55b15f6bcd25e840d2a875414c37d1aec35a40ddc9fcea4bb50e7c61c0fb97a291d0ca43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818372, "uuid": "1533ccf6-b1f1-42d4-a2ef-7f4774a243b3", "value": "T187836CC4EA87D4F5EC2209351177BB379AB3F53E216ADB83C3A8E5669C025C2D41A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818372, "uuid": "45fe442c-cc58-4bf3-b4f3-ed9f54358210", "value": "1536:OxyvgrqOCklIBZZQJZnyHPtD4Mm+r5E1fAqn8cSi7:XgrqOC9eJZncP3lmBAU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818372, "uuid": "17b84e04-eb04-4c35-9bb9-65adf65e8677", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818372, "uuid": "c39b4728-90b4-4891-9af9-1871d60e282d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818372, "uuid": "422f8b94-a238-4a30-a60b-2268d53f9c8a", "value": "runningaway.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87098290-46f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777814718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814718, "uuid": "fd9580e0-625e-413c-b022-936d79ba0628", "comment": "Malware payload (ValleyRAT)", "value": "02dac598b2351d37b4ab957eff61e2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814718, "uuid": "3af246cc-4c8b-4b49-9c15-9f85b7788005", "comment": "Malware payload (ValleyRAT)", "value": "e6c18aa0599e1134add97a6758eea3bcf5962fadeae3e8889d54bf6b8b23229d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814718, "uuid": "5657200d-0656-4f6f-898e-511f7a0ba5bb", "comment": "Malware payload (ValleyRAT)", "value": "92ea6839fadd34d7c7d77bcedf399931b5e4fb85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777814718, "uuid": "82d5b528-2a8b-432f-8c64-af52f11f450f", "comment": "Malware payload (ValleyRAT)", "value": "542ff7a77e7e80ea4900c8fb99076dcb6fb648f3c5dfb8634fa5ff99ed6cdf0edfc542cc8a270ff1e09bb9f6b1277782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814718, "uuid": "251d7d58-3e94-4473-ad12-bf811c1c74ac", "value": "T19395C023B2CBE03EE05E0B3B05B2A26895FB76256527BD5796F4849CCF250601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814718, "uuid": "2984aebb-90f2-49d3-bf9d-732af27b29af", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814718, "uuid": "8692966a-0332-4040-9a96-9552dd5ad67b", "value": "49152:Y+MRvHxbJr67MZ2Z9ftchfudg87dqn7iMK7tW:Yrn+MYchXqdnMOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777814718, "uuid": "943ec44b-8321-460b-9bdf-c4dcc8722c96", "value": 1901926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777814718, "uuid": "b53341e8-cfc7-4444-b324-8a7be50edde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777814718, "uuid": "9087c9c0-67d0-46ed-ac7e-9491196f8a88", "value": "02dac598b2351d37b4ab957eff61e2c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c6e0d6-46d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777802154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802154, "uuid": "6c511714-81a0-41c1-ae9c-e74846df5d2e", "comment": "Malware payload", "value": "438590800ee8bbee3ad83cd71462213b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802154, "uuid": "a4983220-dd71-40f7-930a-a9900d1ee973", "comment": "Malware payload", "value": "e80fb5816b0e2f9b7cd7110abc7b36a9e008a9c6e29c6b8f53ac333afc1a9226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802154, "uuid": "a62200dd-0f49-4055-9698-2c1964033a85", "comment": "Malware payload", "value": "fd64defd9deb0fac2b3df2b18d8ea0aeb92c0781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777802154, "uuid": "76d412e0-40b8-4d57-8de2-6ceb62bea194", "comment": "Malware payload", "value": "e6b55cff4010b2f515f30258d15f9dd7da79193d67c5cbe22f2e4dffd8fe75d2a95f13a1bed06401cd6e035893707047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802154, "uuid": "bcdfbab7-8f9c-48ce-86be-37347d85cc95", "value": "T15F630201AF25ED46DF000C7326CDDB9D8E796B5A4A9BF07698E19C8F97E11CAAC57300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802154, "uuid": "8375c67f-f4f2-4026-a07c-b692a3252515", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0c:phNlHuBafLeBtfCzpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777802154, "uuid": "0545effe-b04e-4f94-bab0-42df54783588", "value": 69972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777802154, "uuid": "2adc592d-d94e-4c6f-bba9-727dbad5bc77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777802154, "uuid": "8457e06e-fcd7-41e9-b5b1-17bedae7371e", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ea6112-471f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777833587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833587, "uuid": "3f9c06f1-3c2e-400c-9e1d-0d023939cf86", "comment": "Malware payload (Mirai)", "value": "62dbc32ad507965b405852f3a98454ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833587, "uuid": "472e6d81-77f1-49e9-9d45-defa694fcfd8", "comment": "Malware payload (Mirai)", "value": "e8c826af0bfa115a3aedde4b95fa69a300f5205953125b2b1b32a1bec2d57017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833587, "uuid": "90332b2c-01b3-4e03-b467-ce006afbc265", "comment": "Malware payload (Mirai)", "value": "d206f6f24aa51034bf378382d5f07cd778370679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777833587, "uuid": "94459375-f99f-492c-8a39-d5c1109ff101", "comment": "Malware payload (Mirai)", "value": "312f6652375c2d0ec81549f6d5bdee2aefd3c2d234b32198926c5864a2abc79b2d02b0d52f0ada4a97ca25a1091b1935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833587, "uuid": "7415b2b8-d496-4144-9b90-d8d9d1593014", "value": "T1D314A70E6E228F7DF6A8873447F74E24976933D627E1D681D1ACD2101E6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833587, "uuid": "9eaf2ee5-289c-4e81-a5f2-1eeb4e2a5fd5", "value": "3072:15CK8omnTg4A0tYjaGPSRo6z7WAqTHd1AXkCgc0lCK:GK89ThA0tYja/PmjrXCl0lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777833587, "uuid": "0bedea73-4e90-41da-8e8a-fc15bd5b60ba", "value": 202200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777833587, "uuid": "e6229b29-b37a-44bb-a244-5f5fb0cab3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777833587, "uuid": "bf710e0f-29da-4e5f-971c-ba279d35e036", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4428cba7-471b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777831785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831785, "uuid": "5adfe3af-b38e-4b25-a58b-cb80ecdddfb5", "comment": "Malware payload (Mirai)", "value": "fa85b6b212ea594ee0037cdcad1216d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831785, "uuid": "1216e479-c10b-454c-a8a0-beeab6d60ff1", "comment": "Malware payload (Mirai)", "value": "ea7e893dc22452575330309436019d4ad70a0a664ea37932a882efc1dc149670", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831785, "uuid": "7286a1f8-caad-41d7-942e-9972e002e84a", "comment": "Malware payload (Mirai)", "value": "6e66535a914edee29e227ef444c3a3ab9b0263ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777831785, "uuid": "c040a3af-b504-4509-bd31-01cb434a2d51", "comment": "Malware payload (Mirai)", "value": "11629968a0e2c465faf8e6656a786dcf4cf4be0bfbb62a5dec73a07b473d50fc3bfb98527b6e3efa6b64a930203b3e6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831785, "uuid": "dcc19741-c204-4817-8b13-4314b7c42190", "value": "T11133F795B8819A16CAD0537BFA0E81DD3325739CE2DE3213CD226F6537CB42F0E6A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831785, "uuid": "5f49154a-5fc2-442d-86ba-a90a5f7cf4d9", "value": "768:og4fvh5kHVXD5S7YwInDTGS/vFeeUTbBCoKfRZh9su6i9OzZWVMYDLIBYXNYmkbC:1AUHc1kTGQWBgZXiWUyjLMt1bN+ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777831785, "uuid": "4090f4d6-464e-47f5-84ff-05ba591febd8", "value": 52360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777831785, "uuid": "06f8ce34-f931-4404-bc0d-fbe2eb8853b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777831785, "uuid": "11f5bfb8-bedb-4c86-8430-2af0cbc27230", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d75ed06-4683-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766652, "uuid": "d4e18295-f7e3-450f-9fa5-2c07aee88650", "comment": "Malware payload (Mirai)", "value": "4859e75ca629157c752d34d0591eb394", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766652, "uuid": "b9853dcf-0a52-4575-b832-62569cc3c802", "comment": "Malware payload (Mirai)", "value": "eab92ddb536aa5393b427eec8c2b0be76beb90894018cfcd5aba09ce8cdd1e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766652, "uuid": "3735f2f0-c27d-4698-a0b4-85ede9b7c25f", "comment": "Malware payload (Mirai)", "value": "4b1c9e33e2459ab2a1e10f17148ef7aa8682a9f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766652, "uuid": "9d5da472-65cc-42f3-a39a-ae6b11371632", "comment": "Malware payload (Mirai)", "value": "9163f059baddfa5080c84d3ea73fd65dfa7b16d2341f93733e1b420fb6d25594ac2945240ab474db978c3c70236b4af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766652, "uuid": "6f0be03a-494e-4810-b510-6c6e054df492", "value": "T12DB56C43E683C4F1DA560BF4125BFB7B993699060121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766652, "uuid": "3d552ee9-30e7-4083-a392-95e4c9fa0981", "value": "24576:IKYPs5xI2zAXX4sd5z3euatL3QKL1BbRj8Zf8GdV0fGeydsF0wH6OjLJ7JAH6Wcm:lmbJe/L3Q7RdVNeNlAZcagpGkVye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766652, "uuid": "9a4581f7-e2aa-4b68-8da6-70f73675fc45", "value": 2398968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766652, "uuid": "9b7e694b-5dee-4cbd-bf44-8feb50adcc6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766652, "uuid": "e8e3f3ae-73c0-4758-8c4f-64e748b8a9d5", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db63e9b1-470d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777826026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826026, "uuid": "e4609871-0574-421f-a143-cb633a971187", "comment": "Malware payload", "value": "72b04729f0d98c736fae4404a5a784f8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826026, "uuid": "92e1449c-e887-48cc-844f-13035d0e95f6", "comment": "Malware payload", "value": "eeabeb05376bdf8fdc837659467df82b807ede484f027c23905222c63698330c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826026, "uuid": "d9f80f16-7aca-4ecd-9b6c-022447b954cd", "comment": "Malware payload", "value": "896df45e686bf10415f9d7e23445ba42e1e2f99a", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777826026, "uuid": "1f030b30-0150-4754-a5be-b82d24ca3073", "comment": "Malware payload", "value": "8b941a2b0268e9c40dc1cbf064413d0c777260e426dfc1d67928ccb40409833e074e6304d147db5717e3d03187d21a85", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826026, "uuid": "de5cd796-727a-49ba-9df8-8cf6ae8ea791", "value": "T13CC612F3AE8A713DE06A0A357A72D23C443B6E216D128D5A96E2F45CCF351603D3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826026, "uuid": "b3353e3a-8a85-4b92-9651-bb892ccc67d4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826026, "uuid": "48d9f84a-3ac9-43df-bcae-f82ea38eaf7d", "value": "98304:6L8Nc3TTwK1XTKgSZTk2hGIQi8G4/CscJSw77BrkH6t6A4h3:9oJMQOxQiU6scN7BrkW41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777826026, "uuid": "1e3ec011-3330-475f-a446-f83362f689ac", "value": 11897177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777826026, "uuid": "58210584-1207-442b-987f-055436145627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777826026, "uuid": "627c8efe-3765-4ab3-836f-12d804c68541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aeb9483-46c0-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777792712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792712, "uuid": "b07e3eb0-7959-471e-900c-452fc8ab9c25", "comment": "Malware payload (CountLoader)", "value": "51fe8e4c8974c3a1098784da1b195f1d", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792712, "uuid": "f3d82065-1c17-45ea-b876-d7f6953527f1", "comment": "Malware payload (CountLoader)", "value": "f061a7c86a39411cd19ba983a15953c37df9ce31e6b01babc264421a5658780c", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792712, "uuid": "09b85895-cf9b-48b3-8af4-c09a03366790", "comment": "Malware payload (CountLoader)", "value": "023ff6ba089f30ec1e1f3fc471478baabebc5be2", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777792712, "uuid": "37b4f3c2-eb57-42e2-9371-006883e7378e", "comment": "Malware payload (CountLoader)", "value": "a89f625a48c1fd72a18b9b6cb4988787c4ba0bd0eb3f91f2f8759be64359de3c254a358de598d4f9141004e55ecb09aa", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792712, "uuid": "5523a214-cbf3-4564-8c37-2a32bb67c5ba", "value": "T197D58E90FB8644B0D6462238785773EB6B342C9A4F3C5AA7D7E13979783F6D80833619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792712, "uuid": "2168fef8-6f21-4b71-9cab-4e455f772c76", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792712, "uuid": "8ff656b6-c91c-4213-af3c-b4924d252eb0", "value": "49152:RGPGTIlZrHmlSdyGUDRKygzkjiNwLz2IL3zbslT1RROzmJ3pxab4JqaHpbn47qKA:o4IlZjmlmyGUDRKyg4kMnslTvQzmJ3pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777792712, "uuid": "5cf440c6-f674-45f3-ad65-2efa3915e707", "value": 2940416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777792712, "uuid": "ed27dd1c-9531-443d-a94d-f90b57f3960f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777792712, "uuid": "2b9da219-6186-49c8-9649-7aec098c63f0", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ae20ff-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818316, "uuid": "21f38d20-6c98-4d63-83be-e3f0cf6ed29a", "comment": "Malware payload (Mirai)", "value": "c05aadfb3250fbfe22498ce3a7d3677c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818316, "uuid": "91ddbbe1-419f-45cc-a095-59a3074ef65d", "comment": "Malware payload (Mirai)", "value": "f087b6a25ecf7485382cfdcf2b85e2cda5c5aeb3592e3f3c5ddf801cd627d374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818316, "uuid": "0cfe9601-5e09-4ef6-8943-0a12ab9355f8", "comment": "Malware payload (Mirai)", "value": "283247c5f9e1e5bad3abf676d5423741c6087f15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818316, "uuid": "96adb3e1-1258-404e-ad0d-c8b7606dfb86", "comment": "Malware payload (Mirai)", "value": "65dd97f1fbf4d361210f3d3eeb3ce9e98f2bb285b9439450806a45c390f136d9d335a7aed90f9fab5be497672d83eb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818316, "uuid": "f31259cd-58e4-43b6-9584-a3b1273ac4a9", "value": "T16C83AF67C8395C58C69842B4B1B4BE3A5763E54056832FF71ADACA36904BEDCF8063F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818316, "uuid": "bc03b583-55a7-4620-b44f-16ecc5d4dcc6", "value": "1536:4/MtmWllcl284uHi3Wy3XWJNG2hDawKzWrm7HpWptCCXubT6r7M:4kAWjDvB2NaXzXtWptZWOr7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818316, "uuid": "f98b01dc-2a8a-4138-8239-6680848f8554", "value": 84208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818316, "uuid": "0b4d00e8-10f6-473c-8c24-520f8e8ea261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818316, "uuid": "43d4c538-3925-4246-bea7-5a2d6b3bf7cf", "value": "runningaway.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86194a2-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818317, "uuid": "d3b16e1b-c1ff-43ae-ab56-e011ae76e5f2", "comment": "Malware payload (Mirai)", "value": "aa04d8628d2d4b40cc8f952e83cd7045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818317, "uuid": "e8c4b378-d75d-47f7-ab29-17f564eaea6c", "comment": "Malware payload (Mirai)", "value": "f225e98fcf789f9479199ce38f6e6d0a1641c8e2348b9f7248657db9e8f9fa00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818317, "uuid": "09817bb2-14fc-47d4-a271-366d1aacd179", "comment": "Malware payload (Mirai)", "value": "b0d2069d723fb4651e2fedc4ff4eecc1d1365599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818317, "uuid": "d9f6473b-b3f1-4ed5-8f1f-28e9c66ea3ee", "comment": "Malware payload (Mirai)", "value": "fb0c78ad698c13bbc584f0028beb35841999f8525a3a85c5ae8ed860987320dc22736e94852f82ab985bc754085dd9b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818317, "uuid": "53f46a74-757c-478d-880b-b346c4593aa4", "value": "T1A1C2E116BBE6E08BFB309437C075C1C2BFE745B550E691612661E750F6EB80EE0F819A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818317, "uuid": "a8537a81-807c-4e46-9e1d-9f3b8d8e62d7", "value": "384:3Oj3F1sanMrC3/Vh4EbUL4CrUv0Rv1HD5E1DE0Q0wk/jco1CZYuhymdGUop5hXz:38MrgIECwy1HlE5EKwoIkCZTs3UozJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818317, "uuid": "1300783d-338c-448a-80f2-01e1e71bfba8", "value": 26332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818317, "uuid": "4591198f-4abf-48a8-a1e8-9c92bb5e87b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818317, "uuid": "c644bb89-980a-4870-b655-cfd90826cb4e", "value": "runningaway.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a861f9-472f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777840504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777840504, "uuid": "32331fa1-d597-4619-b7c9-aec9ba93891d", "comment": "Malware payload", "value": "eb985ae02133fdf0dd1ba622060213fd", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777840504, "uuid": "23bf1d50-9f36-4dd2-a45f-b7f97d496cc4", "comment": "Malware payload", "value": "f2f8929bb88dabd8599cfbbdc9db768bb07632d791bb8a045560f7b9966f36cc", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777840504, "uuid": "403fe936-f3f6-42b4-a847-e4b3b19ce74d", "comment": "Malware payload", "value": "2af2d1ebf4da3b3ba8d0dfb973897eac182840c2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777840504, "uuid": "d57daafa-fb0e-4a14-9929-7d9230b927e5", "comment": "Malware payload", "value": "8d284361c15d2f16d73e5b8a0f2378c5a21bdb57b7d54abeffbdb12fd5d32364dd929ce0f49c426e2dc59036fc81d336", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777840504, "uuid": "738e42f6-d9a2-4000-9f87-646986c29d51", "value": "T147954A077CD108FDC49A6B3688F662D17731B8080B3673C72AA16A743E76BE05E7A745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777840504, "uuid": "04bea428-920c-4f29-ba53-96628ca3856a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777840504, "uuid": "f26c6619-8c1e-427a-8b76-3ee1ca748b5f", "value": "24576:VjOEB7JZ8K+fmrv1tarbnG7i6q28jp2tQDZJS98GD66Fhele5n92jUkCe0NFg:VjlrZ8Pmrv1kTG7i6mjstU3WOeDbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777840504, "uuid": "85a4906c-6ae0-40ce-bf61-41f0e93a4173", "value": 1948888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777840504, "uuid": "cc209421-39d0-4953-812f-c25386c0f70f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777840504, "uuid": "1bdcc12c-861a-4db7-bd02-aff18d6d4807", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0317a02-46bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777790735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790735, "uuid": "a94a2712-50ea-4f85-a64a-883109cc8a1f", "comment": "Malware payload", "value": "1ba650010874209c0da7bc77859a12ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790735, "uuid": "d863e5ab-34ce-400b-bfb5-1adecb9d0977", "comment": "Malware payload", "value": "f43f8a7264b9c516560524627edf4843b94ff2fc4e09df58ea3b1d0fc7d2ba2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790735, "uuid": "72450720-a868-4acf-949a-1f7d27c8413a", "comment": "Malware payload", "value": "85c61afd57ac2ed743de76c3d93a699f30407fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777790735, "uuid": "00fc2f36-e392-4ef8-8adb-356c32992028", "comment": "Malware payload", "value": "f988027c198d93efb2d118aa92ef0e72cd6980fecc0a1ee9e35da294742c84a3003212f636c01fa0c02b2bc5cad119d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kepavll", "colour": "#0EEA41", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Kepavll!rfn", "colour": "#301EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790735, "uuid": "faf67ab0-eabc-40f1-a18f-8c0b51c7ac98", "value": "T18787D013F96619E8D0AE8130C57162633BB1BC694B3513D32F90B624AF7BBE05D7A394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790735, "uuid": "973470de-40c7-4254-9fc8-250520e0fa53", "value": "cece05d62228feba4389b57bf9b54ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790735, "uuid": "62765a40-6345-4cc7-a7f6-4a3eacad8957", "value": "786432:ulIdRl0HVfp1uVS+w1IqbnCHiHDgT1A1xq3H2:sIdRlGBUwOEUOo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777790735, "uuid": "2fb5ab04-ea86-4a95-96c3-d707400a15cd", "value": 36444160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777790735, "uuid": "dc4bd58b-7f4b-4425-b3a9-9fe421e8f231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777790735, "uuid": "d6b7d290-009c-4627-a29b-3cd9ceae3f54", "value": "Goole.Chorcn.wim.7.1.1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d98d2c-4722-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777834905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834905, "uuid": "59de03d9-aaf3-481c-aef2-eb60281a0a4f", "comment": "Malware payload (Mirai)", "value": "19fb48b8f18331568013a5acf3e089dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834905, "uuid": "f6bbc69c-1668-4f31-90a3-6e62988d0995", "comment": "Malware payload (Mirai)", "value": "f494a27a96e5f00231ca6b6092fe4fc1afea3c14db53a3f4b6590ff5ef94ec54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834905, "uuid": "5ef663c1-e73c-4507-9c3c-f42c3c34ca58", "comment": "Malware payload (Mirai)", "value": "f142151b8d32cdf781db575a4f009566f657d5bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777834905, "uuid": "69f725fb-829d-4a05-8541-9f3b58eead9e", "comment": "Malware payload (Mirai)", "value": "3cbdd808069ce4108b45ca125c3e2c801f5eb4f4966a6f5a9d9b77aa90678c3d0e47a1134bf9e44c5b90aa0c556077b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834905, "uuid": "a129c137-f44d-4af7-8303-a3cc6c828748", "value": "T1F9D36A73C86A6F98C2559134F4309E782B53A49552871FBE19B7C2B14083E8CF90ABF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834905, "uuid": "71b8ec4c-92f1-4aef-b69c-638bb5ea57d4", "value": "3072:fGUZJqRutxCZg4yhzC+242tb2WGEugbwIK:fBJ6+ICzC+7wjGJgbXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777834905, "uuid": "51c66ac2-609c-41c4-88f7-8996e744e305", "value": 135584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777834905, "uuid": "fb6debd2-6095-41c8-8a6f-c715c97cd8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777834905, "uuid": "26c8c68f-9661-42fa-aed3-c54a57f3d415", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23973f38-4734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777842468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842468, "uuid": "2d1ce8cb-3ee2-40fe-b493-3c469c4eafbe", "comment": "Malware payload", "value": "a0c4836283b6e7dd85dfc0df4d25744a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842468, "uuid": "6a8c50dc-f7b9-4171-ae48-a16a06b1aa44", "comment": "Malware payload", "value": "f50f2ca3046be7c2a990617236e7d2368afdd676ce6754a5103dc5fdcd55601e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842468, "uuid": "43f96c0d-b686-4725-bbe2-8217607e03aa", "comment": "Malware payload", "value": "ba9c7aeaa45c052bb578505a217f11860bd09ebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777842468, "uuid": "7e6811b2-70d6-4c48-98e7-c593b1eefd5b", "comment": "Malware payload", "value": "dc4bcee369b26862b292d880adfcae23004d0506a18582a8cabd4e95b057874ecea50823cb7c27543701853e1d8f869a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842468, "uuid": "19456e78-82af-450c-9b22-be361d5cff67", "value": "T106045B8233856B63CE1816700EF2C778AFE5354216B2C55BE3665B0D0EB65E2BD2DEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842468, "uuid": "0a1fa920-8f70-4706-9ebd-263a5f79d84e", "value": "3072:qOPes/gxTrfY/3nBRVLAP9Oel+2fYlPaiM+w1qgJU95F2MwSPij00:/JgxgJRNy9Wla2wnYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777842468, "uuid": "6c25196b-a12f-4681-8dc8-6fea8753cc5f", "value": 173736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777842468, "uuid": "37c4d5a9-8cdf-44c4-a709-a17ad8edf9ce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777842468, "uuid": "2bb9678a-b102-4e0f-952e-701939a40a4d", "value": "35fc4b37.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8e1799-46fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777818354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818354, "uuid": "fbdd7422-bca4-4663-a75c-b900a018c370", "comment": "Malware payload (Mirai)", "value": "66ad60a4e2c2b25557d7e2616d1621eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818354, "uuid": "6c24aad8-3b09-40c5-969e-67c94aa211b3", "comment": "Malware payload (Mirai)", "value": "f568b8c1ca3fcb5c79dea54619a43d101699a1ffd3ad65303711dcb6270cb6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818354, "uuid": "039cb6a1-0e90-4453-b9d4-8989b4545423", "comment": "Malware payload (Mirai)", "value": "7a6ae6fbaee1f3a607be24c7fe5c9049be61fa4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777818354, "uuid": "616ba460-1402-491c-bb44-e4cf908a0c19", "comment": "Malware payload (Mirai)", "value": "9e9bd7a194ab335312b84acd1c0735121e9d7dc83a13b911d9857bd61442d8f922e1348476a9d3803dc6653f7366c625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818354, "uuid": "a9833e56-97ef-407f-b498-2104eb237140", "value": "T103531781BCD2896EC6D4237AE67E318E3362B3A5D1CF3617CC581B21778628F1D66B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818354, "uuid": "0fc5bd63-5f1f-4fa0-9e22-81f13dc2ffe9", "value": "1536:SuJnpdNt/BVFBXYNZPj92rdYk6PJqX8p:SKnjT/2HiyqX8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777818354, "uuid": "9c373c2b-a501-4374-8546-010a511efcfa", "value": 60700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777818354, "uuid": "dea2eb1a-8f25-498a-97f4-7570cd72ceb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777818354, "uuid": "53602b4e-a352-49e2-8840-97dfa91ab853", "value": "runningaway.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111ea574-46e8-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777809795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809795, "uuid": "03389eef-fa52-4562-84bb-e83ed58e7d65", "comment": "Malware payload (RustyStealer)", "value": "31cd8360d4bc2d95bcc26071cf92d74e", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809795, "uuid": "8be1ec1b-c30a-429e-b4fa-9dbb74982555", "comment": "Malware payload (RustyStealer)", "value": "f668fbcf0848a53ffd53e62566e3b9b7aaccf7dbefe7d0a366984e10ae87e293", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809795, "uuid": "d3c87fb2-e353-457e-8491-5ea61c0936de", "comment": "Malware payload (RustyStealer)", "value": "d05c0bb1b1d4dde61bef29125f30b66b93d691d5", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777809795, "uuid": "d8090385-fef2-4be6-baf0-87293ccb5b64", "comment": "Malware payload (RustyStealer)", "value": "1b3547be0ce41d9e7e90401122fa1644f8d8c14d3851ca2fb093e0b656c75d1104f6ee9933199cfce8abf9856dc4bea6", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809795, "uuid": "7d28f2a8-35af-47cd-86ac-1ba91c37f29e", "value": "T11435C651D1059AAFFB14C0722E96B071606C7B7B08BCA0BD52E97D7BAA07FF0C5051BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809795, "uuid": "71be5243-aae4-4a12-8713-4a1de11d9790", "value": "be39bc473662d41aed49363b3dc53a8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809795, "uuid": "abd209db-b0ce-4486-bb21-ed391e6031b8", "value": "24576:jWVitNgtKaOrNYFJfr8q23/EXo5UfkOIVtSRx:iVit6OrNSfwq2qonOqSRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777809795, "uuid": "0c891e5c-38e6-485f-b855-d8a286ecf3f4", "value": 1125478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777809795, "uuid": "dc5624e3-38d6-4d3f-b294-f1a27d1fe7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777809795, "uuid": "bd9fd5fb-87d5-4902-8660-b483a9a92df9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a89f7b6-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794457, "uuid": "faebafa6-5344-4f3a-aba0-5ee2c66af3bd", "comment": "Malware payload (Gafgyt)", "value": "87ac4b2041f174e83bcf6ac1b7442153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794457, "uuid": "cb19c5a9-0f85-4059-bb85-537d84826942", "comment": "Malware payload (Gafgyt)", "value": "f856993370fb68ec62a5b4bcd64d1c1aa7fd8d820f8d96e1237d903a513ade69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794457, "uuid": "59b8dd61-004c-4ec3-a5be-8d40efd2ccbb", "comment": "Malware payload (Gafgyt)", "value": "18183388eeddc9e4096a4fde4192450ff2d3ff8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794457, "uuid": "54f69289-4ea7-443b-a68e-2dfaa39cf873", "comment": "Malware payload (Gafgyt)", "value": "347e9a28161ceb1e6c89e81b707433935d03613bc14597e95dc7204f8a359b98cde507f369ca9e0d257c553d995dd78e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794457, "uuid": "fde77610-6b94-4f7b-a42f-e3e4201868f4", "value": "T19BB31A02D550CB53C1D2177ABB9F862D37336B64A3DB33115A24BFB82B8279D1E39621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794457, "uuid": "d8baacb6-3eeb-4d8d-a8ce-a26bd6dc57e8", "value": "3072:MsStFNBDbaUgQb4Ajk+FcMQGrWA9V6mOQYWyXdin:MTtFNZbaUgQFcMQGNV6mOQYW0din", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794457, "uuid": "09f83460-2d06-4523-b73b-bc203445c33a", "value": 107819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794457, "uuid": "8f2a915c-ce16-494d-a2f9-d16159c4a8b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794457, "uuid": "07ec1867-429d-4777-8cd5-8868915c2021", "value": "armv6l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a40090f-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777794429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794429, "uuid": "251f5d5b-79a0-46e5-867e-5cc25f6c7c2a", "comment": "Malware payload (Mirai)", "value": "b5dfb28ec7d048ae4baec9a6fe6165a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794429, "uuid": "cee4cf29-905c-4ce7-aa13-032013ad823a", "comment": "Malware payload (Mirai)", "value": "f94f28a7594e854ae063a3803dde361648ae95d609cb49e95cd9514327fbdb46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794429, "uuid": "cd2fb4d9-b5bd-41c6-aec9-1dec93b8e949", "comment": "Malware payload (Mirai)", "value": "53ecb6de9b81712c861b8855714a71c02d58d433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794429, "uuid": "15009ef4-5ebf-462a-b92d-fd77bf0aa5c0", "comment": "Malware payload (Mirai)", "value": "a053c98e432b44f079b092647b573860fd4cf92af981f5621ba21828680f9812a3fb625fe78076c1b5adfa5d03fc53c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794429, "uuid": "99042b66-6d40-4543-a6d5-5f7529d74c4d", "value": "T1DBA3B20E6E314F6DF37AC33597F78A24AB59338626D1C689D27CF9011E2024DA41F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794429, "uuid": "ea205711-f089-486b-a5ff-fb817c6a01be", "value": "1536:jlIgd1VQtp2B938x/GJaaGqa3nKbrFbaKGTaUCGIBZ64ndpJLn/mNBM2drtGLbed:jn1QEBgLaGqKnKkaUCGIBk4ndpJLn/mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794429, "uuid": "675d7b61-4572-4b30-99c2-782d27f54d65", "value": 98248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794429, "uuid": "fae08581-71b7-463f-8fb3-86e78e8f37fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794429, "uuid": "09bec735-b115-4cb1-9928-d80497912568", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15210eb5-4700-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777820110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820110, "uuid": "8f608032-35b7-44b0-891d-000498c26999", "comment": "Malware payload (NanoCore)", "value": "c33ca61fd2d347c3a3d09d650ccad719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820110, "uuid": "819c8b67-7063-4a9a-a59f-d8d550592fa5", "comment": "Malware payload (NanoCore)", "value": "fa13dc6f36db61d4b47aa2deafd4096a91811dc739b228e127c4eb27828eb3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820110, "uuid": "f7d1edf1-a02e-4b77-9d87-1719943fe24d", "comment": "Malware payload (NanoCore)", "value": "29c33e841f5a4e39c82cee99ac26170a640dae42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777820110, "uuid": "066670c5-6c86-467f-ac04-96827936f121", "comment": "Malware payload (NanoCore)", "value": "69cf78a64cc45a8e4dd3e8991ae6a3a50db4e5512249e05b57f0c2cdb56f91d890eff8527ce3dd7a67983f496e81b47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820110, "uuid": "ffe047d5-726a-4273-b7a3-1a3b89c0ce96", "value": "T14414CF1537A88A2FE2DE8679712212138379C2E3E8D3F3DE68D455B75B667E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820110, "uuid": "b21a7d52-24c4-474d-a593-0ae24d3f3299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820110, "uuid": "707e1e10-1ea3-487c-9992-1d39a13e44e1", "value": "6144:gLV6Bta6dtJmakIM5V4Q4cpvMPFGDqMiQz5R7/3A:gLV6BtpmkC4QRFBqMv9R7vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777820110, "uuid": "de67ef02-0841-475a-a9ce-451ff6f02aa0", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777820110, "uuid": "8c5857f3-569f-4b67-8fb3-7da99b036076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777820110, "uuid": "8bf9b848-d395-4a30-a793-3ddb0584ef92", "value": "liawnehaha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3428ad8-4728-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777837555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837555, "uuid": "b710f49a-987e-4bf0-8b1b-4d7624569bf4", "comment": "Malware payload (njrat)", "value": "ce566db914b48a390992f729552c97d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837555, "uuid": "a1d543ac-5991-44f1-892c-2bb2def718c8", "comment": "Malware payload (njrat)", "value": "fa210c01660c4efa63d32499cf40624146f2863bd46e658343de1d63d2ea87af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837555, "uuid": "36c6316f-9d9c-48c9-8ea6-71a1e3766831", "comment": "Malware payload (njrat)", "value": "9d032de0bceb62d9a97ce1d50593a5497838a762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777837555, "uuid": "65cbf812-15bd-4bb7-8d5b-a75d594ad40c", "comment": "Malware payload (njrat)", "value": "1f1437cd1edf3b6bd6b59e655659fd1ce106df5c8274cdef6d90966e5baed16b153d5004dc8bc045e0912afe48d56eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837555, "uuid": "ad95205a-d3e5-406e-9686-dc2e0f1e1976", "value": "T114D5021C33F6CA08F2AF0BB4E87185654372FE179C62D76C59A579AE04B6F44BA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837555, "uuid": "213776e4-1822-4163-956c-569ccdded03b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837555, "uuid": "a9743ac8-698f-48e3-8568-8b0f05dca54e", "value": "49152:tgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4+dV:tgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777837555, "uuid": "de3cdd1e-560d-412d-9093-4860e5a0c85d", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777837555, "uuid": "e64e7439-c60d-404f-8515-31bb21fab101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777837555, "uuid": "977e1345-ac6f-413d-b201-3f78aa74032a", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51939d14-468a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777769531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769531, "uuid": "da39eef1-b454-48d5-9629-7608d25cd504", "comment": "Malware payload (Mirai)", "value": "501fbef550f863143770784de730bb61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769531, "uuid": "2ddc8aee-fba1-46bf-a3b0-52b3dd006267", "comment": "Malware payload (Mirai)", "value": "faebd5ba34e23efbb919260b3f2a53d6c1d4634c4c54772adc5c30be34c3e1b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769531, "uuid": "b762940f-024b-4c73-a7e4-ad648558addd", "comment": "Malware payload (Mirai)", "value": "60811c23c615efa864f2fcdc16c128cb20a9a912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777769531, "uuid": "e47022d6-cb19-47b2-8a0e-bec71d0e5d90", "comment": "Malware payload (Mirai)", "value": "af020de8190c537f02399a2457fafc834f61a986b0e2dc1b51fbe536fc3ed3c82819ee530a39c94275c7d6275da1f46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769531, "uuid": "b80fc006-ea86-4228-9351-497db2007b4c", "value": "T1C9B57C47B708B9BEF286733784574A0E34047F12C0815F23A2B5F5BD5E6A1A91F396CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769531, "uuid": "9e688717-740c-4f27-a60d-8bbc24753548", "value": "49152:vN2VcfXUYuo1d6YH3HotGXsMxZbhrBkMT:vN2+bAY3rcMxbBkMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777769531, "uuid": "865d273c-d49f-41a2-bbd9-a3a958e76835", "value": 2309148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777769531, "uuid": "d710b1c1-f348-4d04-8c94-bfa425909a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777769531, "uuid": "7c08510f-d189-4051-b444-65ee1d76a995", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530bec3b-46c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777794444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794444, "uuid": "671ae5c3-d5c0-4c03-be37-d974209799bd", "comment": "Malware payload (Gafgyt)", "value": "0c70d83f38d583b73bda800c249a86b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794444, "uuid": "00b1449c-1f0c-496d-96a2-6f1f38085bcc", "comment": "Malware payload (Gafgyt)", "value": "fb129d7897b8124c7986cfb3d82e680f1bfa9bb279c51c2904b2704b61f12cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794444, "uuid": "db25220c-3d15-497a-a0e7-1c33ae099feb", "comment": "Malware payload (Gafgyt)", "value": "186b441c5339dd61bcd40caebc1e5e07b46a66a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777794444, "uuid": "454b36b5-6682-42de-83fd-ae2bb72c1067", "comment": "Malware payload (Gafgyt)", "value": "21a56fd90fdf3e73bb2999e70bde50f8fd21115bc526b588516f1e86e89d72e80f2ab3470393c127199a51c76d411b90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794444, "uuid": "481ee9ef-eb88-43b6-bf3b-12abbb69c441", "value": "T1E4733B45E392C1B2D5831B7402E3DB394231FDA1631BAE2AD76CBFB4CA33582645672D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794444, "uuid": "c7816c65-373e-4a7a-8932-d4e0a9d7ad56", "value": "1536:TWBQY8q+HI/AuOWoLjKUh318hA5SrH912Tk:TWBQY8qaI/5m/++KdwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777794444, "uuid": "0b986e56-7edc-49ea-b59c-fed6ab495edc", "value": 76976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777794444, "uuid": "958c74e6-01bb-4277-aa71-c9906e8f1c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777794444, "uuid": "928ed296-7564-48ac-abfa-c10a2da37cbb", "value": "i486.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc216a31-4688-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777768877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768877, "uuid": "f4a4a04e-d647-4700-9ccc-f69d45bdf4d6", "comment": "Malware payload (Mirai)", "value": "305323bf2a6bc13c9f450e28a2bc4f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768877, "uuid": "3326e821-bd96-405d-838d-08f32f947acd", "comment": "Malware payload (Mirai)", "value": "fdca39d8cea276643282eaa76a751d94a1eb9d0e1c14152a6a0b04ac254356f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768877, "uuid": "593a5b97-d008-4b51-bf8c-fbfcda993c77", "comment": "Malware payload (Mirai)", "value": "46fa9905df463f035868cd5baf3a1ae9762d5320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777768877, "uuid": "2d039449-f4d7-4c41-9c33-65b48b514f58", "comment": "Malware payload (Mirai)", "value": "da7e58d3a5d5f505e4d1b1a3b474886b923c132b5a2d1f5275df6f00bea0b7b541cd5fd7377295eb67c11dc03f79088c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768877, "uuid": "f6945125-fef7-4259-a64e-8887f6af9eec", "value": "T18AD34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768877, "uuid": "7349c3cf-5146-4bb8-a95f-3f0b2965b5ab", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3j8A:APeCK9kzivVYQitymTT8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777768877, "uuid": "ec88955e-3842-4c10-b680-3536e795908b", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777768877, "uuid": "d4873ffa-2bed-46ac-a502-d680e9fbad7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777768877, "uuid": "e201c0ed-b1b8-4334-9e63-bbeb2189198b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e39e50c-4708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777823776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823776, "uuid": "5385adfa-0f08-45a0-937b-1132ad71b0a5", "comment": "Malware payload", "value": "d52c8c3781377bac68f9bc5b99293f10", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823776, "uuid": "18fe96f4-0284-4a79-a1d8-3903111fe045", "comment": "Malware payload", "value": "fdf36ff2282200118280cac46684ba5727b0d74560d459a4b7699d86cd0831b5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823776, "uuid": "78800d68-2fe5-4887-aed5-c3cb5f5b69ef", "comment": "Malware payload", "value": "e5edce44eb499d12221c0355d2f459b7441bec94", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777823776, "uuid": "b67b924a-fc89-4ddb-a0d6-460c80b2b9c0", "comment": "Malware payload", "value": "7e6d9d4a6a930991a44dc7d1d1a93dbfa053383ab97916a72e3790162db234746ea5508a2ca59e8f4853325a61e53629", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823776, "uuid": "6fbe9a1b-d24d-4a91-a814-378777b5a4ed", "value": "T1CCF4209F6A1C64C1CB296AF89C89AD4983A07D95F5FC40DE1186F727EE3CED34E28045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823776, "uuid": "4455e343-ab9e-4257-a9b6-4944d91fae85", "value": "12288:cJ2tKKesFa/CqIx8ovU7TuO2ZOjbrWVgJRpOmnp1m8RHtH8K:mkn7qgVc3uO2Z2bSVgzpOmnp1m8RHtHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777823776, "uuid": "23a6cc21-f1af-4d67-b636-41a93855d9da", "value": 750648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777823776, "uuid": "2cfd3914-9d45-4e14-846d-6af9f97e2992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777823776, "uuid": "db64a357-ba62-4e07-bef1-0a78b8a3eeb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be7614d-46ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777784017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784017, "uuid": "56472f0b-29df-4998-9548-b557e05d9b40", "comment": "Malware payload", "value": "8b2ebb8cef43ede4e748211b80415262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784017, "uuid": "ff2dbb9d-bcd9-40ea-a1dc-5c5a12e298c0", "comment": "Malware payload", "value": "ff11e95d2ca67b70576f41af5905711a5ad457264a74148754a1e50bf2640992", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784017, "uuid": "899cd7f8-71fe-4d12-bd32-e20cf591fcdb", "comment": "Malware payload", "value": "ddcd0ac25db5d5828e7dc9b7fb6565bce8619b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777784017, "uuid": "dc0feed2-9537-4480-8297-d10f5f4f16ef", "comment": "Malware payload", "value": "665a74f3b78e371183234bd110e9fddb2411c241a472a28679f25a7b1902933ebc4f45e40222dc55ca1655db3339771c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784017, "uuid": "56191516-bede-4080-b9cb-30f3fa7415d6", "value": "T19547DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784017, "uuid": "efa5efc3-a1f1-4138-8d91-545445c21422", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQg:cqYUQuVDt0TZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777784017, "uuid": "1453f6bf-9277-42f7-9789-793cbf8b20f3", "value": 25231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777784017, "uuid": "5a3653f1-81aa-488a-a611-f9a3ead3dc4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777784017, "uuid": "73172693-dd79-4100-8321-b00e88d5a41d", "value": "ff11e95d2ca67b70576f41af5905711a5ad457264a74148754a1e50bf2640992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }