{ "Event": { "published": true, "date": "2026-05-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-02", "timestamp": 1777766582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1f318b2b-abce-4e3a-96e6-fb37f78c9f9f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f29e72-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777697681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697681, "uuid": "95d687ff-ed13-4ce0-9bc0-57bee11cde02", "comment": "Malware payload (Smoke Loader)", "value": "d3677dda994a90630ae14348bbcbd583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697681, "uuid": "1040869d-56ca-4f5c-92d1-d84fc159fd11", "comment": "Malware payload (Smoke Loader)", "value": "000a9a0d53e6440d6d398e8249714bb057d9647c328232e16e9472693e1897eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697681, "uuid": "426d82a5-5dab-4b43-83df-82a8126f2327", "comment": "Malware payload (Smoke Loader)", "value": "56589e2bd97d6e46493ac98f31ebf7071eb9236d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697681, "uuid": "e73c4ca5-4d68-4370-8b7d-7c2493ef8472", "comment": "Malware payload (Smoke Loader)", "value": "c70f22383b9bff705e111e498a44bf8ced3a95955a9069b86a4a6fead9648f20c6b7a478b026d07b986d9a154e4b7201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697681, "uuid": "26cf0a30-1a3c-4928-93ab-5e3a55bbca2c", "value": "T15C173387F25A30F8D4379178A4764E529733BC3603605BDF4394A12B5F23AE0AD39B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697681, "uuid": "b1fbe25a-6c78-493d-9c0f-b80c0cd693f8", "value": "4029dc5ee830151a426fff64189bae0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697681, "uuid": "c0e7d57b-8ae4-4a4e-bd6a-fa6cdc92f7d5", "value": "393216:FgOQ4kP5/tEnd+BdIzpajBbbcaKgMyMuTOuJktoGcPv7:WOQz1ed4vBcKMVcOeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697681, "uuid": "6a0da42a-194f-4896-bd87-da5200c4e475", "value": 19821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697681, "uuid": "75c20f58-8952-40c9-8628-bc52e8ba6ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697681, "uuid": "4ac92ebe-6a45-4a72-aca5-041c434d9590", "value": "stripe_checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b7bf5c-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743666, "uuid": "af063306-9a00-4cad-8ee0-05b0bbfff5ae", "comment": "Malware payload (Mirai)", "value": "6826c27e94d374edc15bccb5ea1e4316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743666, "uuid": "a8389c6f-9b19-4726-a44d-67ced7e05013", "comment": "Malware payload (Mirai)", "value": "00d55527ea0fc012fd08d1cc26b27965cd4518c23597ee095403252f7cb7755e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743666, "uuid": "c3922b9b-233a-4d1e-9f89-768938965afd", "comment": "Malware payload (Mirai)", "value": "5807b60d43bc91c31dd33d4c16b43c661e9b3f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743666, "uuid": "b4e0683f-bf12-4834-bb96-091356444e4e", "comment": "Malware payload (Mirai)", "value": "bb1f419e8246f31f7ff7e4eb8824f659f998b6a9480a664fb72635b17c0f30ebcf5fd29963d7563341cbd017f155f3ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743666, "uuid": "bf3d8d40-24ed-480f-a3d0-f37adc0088bc", "value": "T1FB54D60A7B519FB7C46FCD3306F98B0228CCB45335652B7A3670EA5CB61A58B49D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743666, "uuid": "307ed7e0-1b8f-4adf-aaee-03838661f472", "value": "3072:+7M2vrjCPFdgtqULNj7+3ZEI7JxLCoqvR+IP/+jPpnGq4NVj:gvrjCPTgtqUtCJ37J32+I3+jva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743666, "uuid": "2bc5a118-77dc-4de1-b0c9-b530418bdf96", "value": 305544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743666, "uuid": "f9354079-168d-430d-b9a0-3514c8c5228b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743666, "uuid": "762b0b2c-a633-4b93-b186-5a41b82cde60", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630551d0-4605-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777712437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712437, "uuid": "fdcc09c2-e508-4f5e-89d9-6665b3f7c2fb", "comment": "Malware payload", "value": "5835f7ea94a2d31faf273fb253ec25e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712437, "uuid": "a6399fb0-0975-4c55-893a-4b02cfee2503", "comment": "Malware payload", "value": "00deea7003eef2f30f2c84d1497a42c1f375d802ddd17bde455d5fde2a63631f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712437, "uuid": "c494de28-680c-45db-ae33-7cb8c5dca3b2", "comment": "Malware payload", "value": "c028173f1403232b5259aa9d6e5b72f6382e865e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712437, "uuid": "19f93589-f2d6-428e-871a-b8cf4ed4bd00", "comment": "Malware payload", "value": "637fcfd5e5f814aa25a4edd3cf11101dc43167e56310e67c8c39f697f6d1af64c40a5754ce7a9395d8927bbaaa168ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712437, "uuid": "dc9993e6-aab8-4ed3-aef3-de3cd427231c", "value": "T1B3C4D797A89550F4C1FFE134C66AA212BDA13495073827D72FA147F10B26FF86A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712437, "uuid": "c9536ea8-0f5d-46ec-b6c5-41d1b7f87547", "value": "6144:c94NsgaeLCfHqHc6c5EBr777mMsIRbS5OwziAJxTDo7BTbWW97eG1Cr2O:ciZLBtBn77RD3w2AJK7gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777712437, "uuid": "8a975843-4380-4be9-9c1f-8778fb3970ab", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777712437, "uuid": "d0a0c4bb-29d4-4980-8240-c6bc0be6a43c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712437, "uuid": "0b440535-8908-4512-8c0b-8ba50323d33e", "value": "00deea7003eef2f30f2c84d1497a42c1f375d802ddd17bde455d5fde2a63631f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86334ab2-4625-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777726240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726240, "uuid": "d8e11934-6968-4fea-abe0-d014dab492e4", "comment": "Malware payload", "value": "2b31d9ab81597a9da17b069bdd80bbd3", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726240, "uuid": "e30fa107-36a7-4388-b5cf-369993676d5a", "comment": "Malware payload", "value": "01586d4e2572909873585d09ed226fdf65dc7f20560454e0331aba7940822e40", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726240, "uuid": "1d19f9cb-a834-4856-ae7f-67028ef6792c", "comment": "Malware payload", "value": "0d60f7e81f6715e86c9bc1df76684bbdb9f1b964", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726240, "uuid": "36d78f29-1769-4292-a6d9-b828490b1028", "comment": "Malware payload", "value": "f832d06de7fd535a8a75b51da17df563f6bd609ada75777c67e510967c52a822f5252a84df32af8e6995f3ba5de60304", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726240, "uuid": "dc468b1a-e6bf-4510-b4b0-34a9b53bc680", "value": "T13483584533E87300F1B6BE3B9A7AAA85493BBE60DE72D36C4610D81D6935A50CC74F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726240, "uuid": "1d5a6a3c-d887-42eb-a479-3dbe921fab58", "value": "96:9h0eYaZw3YwppTYaZ53JRbRFYaZn36m6qW:9YDowpmi55YcKm6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777726240, "uuid": "f1c7545e-0fdd-42b7-a09a-8ec0d1f077ef", "value": 82974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777726240, "uuid": "39946ff0-ab1a-4893-856b-feac7af29af5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726240, "uuid": "e61aca49-556c-48d0-b30a-f9843014ef7d", "value": "init.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ea2ede-4657-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777747882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747882, "uuid": "e0d6f4aa-7862-46a2-bb90-c24f0534965d", "comment": "Malware payload", "value": "3b4daa626a4a71eb4d6b6ef0979a74f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747882, "uuid": "405acfb8-5606-46a1-a855-6501c053563a", "comment": "Malware payload", "value": "018b922eed6b9bf991204fe97a3f52ee8b561aabdb96ce7ee63931f77c5808e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747882, "uuid": "5a119233-6f0e-4fac-b7e5-c410faa82099", "comment": "Malware payload", "value": "3432122ad75a47c98709636a0125452187ffa68c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747882, "uuid": "ca009ee9-41f3-4487-aa53-db613166fd8c", "comment": "Malware payload", "value": "2a70879fb9ab742a3399148b4c824611bb53c22bc9bbd15df16c7f898a0dd00e8d4bf2641cc765732e9b8ccc15c7981d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747882, "uuid": "33f3723d-4d77-4c6d-bcc5-d9d9eb47ced0", "value": "T108761957B8924942C4E43A37B8BE81C432630EBA8BC7165B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747882, "uuid": "b15e71d6-2f3b-481e-ab99-fe4b1210ab2c", "value": "49152:fagRD+x5fl0OVbZyGENsVhsPWMKaO7DBBJtTpiB+MuO5EB:f/Dol0OVbZyGENsRL7JtdiB++EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747882, "uuid": "6acfa03c-fb8e-48fc-b363-7001799971a1", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747882, "uuid": "952fdeb1-99c4-41f6-84d0-59d69f4d4c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747882, "uuid": "112d528b-5c2a-47cc-a0ec-360c07817544", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdac2781-45ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701879, "uuid": "2005fcd7-410d-492b-8105-e46d186ec31f", "comment": "Malware payload (Mirai)", "value": "2ca1c7f343ad6e8ff1d1e4055ae80130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701879, "uuid": "edf5c7b4-1963-4991-9237-e0455f6ff066", "comment": "Malware payload (Mirai)", "value": "0269c367eff172f6bfcb54ed717a3f9520be4130c4ab4d2f4a5c95c8dbaead5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701879, "uuid": "1ee4e1c1-e8c5-47cf-ac50-01a87a6987e2", "comment": "Malware payload (Mirai)", "value": "955ff909972958098f0d4a06bcc4d6b9eea90449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701879, "uuid": "30e3134f-799d-469f-99f0-3ecb44ca085d", "comment": "Malware payload (Mirai)", "value": "d5e68a387a6f60d436dfda57905f58a826550bfe5db34a89264365953c0cbcad6935da51deb4894a50a863d7a3cbc9b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701879, "uuid": "9aeea3a3-73b3-40cd-9e14-30e02df1d745", "value": "T1D4E4E50A6E629F3CF36487314BB34B24D6AD72D617F1D585E2ACD1055E3024E192FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701879, "uuid": "0eeb0510-89fa-404f-b524-ef029be5404e", "value": "12288:QIjq+YOSHFWYHm1cQdR8m6sEjdN01uTuzBBKVNoeAX:mOSHFWH8mtEjdN0Eufr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701879, "uuid": "28eb5464-467b-46bd-b248-2e0087c06582", "value": 713168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701879, "uuid": "775f0bd0-e37e-4d36-9207-393800542efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701879, "uuid": "935e7a9a-67cf-432a-a886-624de6319d69", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66605fc-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694511, "uuid": "2eb967b1-6c9c-4b27-a313-5c34f6f48ce3", "comment": "Malware payload (Mirai)", "value": "5841ea0f0c0b63dea2ce605cf623aaa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694511, "uuid": "b30d30b4-03ce-42a7-96e4-614f5fa097e9", "comment": "Malware payload (Mirai)", "value": "04d1c01b0bf4f0ccbab58efce6da76ba7c4a350eb0afed883e3a5f95f677c337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694511, "uuid": "034b93b5-5b56-454a-996f-ecb34169f9ca", "comment": "Malware payload (Mirai)", "value": "c8cfd96fdc1b1cbd81d1bf25e95dcb3303aada3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694511, "uuid": "2211cf49-fd75-481a-9c20-a314bcd775e6", "comment": "Malware payload (Mirai)", "value": "bbb30ba40b205a099582abe72b084519129b47f35007aa209cca9a820e6be193706a804bbaaa29a32fde54d84c893e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694511, "uuid": "0fb611f5-8d74-46cc-a4ac-ef92625559b3", "value": "T170A43A51BD419B26C7D06ABBFFAD828C331317B8D2EE7112DD164B3136DB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694511, "uuid": "ee39e850-8cab-48c2-8dc5-afa1d1e53d87", "value": "12288:69RY4tNW3RFOaASG1AiQvixtn/UEqDDPcVbArSypjRGDyppEMJl6T9b7MhN1s5CW:KYHPEbyhU5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694511, "uuid": "24dd4d17-9983-4401-aa59-1c19ee51e9b3", "value": 467060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694511, "uuid": "5e8bcbf5-47d1-4015-bc55-10301dd18b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694511, "uuid": "4d4e864e-fc49-476a-bc45-80e9147cd324", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f840cf0-45ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777680246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680246, "uuid": "90966f28-6a2f-4c90-b939-7fd70e16193b", "comment": "Malware payload (Mirai)", "value": "cfcdc1b8f74c0d4511b860904f1ed274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680246, "uuid": "d0e1a00d-5bd4-4592-a57a-3b6072f0eb47", "comment": "Malware payload (Mirai)", "value": "059a3ad31eadb9a89cce05d6c8b2d353c35f93cc1519d52a4002e0218a8f8b09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680246, "uuid": "7adc1d6f-66b9-464c-80bd-2d5568b2017f", "comment": "Malware payload (Mirai)", "value": "b735b50edc93489c88a420f1f95e10a22ac7db6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680246, "uuid": "a396a920-75b5-4f0e-afc0-91240f033f9f", "comment": "Malware payload (Mirai)", "value": "ca72ed3874707565be8684f35fd58c200414687ea488c2d0cf22870d7c0aebaec9e3b517b06bdd955de9a09103e2f166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680246, "uuid": "5b2a9b96-e94d-4ecd-a220-75b32680fbe0", "value": "T1EBE31945F8514B23CAC612BBFB5E428D372A17E9D3EE72039D256F20378686B0E77542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680246, "uuid": "2c225d2c-a0cd-47bc-8b25-0fca1381b042", "value": "3072:L2IXWICKh3QpaMLT5GvWdi24sK8YbOb/SFoAOF:LDXWhvLTIvki24sVYbc/moAOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777680246, "uuid": "ecfd62f8-f0f1-4aef-be44-63e9774574cd", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777680246, "uuid": "bb3fe119-1276-479e-a3c1-fad40d12beac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680246, "uuid": "a13c7b41-ba67-4012-b7f9-9ca53fe145b7", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37a6dc5-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736651, "uuid": "c940fee6-9f97-40ea-bf0c-25dfd72d5edd", "comment": "Malware payload (Mirai)", "value": "061375fd23065c0f8d943377316db08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736651, "uuid": "709d91ba-9a49-4e89-b2be-a3332e0152b9", "comment": "Malware payload (Mirai)", "value": "06c3b54fbe5454c8db506947a902a6b9424a446650c1d13d319a4e970ab755b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736651, "uuid": "a7b4fb37-5d6a-4453-a921-2679f023c766", "comment": "Malware payload (Mirai)", "value": "c76dd42088ce05392b1974e618580f8ec4466d8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736651, "uuid": "dc8a6cbb-9bc0-4ba5-9fea-bc59063cc589", "comment": "Malware payload (Mirai)", "value": "eb5d781939f17cf8a90061b22734957cb396ca6a07650d8d2592c8843d44b754be641b5c827d1210be05b2587d400caa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736651, "uuid": "e875d338-2534-4d18-bd65-63886e8a948a", "value": "T1A2839316BF601FF7EC9ACC338AA91705289D651E31A93B75B830D428F25B25F15E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736651, "uuid": "1cafd5ce-90ce-48a4-965f-d60404d89898", "value": "1536:bw4pjQLOQpGTZHslkJGAopJpPok9Z5zty5d42+B:bw4pjW7AFslok9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736651, "uuid": "df81b54b-6e6a-4c18-be41-7f7522f1d401", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736651, "uuid": "2437c6e4-acbe-4ab2-b070-c96a80c2e960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736651, "uuid": "235d42b6-42f6-4426-b8a5-ed3eca3c7c83", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c724ff-4633-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777732420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732420, "uuid": "77fbca24-3982-45c6-aa8f-042f54122e7c", "comment": "Malware payload (AsyncRAT)", "value": "f0d5dd84ac3f92457bae218011eb0da7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732420, "uuid": "a236f1c3-0083-4741-8489-c39985b63563", "comment": "Malware payload (AsyncRAT)", "value": "0713f3f0cf5f96bf53479ba18394725aa7937540a7a3dc75b6b75a10beed860d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732420, "uuid": "37da3faa-28a1-426b-9317-5125ae74b593", "comment": "Malware payload (AsyncRAT)", "value": "1bc3ca7ff5976aaf93b85e95755c85648efeca8f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732420, "uuid": "d052a94d-ab6d-4284-9c09-0e16c1b72ada", "comment": "Malware payload (AsyncRAT)", "value": "dc5dbd27e4a52e48eefe8b970a5cb900954bfe0ea787a7c0fc55447dde2fff8b91c1c9ee5e4a79d21a1be9df07e37651", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732420, "uuid": "77a8e2d6-642c-42be-af19-0f465d387929", "value": "T1ADF4BE19E7A508FCE0B7A6B4CD924902E7767C4D47B1E68F03A479662F333909D39B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732420, "uuid": "11ae081c-3493-4cd6-80a4-352773c6685d", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732420, "uuid": "a321ea93-7e8f-4e1f-b38f-a6b39ac4c778", "value": "12288:IhoVY2+LfWvRSECKG4iRkToVsz5WSFEAmDG8c7uzDALmX:4b2+CvRSEHiRkToKoSFT8c724y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732420, "uuid": "4841334f-ed4b-4e7d-a912-11e31f512fd3", "value": 733114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732420, "uuid": "f76c5a7b-6736-46a2-891f-987f8d0e3a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732420, "uuid": "767679af-fd21-4c25-ac9e-8578e50d6d16", "value": "Previous smart bold payment.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c10c0e8-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719270, "uuid": "4f9121e6-2288-49d0-ae30-89bfca717396", "comment": "Malware payload (Mirai)", "value": "e4b0dfe54d1af68b79b0dcbc47e00a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719270, "uuid": "3ea96f95-933a-405a-9ce3-da346d9c7bcd", "comment": "Malware payload (Mirai)", "value": "074005ee94625b07008b3c98ed2817d59df3ebaab91a67f8cd77572267715d5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719270, "uuid": "7147fcd5-917a-4030-91c9-0146b0cb6afa", "comment": "Malware payload (Mirai)", "value": "09e85429977c423fed07f7d8a0ace9526dfbfc83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719270, "uuid": "a7b16304-a6e3-42a2-b343-69afb5228d76", "comment": "Malware payload (Mirai)", "value": "bf570a01d836c12b811bf67e95ef3e3dc299d296860e6d98d0bb4c8afe72b3e2680e993aa33e9b5c336098ece4e5340d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719270, "uuid": "76d3b4ab-bb0f-4fcf-84f2-42a362326900", "value": "T123848613E91584E5D414CCB213673356AC4793BF88A632D3EF5A4AA1FF2581B42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719270, "uuid": "25da8762-c42a-4a4c-a98f-ddb56f68ab33", "value": "3072:TLmVm5e5he3xTIH2xD1ZXbWCrAjITIMI3Ja0fD4BA904v:TCVm5RdV5rACC3D4BQzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719270, "uuid": "4bd0abed-51c0-4675-acf5-05d06c0dec77", "value": 390088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719270, "uuid": "23e056e4-8185-4c53-a6ef-6c257c35fc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719270, "uuid": "b12d430e-aa63-44ef-bf47-7f267d69ed25", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ba4f72-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741547, "uuid": "6fae844b-c0ac-4bee-8a33-210dbe169824", "comment": "Malware payload (ConnectWise)", "value": "7b9fc9691f11a72ba8e33e75ecbde6fc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741547, "uuid": "6950e91a-b7c5-4b3f-adca-bb5f92f76ad5", "comment": "Malware payload (ConnectWise)", "value": "086ce7b8dcf90857f7895db50a3c01273072b69cbf190dbb4121d4082013a4c3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741547, "uuid": "5cfd9e5d-c0d9-4972-823e-e161ec62bda9", "comment": "Malware payload (ConnectWise)", "value": "7645fbeec99d7cc113289daedeff0cbf4aadf2e2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741547, "uuid": "18b05cef-fee2-4b9d-9220-ce5870f50f77", "comment": "Malware payload (ConnectWise)", "value": "0a80e1a5517c7adba33f1c7193ab6f65c83c8d3d89f34d79a8cfe0aac47c7fc8262f60ec88408c8fe9fa4f70ce6d2e5b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741547, "uuid": "e41ffbac-adb4-48b6-ba83-44c00180b162", "value": "T18A46E111B3D995B9D47F0638D87B4269AAB4BC048712C7EF5394BD2D2D32BC05E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741547, "uuid": "77e956ba-fe52-42b5-b66c-0f245ef24c68", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741547, "uuid": "e01c8645-b3a2-4e77-ab31-3fc65d37edc3", "value": "49152:NEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:CEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741547, "uuid": "1ee29690-d3a8-450e-bdba-5468b3faefb8", "value": 5766256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741547, "uuid": "c1a8cb0f-23c7-4032-ad24-2c1055f2a609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741547, "uuid": "70e4f48c-d7b4-4aff-b2ba-0eafe10d8c70", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c34f6e1-4617-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777720183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720183, "uuid": "9a2bb549-6a49-4a0c-8bbb-b40f5eb88070", "comment": "Malware payload", "value": "2a8ae9aab0dfdb012700d8b513a98fff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720183, "uuid": "440af052-5d97-4267-b5ae-d48bf38a94e0", "comment": "Malware payload", "value": "08e9e74143acd1979764892a415ea2130695d2554f1b082186b4afc2b639b185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720183, "uuid": "82cc66ff-f601-4695-a7d5-84588503fbf0", "comment": "Malware payload", "value": "0824b8fddb289715f38152e729efca072323ecf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720183, "uuid": "a440ffa3-6669-4295-a504-9b8767f2276f", "comment": "Malware payload", "value": "64869298d8f17aeacffb59ddc34575eba00f78ba22635fc30e509a49ac2d9b25a28c738c8bbf3c68297c97dbc76dcfec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720183, "uuid": "f92777de-c5d2-485d-961e-8712f3cb2164", "value": "T118029F03FE308E9AF223B537455987B3761061A310DE2A4839E5645D6E075C9BA2FE37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720183, "uuid": "be6e8f62-6da7-42c6-96d1-9f81da38a7ce", "value": "192:j3ZE0N6ki8jfz6SG1F9dpDC1lHWuebp/vMxoeio4b0sNz:j3ZLN6d865+l2B5oiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777720183, "uuid": "60e85ec2-a593-4eac-b906-65718c97c576", "value": 8348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777720183, "uuid": "49427f8c-cc11-4c44-9288-7ee1b308e19f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720183, "uuid": "b29aa37a-fb9d-4653-b5b4-92ec21f20de6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb047ccf-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736636, "uuid": "83e1c5e0-1737-493c-9008-eddaa84f628d", "comment": "Malware payload (Mirai)", "value": "d1f1219711e71e4a53409ae4b86d79e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736636, "uuid": "5457403a-d6d6-4058-a3bf-76c3c888de43", "comment": "Malware payload (Mirai)", "value": "090106580395f02f8224c2186d322f46929d8ebdebdb86dd7bb59ab4d0cf4313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736636, "uuid": "ed8a0ab3-f1eb-48e8-9878-30e112632313", "comment": "Malware payload (Mirai)", "value": "23c1cf7bd493840ba1cdbfb2be8c3e46a7daa1f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736636, "uuid": "79d8dfc5-fc5d-4062-9315-cc6139450f00", "comment": "Malware payload (Mirai)", "value": "3b6ca0bfcccfbe9c0c715be6eaf8a218495585f437ee7cd52e42e956cbea09acd801905dbddb0c19b3b42d307b585c13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736636, "uuid": "e43bbae6-2858-4e2f-ac59-ae90373f644d", "value": "T19173A9092E358F6CFB5D823697B78F219758339626E1C645E16CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736636, "uuid": "61a6d628-e387-4391-b376-24ebd6368fb1", "value": "1536:lo89L2T27mQaXcn6EyvFaQSiIHW5VU+6Y3jfhdR2QEc8LMk5d42+T7w:lo+2TIaXIEFaZiIH0VU+6KfhdR2Hc8Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736636, "uuid": "106b6419-a5c3-42c1-ae31-88dffa33f534", "value": 80188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736636, "uuid": "401061d3-1bb1-47c3-ab7a-91a678015746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736636, "uuid": "ae32ccea-ab2e-4473-9cc8-7344f28d71d1", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bba0c0-4640-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777737668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737668, "uuid": "5451d242-b07b-446c-b5b7-695d8985bab4", "comment": "Malware payload (ConnectWise)", "value": "59f7297f5e811cb6f3eb35b3765725d8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737668, "uuid": "758de051-1520-4892-87ff-b8c58fd0e2b2", "comment": "Malware payload (ConnectWise)", "value": "092d767d5794042a694447b05d6e2089c2834c0168206867a43bac5432880be8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737668, "uuid": "8c061ff3-529c-47d4-946d-1439dd791232", "comment": "Malware payload (ConnectWise)", "value": "d2bad9d252eb9a5cc5bb39169915b1fbf99df2ff", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737668, "uuid": "31bd0d86-3326-476f-abc3-2a3abdbc43fb", "comment": "Malware payload (ConnectWise)", "value": "33f93ff0df0ff3a2006d5cf76472f46eaa39d570e213b25a9f58d88a6253ab64ac2545e25db5789a3c23dfdb4a888950", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737668, "uuid": "c7b084d5-b49f-4d23-aca1-94b27e41b364", "value": "T1D946E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737668, "uuid": "1fbb6eb7-b5a6-4eb5-a47d-81e933d0a868", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737668, "uuid": "09759df1-b815-4a76-8b0d-6dfee3d3f67e", "value": "49152:hEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:2Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777737668, "uuid": "b6e12ab1-ebb3-4d16-bfd1-570085e60335", "value": 5622504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777737668, "uuid": "d0106ca6-b9f4-4b54-bb30-d09c85604b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737668, "uuid": "663c1081-f302-428b-818a-8d76d0e8cc20", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7764ee-464b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777742362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742362, "uuid": "080782fb-f223-4035-8b82-280299bc06ad", "comment": "Malware payload", "value": "978e3ad75465796a7f29093eafc9bdcf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742362, "uuid": "12fa9be8-e554-442e-a800-0806a6790a6c", "comment": "Malware payload", "value": "0945d6196681ac26b289b4be335bcf4a19cebbe32b79ec67692442aafae338fe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742362, "uuid": "c24465ad-12b6-4b89-9d42-3068238cbda8", "comment": "Malware payload", "value": "94dba2cf0f5075653ff89f51141a2356fce289db", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742362, "uuid": "1ea5bf02-f0be-4d2c-9db6-60d3223dc41a", "comment": "Malware payload", "value": "b6d7a94ff3585570ef9bbb775f5d1c415ebd04712e5f2b57be46c6857a44d683dbab6ab8e24ec07645379586f9f6a671", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742362, "uuid": "9f2f7623-f3df-4281-b63e-5474c7505cfd", "value": "T16B466D0ABEE100F8C2A5A6318CE637427F61F45D4B2627D32991A2713F67BE01DF574A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742362, "uuid": "1ba2c5ca-29cb-4a3f-aae5-2d878319c6f5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742362, "uuid": "e67dfbca-a735-485f-a2cc-510b6907f35d", "value": "24576:EHsxeStZQAfjwUkmVeBzkVbt4rNg2yWeoetG1KUDZciz9Yo4nhele5nK23cPDUKD:EHseIZfjwUk7IVbtSLyWeoeZ6Ed2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777742362, "uuid": "b070255a-f2f4-4f23-a463-38a5928625ed", "value": 5786840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777742362, "uuid": "35aab04c-6984-4786-8d5c-25dcca509e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742362, "uuid": "1e36eafe-c354-485f-896e-6e4da4d823d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859e1bee-464f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744278, "uuid": "29405ded-b797-46ef-afd2-7122464f55d3", "comment": "Malware payload (Mirai)", "value": "d8418098a53818e42ef9c8f6008fa960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744278, "uuid": "33c543f6-d96b-4db3-b994-f9516b94f3ec", "comment": "Malware payload (Mirai)", "value": "0ba81f3fa2640ab5984135df5c2c8cfdbe2e497cfb3529512e35e8994f003677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744278, "uuid": "de35b567-b4bc-43bb-80f3-df6d109f55ea", "comment": "Malware payload (Mirai)", "value": "ba0fcf9869f34f5fe0a33db023b819464a7416f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744278, "uuid": "037bc455-08ea-4dbe-a087-aea8a59f652a", "comment": "Malware payload (Mirai)", "value": "414ef91b0728e51ca3f6280a4578cf2010ca0078a83c0ccb9dfb701d366a1a22f51eefa2e54c9c8d10c672f8120b5998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744278, "uuid": "23bf1f44-2f50-4df8-827d-d20c0746240a", "value": "T110043902E643CAB2C01301F212F7C7764E31FDB7AE25C916D3BCEEA1A9655D165093AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744278, "uuid": "f5f4ce18-ec45-4d34-938e-d24f60b70f50", "value": "3072:eqRG9QktvUXvK89ZvKQ6FJEJK0wWsTOUBsClpGs:5Rbf1KQ6zOD0TBmoGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744278, "uuid": "e641ba9c-82fa-42b0-9fb1-723d23448182", "value": 184464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744278, "uuid": "2253a822-5dbd-40bb-a584-8d28ada97500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744278, "uuid": "fc2f3f55-1bc6-47b2-8617-6bd6bd4d165d", "value": "bin.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca378ac-45df-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777695998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695998, "uuid": "6bafb351-6943-45d1-87fc-806c79540c4b", "comment": "Malware payload (RustyStealer)", "value": "6c98b26c585eb06e969c52dad708a227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695998, "uuid": "a34b49f4-7719-405a-bde8-f4f7020f20c2", "comment": "Malware payload (RustyStealer)", "value": "0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695998, "uuid": "957f63ae-08a4-481d-83f2-e8d023e2d7ef", "comment": "Malware payload (RustyStealer)", "value": "016616281fbdd9f712cf41323b9df9b803904cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695998, "uuid": "95653040-ddd6-4b2e-8065-4874b300b4c7", "comment": "Malware payload (RustyStealer)", "value": "4635d4b735db11f9fc967413a8cf5c61b8849f64502673232fdfc369fb29f5f185ca9ae91c607b79db719af9adee7455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695998, "uuid": "cb8f6005-c038-4dfe-85aa-2410d72d7f85", "value": "T1C1A57C39B71082F2E64B81346A05A7C383BB7C7A375170FAA17E12D41E55A7A137E6F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695998, "uuid": "72c403a2-62a7-452d-ad64-4ad00295ef3b", "value": "7b4c7da1d5beca35620c2c8eb55ed765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695998, "uuid": "41916903-a677-4519-aab5-a2ebc651664c", "value": "24576:ZRBeLnWQgsTqsXJzOjwgJs/gsLFtodR+/qFHlFUgewGSkTfeBlRZV:ZRBeDnTq6kwkebc+SxzuwGSZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777695998, "uuid": "f2386145-b502-4ae6-99c5-06f55df9c564", "value": 2246656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777695998, "uuid": "7bc4def4-347b-4b8e-91dd-83786ac82db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695998, "uuid": "97b3383a-b91c-4068-adae-9398ed8a064f", "value": "audioeq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc0f06-4633-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777732390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732390, "uuid": "399866dc-be7d-4a64-afea-160e570f9c5c", "comment": "Malware payload", "value": "1676bcf1b22d3c1c503c8efee22d092a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732390, "uuid": "722b74cf-5955-4ee3-b096-9e325eb04041", "comment": "Malware payload", "value": "0c62ddaf24a9867c13157a6f3570a828dcd22d6954daa9cb1e19278e78091451", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732390, "uuid": "47799c6e-e774-47d7-8905-d4b2df5e2000", "comment": "Malware payload", "value": "f43fefb666b82adf2480b7c099bcecd6543e341e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732390, "uuid": "4881b1ac-757d-41db-a244-3013ab28fb85", "comment": "Malware payload", "value": "769e08660379487743f46162da9d4b247d5b4693eb8f39f882b44bb4b6f45d793333028bc6c8d7a35d1288c00d3b7443", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732390, "uuid": "84ed05ae-9867-421e-a8a1-fb1ca0a6014d", "value": "T11B8199AE72807CC9A81F923FE2F559B87B729730616F520C1A69B2D30943747D3954CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732390, "uuid": "9feee498-e599-4523-8030-faec023ce927", "value": "48:+HPmn6cQpR4xGIzY6IF6r0KXLb5CsglhTZD+/LqcFMk73SAhw+MhUWfkOTng461W:+Hg7xGA06r0KxCfK/TnhULMOTn7IVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732390, "uuid": "e0cb1734-82a3-4ae9-a149-dba5b88e1c3f", "value": 4199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732390, "uuid": "bbee2cdc-e0cc-4228-974d-5da5a81a529e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732390, "uuid": "1479cb4e-eddd-4988-8e08-50b5d39f9c1b", "value": "UvQO7fU.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dff30c0-461c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777722307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722307, "uuid": "849a6ae8-9de4-4764-a38b-7e0213eebd66", "comment": "Malware payload (Smoke Loader)", "value": "095c32757a1db06106df2c9d647cfee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722307, "uuid": "b9bb0d1f-50a0-4f96-9580-be65d955f31d", "comment": "Malware payload (Smoke Loader)", "value": "0c8653b27836eedf17e11a94a9af1f4bd9a49ba2b64fd51033240f3a2bdb1aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722307, "uuid": "6d64af69-4b90-4bbb-b305-b3cfd4206c41", "comment": "Malware payload (Smoke Loader)", "value": "096773528e455699892bbbb060c20d390d229399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722307, "uuid": "795f3fe6-f10e-4e2c-b6f2-446a7ec0299a", "comment": "Malware payload (Smoke Loader)", "value": "dfe58c7c160537d77c68fc73b66b6206c06c12f58076abead1b6832863664edbcb6e09793b3ca772bb2462a4e7caeb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722307, "uuid": "ff3d79c7-c4d0-4ad3-a3fa-6b12e50bb697", "value": "T18A6439CF32A7298DF51CF831C22225BDBFA6A4975D817BF6254003386E81D919D3A76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722307, "uuid": "d704072e-a694-408c-9c94-7c1b799e2335", "value": "1a2688e74e6d3cf5f1549b3185a5ab14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722307, "uuid": "502d661d-b904-4156-af8a-1047e5e7b57d", "value": "6144:wgiPa/RER9akxqWZGLh6PPqE/xTsAehOAPhG/u3lQPQZn5O7bzmb:wgii88SZaIeG/Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722307, "uuid": "19006e8d-8849-4246-923c-5f83b51d1d52", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722307, "uuid": "adc958b7-1933-42ca-90e4-3fec7b71ad84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722307, "uuid": "03c47bd9-91be-4804-97fe-1f0c6c31fd3f", "value": "nctsrn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa40341-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745736, "uuid": "aed58511-b345-4a01-9f3f-fc928b0199f8", "comment": "Malware payload (Mirai)", "value": "3eb7cfba52d7157dbb61bf34b6ea0290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745736, "uuid": "fd4d0b3c-ad92-405c-9ae1-d199554e867c", "comment": "Malware payload (Mirai)", "value": "0df758641eb16e734606d2a49b3da9e581410beabc90729982eafbf2ee52bf3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745736, "uuid": "9d510d3e-6ade-489c-a20b-578f0cf75cfe", "comment": "Malware payload (Mirai)", "value": "34887d9fa29a2ff89c1625de2ed5ff971d0c4fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745736, "uuid": "27a85d51-618e-4213-93d7-29885abe4f68", "comment": "Malware payload (Mirai)", "value": "8d836001c565ea2a8c870cbca9621da673f529546e4348c4d829d4f3547de0b47c3ec6c4207efe10ed8e728b1a32339f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745736, "uuid": "9ba98026-2f06-4677-a24b-8db7cdcb4e19", "value": "T178B2CF8DE5A17AD1C5BC5D3D738A07F08C80A1917BEE4BDDA315CC80A65D8CAB9A9078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745736, "uuid": "d41a820d-eb52-47b3-85b0-28ac9ba797b9", "value": "384:SDk7yhCymXR5UH2hC8g87QKZRROkLX10PZRolIM6j72oyRWGVCz0NvcA:K8JrUWhB7QKZRRH5S7XeWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745736, "uuid": "5f9921c2-f963-4251-9f7e-c1d539d227ad", "value": 25672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745736, "uuid": "a3639cc1-e06e-4533-8250-590430baf4e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745736, "uuid": "92200824-1bec-48fe-a0b5-dabaabf05010", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a764f9-4622-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724930, "uuid": "7df18933-1df1-49d5-b5fd-0f25f19d3c75", "comment": "Malware payload", "value": "d50f45d7ec9aabbfe33a90b911180166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724930, "uuid": "3c5e0ff6-d4c8-496b-b704-3548d09adbad", "comment": "Malware payload", "value": "0e49ebfe24be4612315db61b77090482d05df8f1916058d5e724473155d74f97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724930, "uuid": "346a84b7-431d-4ffa-ae82-584ec18f1cf2", "comment": "Malware payload", "value": "2e9c93770683065d5c940c6e9ff2b6a37f5a2d1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724930, "uuid": "0b36a7e0-b68d-4652-885c-469f52c0e3bf", "comment": "Malware payload", "value": "8226c3b1b347aae2ddc10245536c44d2b00c9027f0585b5fa51585f7076f20fc31791c8ae6c3e97f70a8979a0c07a152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724930, "uuid": "2db5bc30-0402-4150-8a87-876e93746c35", "value": "T12142B48552C1C95BC7E0937A4B6F8B6C7391D282CA8FAB1B924CC7443E6628C5F16B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724930, "uuid": "c9dde44c-c682-4280-ad3f-2962c56d0526", "value": "192:zhTj74KgXLXwfKqR7b2d6n4vLj3a1S9NkAMPQd:l74KgMKqOvPeONdM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724930, "uuid": "66b26463-bdf0-4c53-83c0-266baacee332", "value": 12742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724930, "uuid": "fde420d8-f9f0-480c-a9e8-9139dc2c20ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724930, "uuid": "31d51925-9da8-40b5-b6f4-41b7f93a738a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63b4cfd-464c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777743071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743071, "uuid": "2541ba6e-afe9-4a99-a83a-09e982522715", "comment": "Malware payload", "value": "4fe08c879a9a5dcacd35610727b07aa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743071, "uuid": "9d21764a-e501-4ceb-a955-31dc6a1c8313", "comment": "Malware payload", "value": "0ea2f56a3abb746c83b8db4ff4278c959bd053a6d33bcf4d757647d04c96765e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743071, "uuid": "9f05c1da-4fee-4027-9df6-fd7bd5968714", "comment": "Malware payload", "value": "c8aef539d333fd8034e9f225448fa56b57df58ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743071, "uuid": "b23ee6ef-f2b5-48d3-b7cd-2a38460a641c", "comment": "Malware payload", "value": "ba9d825f8c9d12537253c06095adba1b7696ac510569cccad2fac1152891ae954351e59749abb3f1e23b2057fecdd4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743071, "uuid": "f7a5e058-9efb-463b-8147-8330ac401ffc", "value": "T128C2E1E59099ADA3C903477781A47C17B0E0C85143FAC68AF2CC72D3BD8E05A6A39567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743071, "uuid": "2ac80d53-d08f-4a28-8c1f-d6db0d5c945b", "value": "384:M4soGLZJCKcNBMSWxDNnbEAnTyNgKBfvbtFNT5Ma5ZTyhyf83zckfgrLv1RQ:QJQ1NlW1lEAnTyNgKJVVMgoMk4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743071, "uuid": "d48b2540-dcff-46a3-b2aa-65daa01a68b0", "value": 26380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743071, "uuid": "022ac24c-3d3c-437f-80d8-a866dcb1c4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743071, "uuid": "607ffe02-8163-492a-82e3-aa4f3a58dc39", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbff2231-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736316, "uuid": "eb7ae685-de32-4f28-be80-2c9bc005a1fa", "comment": "Malware payload", "value": "4aad8bbbd7c16ff8ee140f10abb51be3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736316, "uuid": "d016a020-182e-4fd5-9398-67a2a4faceca", "comment": "Malware payload", "value": "0eee4e8bb6f098b28673e1baf9603a0ef787dc74f7bef33c7619ad43191f6225", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736316, "uuid": "4a9fd18f-36aa-455f-a106-393222b9275d", "comment": "Malware payload", "value": "72238bb9eebe808808f0829dd0b8788c2d057948", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736316, "uuid": "461c1d0c-32bd-4db9-b7d8-4991fb38143c", "comment": "Malware payload", "value": "a6e7729c338c29be27df784ccb8da7c386254cd234a95cd67ab5a8d02adfe038e278e6a2430343c19f74f234c22b6459", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736316, "uuid": "83c23907-5079-4b9b-9c10-6e515f48b62c", "value": "T1C5761957B8924942C4E43A37B8BE81C432630EBA8BC7165B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736316, "uuid": "b8154a96-38b3-482f-8dc0-bf5e1ef89d08", "value": "49152:VagRD+x5fl0OVbZyGENsVhsPWMqaO7DBBJtTpiB+MuO5EB:V/Dol0OVbZyGENsRb7JtdiB++EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736316, "uuid": "8dc05bb7-ce43-477d-b8c0-18ef5b2f6c88", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736316, "uuid": "43a57c9c-157e-4e3e-8b24-6847b1ac3ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736316, "uuid": "e58b5dc1-4f9b-41d5-9829-438c077a44d2", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e20173-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777697700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697700, "uuid": "9874d5f7-fe34-4be2-8425-94f61514d18d", "comment": "Malware payload (Smoke Loader)", "value": "2c8e79969cc426f5f90c0eeb8b5349a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697700, "uuid": "bd88c737-a937-4a24-bfca-dfe3c4c47b86", "comment": "Malware payload (Smoke Loader)", "value": "105987492bef48ec9dce03ad6ada29ce8d3b71622cd8110e75f6aa6d55f24538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697700, "uuid": "0a692e81-436f-47c6-9f96-1de411d40040", "comment": "Malware payload (Smoke Loader)", "value": "32e4bca242d6b071eece71b732138a6e73158b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697700, "uuid": "8efec9b3-b348-4f68-b345-8f4472e6592f", "comment": "Malware payload (Smoke Loader)", "value": "19af6cc52bde22bd61d33b45bd1c1a1c2f19090e4c6ffd4ff1b59a91cdcaa24a31b80cd3c7a610cdb2032d5f95a390a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697700, "uuid": "448fcd1d-f75d-4af5-a2c7-b1c57838a24e", "value": "T10174E067B2A630F8E067C639C8500A06E772783257A09FEF076446567F233D1AD39F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697700, "uuid": "b3ec80b3-30fd-45dd-8dff-e2d552cf956f", "value": "75c410d3cdd17cf4a33ccaf94384484f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697700, "uuid": "c7832359-4923-4877-8cb4-c4c15b6421a1", "value": "6144:GK6wbPAIbVKkcYZz6qnu3KozpOGe8vsVYL2QbCXsQruhuSr0u:GBwbZbzruvRaQ6XrLSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697700, "uuid": "8fae52f1-e2d7-47be-b3cc-573b049dd0d4", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697700, "uuid": "1f08f19b-83b9-456e-a8b1-d9a247a0a10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697700, "uuid": "2c8ea30b-54ed-4aa2-958b-56f60aa6065c", "value": "nctsrn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1b1bda-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777697719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697719, "uuid": "5e21c955-cfcf-4ef3-90a6-227346fd2704", "comment": "Malware payload (Smoke Loader)", "value": "800768153601e6261bcf573cc23d145a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697719, "uuid": "c1c559a2-4dc0-48d4-8b0f-e94d20a277c7", "comment": "Malware payload (Smoke Loader)", "value": "11e8084e7792e38c432e041b5b0e4341cbd21c97e050ab2739e77e7fe30d0d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697719, "uuid": "48e6a40c-12d1-4141-ac9d-ae490d460811", "comment": "Malware payload (Smoke Loader)", "value": "0b7a16e29da0d24a5bc570131aaa836f31d2a77f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697719, "uuid": "47357878-e7f3-43a3-8641-a6e6c1a0a03e", "comment": "Malware payload (Smoke Loader)", "value": "28489d9b6c846400771ef032f8180eaad7f2b127fca9cc195bde957e559e36ca7e69a6d9fb7886de9b8017b50c96c694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697719, "uuid": "0c8c45ef-4636-4b3c-b079-457ce84fe5fd", "value": "T10C134C9673E15A91FC234A72D1E9CB7BE670B84371321E0F1360E72B2F625136924E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697719, "uuid": "602c594b-318c-4dcf-b4d8-f42e2346267e", "value": "613b892e1a546badf626e9ec74dce9f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697719, "uuid": "ce63f977-9b26-4454-84dc-2d8df6c81815", "value": "768:V5zJi936rNZu1VVTls7FQFNYhJMI0ZA52aKtp9qg03z8bxK2s1YyC:309KrNZu1psuzpRza2r0KxhyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697719, "uuid": "7671b712-4035-4dbe-9f18-082bb58701fa", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697719, "uuid": "a09850cb-0ec5-4864-8442-d2e4c26c1649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697719, "uuid": "8175bcca-1f2d-408f-a24a-e7f98626f44d", "value": "WinUpdateHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee30006-4649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777741690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741690, "uuid": "8f2ab1ca-6ddd-4a03-845e-e118076003da", "comment": "Malware payload", "value": "57a06a4446171a01f7cb336e56c7b428", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741690, "uuid": "a7424ac3-d4c2-4611-afe1-beddf333a901", "comment": "Malware payload", "value": "128c332d1be99551d813a7aa847b7dafb4860ed9a1737312c1521154d23f772c", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741690, "uuid": "f8400456-389c-414b-84bd-2a2cbb2a2f38", "comment": "Malware payload", "value": "9464439cae707b8b7c2efbe066964c737468e310", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741690, "uuid": "be4c0c06-b0fc-47fb-9846-1cb665c75652", "comment": "Malware payload", "value": "cac8f0a326da235e697d962c1397936be1885871999370f688a843dcf2d7951429a4b3df454752d83451749666e25691", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741690, "uuid": "a64fd299-d851-4a43-b82f-abd508fea8db", "value": "T17C46E101B3E695B6D1BF0638D87A56696774BC049312CBBF5394BD392E32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741690, "uuid": "f31b1777-794a-40c8-a4b9-6429824c59b4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741690, "uuid": "5fcf7f72-3ac2-4829-9b9f-13e0d199f22b", "value": "98304:xzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:xhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741690, "uuid": "726517cb-ceb0-4077-9e3a-b44d2c894f0b", "value": 5678304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741690, "uuid": "f964b9b2-f9b4-42eb-b348-62e11429ae21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741690, "uuid": "15f3f10b-3912-4f0f-aec2-5de5415b03cb", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a800fe-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736633, "uuid": "ad4c2daa-ec5a-4937-907e-95605e370d63", "comment": "Malware payload (Mirai)", "value": "db4e1a73eebf9d074b7b970a91210f70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736633, "uuid": "ffce3c7b-0b67-4c07-ae99-98d9f30a79a2", "comment": "Malware payload (Mirai)", "value": "12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736633, "uuid": "62cd56d3-6665-4ba9-b85a-d79ca6da3de1", "comment": "Malware payload (Mirai)", "value": "7fa63c04fc6a7a7843a98ba74c40e96037f2ed4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736633, "uuid": "4f8306ba-708d-466d-b953-21659f45ce09", "comment": "Malware payload (Mirai)", "value": "afe41eba5ec96f46ae8b73ebb8f3d3d9c253374bc7a374367e24a0c519bb7326382d010a21f577f79b5fe65be3a40540", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736633, "uuid": "50532d79-e7d3-4e3e-b4c0-e43ac037d7f6", "value": "T11431F9C5135145F93DE6ADEBB9A58A0473A070A56CC1BE8CACD83CF9858DE1D3044E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736633, "uuid": "bd1fbbaa-1fe6-4504-ad94-29024185a275", "value": "12:q0FV3+L3Kg0FV3JL3Y9g0FV39iL3+a6g0FV3jexL3jed7/g0FV3nLL3DWg0FV3LD:v1kvDN3NM67JYVz1adFnOtzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736633, "uuid": "6e979a1f-fbbb-4299-830b-5f2dc7dc6da0", "value": 1783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736633, "uuid": "51cd2c57-e43b-4243-bbfb-cf829821a952", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736633, "uuid": "761a3452-3a10-4381-9570-099df3a38de2", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da708b6-45be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777681907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681907, "uuid": "0797e7b5-531e-4551-9191-e2328d352ecf", "comment": "Malware payload (Mirai)", "value": "4b37918900c81fcfff2aee0c4f05864c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681907, "uuid": "af8698f1-14f9-4914-9881-b474e2900c31", "comment": "Malware payload (Mirai)", "value": "1336bfac8500a7bd7d6471d7c068f71d6a7cd93d6ac9c7c1856c02e56fbd01ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681907, "uuid": "332cee36-72ef-4720-834d-2c45c35871bb", "comment": "Malware payload (Mirai)", "value": "d01d52fd977f351039d36919d7133d1d63ac01b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681907, "uuid": "9778fe45-f035-4d74-a186-8b5b877ae8c2", "comment": "Malware payload (Mirai)", "value": "b0fb91fd7bea31201d5b694c5eaf359f109606f27b235833129894d1970500ff258f518576886fd5bd2cf0de80db0fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681907, "uuid": "42ee61a1-a8d9-4d30-b4e6-c9f91f1fb3cb", "value": "T10514965E6F228F7DF668863447B74E25975C23D627E1D681E1ACC2102E6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681907, "uuid": "95f4f09b-b6ef-49fc-a592-261995aca734", "value": "3072:ryio8wbMt0dAoMKZfgXThuFS+zAUQVdOgOOTTve8yO/twg:i8AzdAoMwksSpPOOverO/twg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777681907, "uuid": "ab2bd0d1-95c5-4d39-9ff2-cc7ebaad3956", "value": 195152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777681907, "uuid": "7c46eff9-ce7b-45c9-98cc-8d4790ec685e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681907, "uuid": "cae87446-a39f-4d87-8d2e-8df983071bf6", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd20b16-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719223, "uuid": "25a2852b-67cc-454c-989f-8234d333a26f", "comment": "Malware payload (Mirai)", "value": "f20fa92dc5ae7350283b4dd841151155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719223, "uuid": "fb69b19f-a668-40f9-a91f-f6e7d9a25881", "comment": "Malware payload (Mirai)", "value": "1348087a6d4103d3da278387dffcb8ae900dec28970bc3239ee565363ec3b017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719223, "uuid": "827621cc-d9d0-4d1f-b420-d5675fd461b9", "comment": "Malware payload (Mirai)", "value": "d29f0f8c8a9bcdb10abea661c13f9c8bfb098b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719223, "uuid": "7eb98cdf-df2a-4249-a32c-68dec72ea818", "comment": "Malware payload (Mirai)", "value": "eb873a871fb7728e9b1b7f3cb4763e0de6046b48c3dfa7d494ce4cb93342567876c9724a80737667b51459ee7c9fe7d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719223, "uuid": "668ce8d9-d5ee-47e6-891c-af942c663055", "value": "T1FE84A653D91688A5F0245CB312273241B84697BB48E726E3FE6B1962FF3541F41BBEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719223, "uuid": "b8835d24-3473-4bd3-a61a-323977a00ce1", "value": "3072:2TgUtjVDygCgp4GBwFjyN3sENnn8egfXIcVKjbiJLyfQPyXp3yf3D8MJGBRqb:bUtEsEjyN8EG3fXIyLy2yXcfRG/qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719223, "uuid": "2d66bd32-8623-4ba0-ac16-376284494761", "value": 390048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719223, "uuid": "213953a5-a4a7-40f5-8b43-54c5e2fe4a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719223, "uuid": "37e53819-f8df-4cf3-8462-343833b5c18b", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2bba8b-45c5-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777685022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777685022, "uuid": "c030a0f2-fd8c-4eb5-bc45-5dda5edd754a", "comment": "Malware payload (SheetRAT)", "value": "453a5ff7ffad8d6e88106587a92272cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777685022, "uuid": "0ba3dd28-4b69-454c-b348-800dc7726ced", "comment": "Malware payload (SheetRAT)", "value": "13b4c3e29edccf923528844fed7bc032f02cdd310d7ad53ed209cf7381bdeb38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777685022, "uuid": "e767ae91-e5a3-4d54-a189-ad73ec2e4343", "comment": "Malware payload (SheetRAT)", "value": "0aff8e72790fc1987a6008737544cfcd576a20f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777685022, "uuid": "f46188b0-4d5c-403e-9b63-ec87f58f3922", "comment": "Malware payload (SheetRAT)", "value": "1262917a66968f623f650de48bf0de8641f1613503fbce48fdbef1aae4bd055a5df766927e5aac505ca59f9e01dba56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777685022, "uuid": "1e69f151-6b37-482a-a141-2f3e5a77f0aa", "value": "T1E2F4E1A8ABA38C03D5D30A7016A3F3F492B8BDCD94229717EBEF9C737D1E6165451290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777685022, "uuid": "b4c88534-b827-46b8-85b2-bc8d51f2218b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777685022, "uuid": "3f6796e1-e335-446b-aa96-1d6729a47820", "value": "3072:9KEtn0tLylviaUkeWxqZPCC2EKzXMgTQL1h01Q9RRX4NQMwxB879ciG/NimD0jDo:Hd3ve67vXMr01LNsDuHm0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777685022, "uuid": "5597a6cc-6672-4c80-9916-7ddc18e1ff0d", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777685022, "uuid": "19d20d39-2ca7-46cf-8d43-3c08a2a886e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777685022, "uuid": "3f925248-80d0-4cf2-8fc0-2d325d2e7675", "value": "NEWFIZER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2deea54-466b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777756460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756460, "uuid": "78553ccc-7ef6-4bda-bf7f-85e17480b1e5", "comment": "Malware payload", "value": "b7bcde8f207cb9ea2e93d5da19293be6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756460, "uuid": "e2cfe22e-a5bf-4c39-8442-13ec8cac296a", "comment": "Malware payload", "value": "13e78dc4766a2a9d166610492f6ff0f4ed185bf43ddd5fdeac6623ec34a25014", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756460, "uuid": "8c81d8a7-14db-4b31-add2-4d7d21c78f89", "comment": "Malware payload", "value": "067653fe9045e061a5e05425d9083e271cf48284", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756460, "uuid": "d4f77ab9-1834-4ea1-8c62-f6f164d69c69", "comment": "Malware payload", "value": "7a89790d8372b4a2860abd2b081c66a6c5136280f902450a98d74e5ebf326494e392efd8c473acd7d26d4913e541020d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756460, "uuid": "9c4ed65d-522b-48b4-aead-08baa9100b87", "value": "T143511ECEF15205F0AC70E55736F4D454B6C5A1CE52C66F5C3CDEBBE9809DD883A01AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756460, "uuid": "c65c3898-03d6-4183-a2dd-195c97bd6ad3", "value": "24:1m02d470Zab7tgnO7qjkx7VLlBHlLv+l410/y7B5FqN/oCDsxuLScz:1FRxdVxBlLv+l45BuumsxuLSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777756460, "uuid": "a9310867-3f5f-4d22-ab3e-c8b88383b19d", "value": 2503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777756460, "uuid": "7365d77d-16a1-4c16-9f18-41bde04ccf22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756460, "uuid": "64303f1b-75ea-4d2a-8a3b-64cd5b3a5185", "value": "SnOoPy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcecc47-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766115, "uuid": "c35c3c10-768c-4494-977d-28ebc6d769fc", "comment": "Malware payload (Mirai)", "value": "8ecadb0a310fc1a6f7e92babf895bb66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766115, "uuid": "32d92adf-834f-44c8-901b-d89d03b5b3e5", "comment": "Malware payload (Mirai)", "value": "1509ae71b8df2481e5db854e7590142c82bced7ec271a9e0afd7724cfe705d55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766115, "uuid": "2124a416-4d46-4e65-b8b5-fb4903f10b1c", "comment": "Malware payload (Mirai)", "value": "73971e16e2bbf465414ef7a33bfc4b00b847f5c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766115, "uuid": "3b2447c8-8447-4ea9-aa03-f357dbce382a", "comment": "Malware payload (Mirai)", "value": "863634b7a17715f9d60dd63cb933e65e0dc28b97bafa1cdf3ffe750564ae7a91f3ed813344b7c24a446cfb98da2ca702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766115, "uuid": "e1a568b7-fe3b-453d-b178-83159f9461c4", "value": "T192E34A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766115, "uuid": "e832df93-abea-48ca-9200-4fe7d4702cc4", "value": "3072:ENUkePbhroLLyLbPDADuOu1sya89LjPEKe2+IOkE:weRoLLynPD2u6yawpe2AkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766115, "uuid": "cadf19d4-c4fa-4f66-be9c-9ed19ead8c19", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766115, "uuid": "47fd9ced-0cd1-4fd6-97e0-c2c1a848517f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766115, "uuid": "a49f5dbd-5163-4c36-8905-1e18fedd50ac", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc090f8-464f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744157, "uuid": "2912df0a-3fa2-4861-b9e0-76c450baf7df", "comment": "Malware payload", "value": "27eb02ea967e5320668dcca4a498b420", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744157, "uuid": "44b1f2b0-9ff3-4944-94e9-4c36db442ad6", "comment": "Malware payload", "value": "1548b15c5b00c90ac5573edcf2a52ba3ce2bd140271e1850aa138f70546ea0cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744157, "uuid": "1e8d9fff-5cf6-4157-b554-62a5288dace6", "comment": "Malware payload", "value": "711faf04e90ab95f83229ec1776b27fd83dd6571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744157, "uuid": "742c563d-601a-4a58-8d5d-73fa14ef3b09", "comment": "Malware payload", "value": "ea75155fe8b18a84695af12f4d162732caf6a759a2f6fd1a243a0070ba3aab709821b1abea8f55e0c6ed901c6ac57c97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744157, "uuid": "dc34ae75-6e1f-42f3-853f-dea6be6fa4e2", "value": "T17A763B87B8924952C4E43A37BCBE81C432634EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744157, "uuid": "c2a0c2c9-8daa-409d-a764-6ec2b9e4bf26", "value": "49152:G5xNekq7aBHAYP59wlLVmCveTH2mkGG6pU+5cO78gyqo5E+:QNu7s9h9wlLVmCveNcO78zqaE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744157, "uuid": "51bc4104-a991-4ceb-82c7-2ea4329a59bf", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744157, "uuid": "94ef8101-3a2a-4f63-9fb0-f58849fe5941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744157, "uuid": "0e752079-8826-4af3-8b9f-0bbde989ea95", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705280ac-4659-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777748537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748537, "uuid": "b9e440aa-97e3-41df-84f1-4047f90e6d44", "comment": "Malware payload (Mirai)", "value": "d8d0f2e8e399d929ebad47686b56dbff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748537, "uuid": "9a587b4b-28f8-4bb3-a8d9-a9967b463b1e", "comment": "Malware payload (Mirai)", "value": "17319c1d92cf05c629e417974ab538a8ef6f2bdb933fefa002fce6db4e76d46b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748537, "uuid": "04c3ecc2-df9d-449f-af35-149ac8b4c42a", "comment": "Malware payload (Mirai)", "value": "d8c8f7b54f91b2c6eb8ad49adaa22e6d4e015f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748537, "uuid": "1f4bd196-3d43-44dc-bfe5-31f771877dc7", "comment": "Malware payload (Mirai)", "value": "68a8a6e77612cb3921cf3569728c76e9e8ee303bc5680e6263b472d13791ca8aad93bfa361d1dba6feaab0ae53f69eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748537, "uuid": "bd2dc566-8860-4487-a5da-44b4fcd0f118", "value": "T17714F946BD518F23C5C311FBFB9E429C3B2667A8D2EB3102DD257FA437864DA093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748537, "uuid": "dd042ed1-d3eb-40ca-8a3c-6c17d5d9aab3", "value": "3072:NYAAfM7MbbuAAWZbPBKjTWxTTH6C8ay9F+XXjAjyji7nGUFLU:NYAAc0bU2bP0SxTTaC8ayv+jAjyjyFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748537, "uuid": "bfaac0d0-1022-4e12-a758-84e17265b0a3", "value": 206236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748537, "uuid": "65b465ba-03d3-4211-beb0-7fa51e25b358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748537, "uuid": "92b1e22d-6f82-49ff-9849-e83d179f4606", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea54bff-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777682794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682794, "uuid": "02873161-799a-4ba4-8fd1-9094c1324ecf", "comment": "Malware payload (njrat)", "value": "f67beb614be415fc0234aa0054674538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682794, "uuid": "29e19843-5ece-4f90-8c4a-d6d0cedc4fd6", "comment": "Malware payload (njrat)", "value": "178bd33fc4ebd0db8492e27f8cf07add647d0af99d01ca09f2d15006431568e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682794, "uuid": "0c059f6e-b26a-4172-9fd6-6ad05c34d669", "comment": "Malware payload (njrat)", "value": "b1f85ea66eab6134e94906dc8ee1950d1db3fd90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682794, "uuid": "560181c3-81de-4af6-a361-6d2e60846a92", "comment": "Malware payload (njrat)", "value": "d995cdc166ba10a0b93251326c0a6db148e7e0469cc0d22945dfcf6786d672ee40872d77bac2c4d158e36005bb5d23b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682794, "uuid": "a6ddd9e1-8ecd-45c9-9b49-67c431b971d6", "value": "T1A593E84977E56524E0BF56F75871F2404E34B48B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682794, "uuid": "31f1519b-4ff5-469f-8d84-013d2185e126", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682794, "uuid": "917276ef-f6af-405d-8eae-2f2924105b87", "value": "1536:qSy1GkeUqZJO5wNSimjEwzGi1dDODugS:qSdUqZJOeAOi1dIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682794, "uuid": "0fc44cb0-a2fb-4a74-af6b-3c394ada25f6", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682794, "uuid": "09ae3904-a570-4774-915c-ade922ac9ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682794, "uuid": "ed34cde5-60df-4f0a-b6a1-c7f400c1ce00", "value": "\u0432\u043e\u0437\u0434\u0443\u0448\u043d\u044b\u0439 \u0447\u043b\u0435\u043d\u0438\u043a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48da7a04-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719265, "uuid": "a6885ff2-5c53-45b6-9157-25141fc704d2", "comment": "Malware payload (Mirai)", "value": "6169248064953f9f5470fa7f1a32e9a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719265, "uuid": "998e4cc3-6bc7-47ed-952d-4e5436e144ef", "comment": "Malware payload (Mirai)", "value": "1959becb44884f50c3272232534420650623dc887ad898e2faf25e22d92a4350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719265, "uuid": "6558bb80-b5bc-4916-94c5-c1dfcd667a1b", "comment": "Malware payload (Mirai)", "value": "3e3c28c2d7848c13a1b32c65260f94ed3b6e0995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719265, "uuid": "5ff79692-79b6-49ae-bf52-6721ade66f5f", "comment": "Malware payload (Mirai)", "value": "2967d5a9c8e815579f9479aa106a4563ccf86260f3581c2f057b12ca2b51107ae581348f519f4a7a296d69464801f368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719265, "uuid": "b73f88f7-2010-4fa5-a5d7-82072312166d", "value": "T121845413D9118991E5644CF2222B3285B94787BFC5EB32D3ED164AA1FF2582F42BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719265, "uuid": "749c6adb-3fe3-441b-b547-913c7ecce186", "value": "3072:gAI5b3e+gmf/X5/wvMzDEwa/ubXBqjG9h6GkZ+joCORT:zI5HgYX1kMnpagAjG/6GkojoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719265, "uuid": "2aaa8f2d-c81d-4c5b-b782-3a0dc4dcd180", "value": 388604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719265, "uuid": "a7ba8c71-9915-4c06-94eb-81e80c7ebd1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719265, "uuid": "daa3eade-5e18-4fa1-a5d7-6afa7e95a7ad", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c5056e-464c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777742832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742832, "uuid": "a99cb68c-d85e-456b-9bcf-00ca2c098261", "comment": "Malware payload", "value": "c6138563352ff8a817faaadcde0ed5cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742832, "uuid": "9bbefa78-e81e-458e-b987-643f39f66fdc", "comment": "Malware payload", "value": "1a454f0847fd8061f42284cbe220f062626475af090c1b576b4b85092e617235", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742832, "uuid": "76af15f4-b2d6-4db6-b613-cbb614cae0d6", "comment": "Malware payload", "value": "fa7c2ddda521f6b95a2959acb0ec4b6459066429", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742832, "uuid": "ed8be300-be43-4372-b790-9148b921c3bd", "comment": "Malware payload", "value": "06678c8ef42a74d84f7268623b88f52ba1678d9c49614a81b15a224ac878fd83bdcc9c7a888b04794d0d4563aab0bad2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742832, "uuid": "4da57eac-96ac-43f3-8f9c-37fe351ba568", "value": "T1D0137D6526953C25AE99883B5C7F2F0CB9A983E1304891DDBFCA3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742832, "uuid": "bc56950e-04e5-4ab8-84a2-c5ccebdad8d0", "value": "768:bJs9NyXsZztCoto9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b+HusZzt1cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777742832, "uuid": "eadb7e77-d85c-4af3-be36-e20c047cabc4", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777742832, "uuid": "25528ac3-952f-4e4f-b4d8-c84600f296a3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742832, "uuid": "c482b37b-89c8-4d08-b9d6-06cee77dd973", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3084f5ce-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719224, "uuid": "f55c6c75-750e-4928-b863-2856a54c60d7", "comment": "Malware payload (Mirai)", "value": "3138ea37b8c5e3af28d8a4fbf14a12e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719224, "uuid": "0daac4d9-ab39-4350-9863-799b4dfc74b3", "comment": "Malware payload (Mirai)", "value": "1a5c1eac4c1108ae9c991ccbac5bcd572fba118a40ddaaf4ed022a6280cd03b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719224, "uuid": "7ede1799-5890-43e0-98e3-0bdae178a5b9", "comment": "Malware payload (Mirai)", "value": "7d9566afeb73e6ee8c1e3a3918af87e1b03a76d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719224, "uuid": "71c3b118-0800-44eb-b294-68d6d317b91f", "comment": "Malware payload (Mirai)", "value": "c374bb5c6ac0cdb43a9192d8e489d939aad8bbd8c77e86304ceb495c0e584fe3f30fc4129abaf19dd18c412c21cf9e53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719224, "uuid": "9698d6d4-4e99-4479-a0e7-bd94e9bd4b27", "value": "T12D7302BE551B8D78D03709B33F9253CEED363C7D691347AB0272A4BC6EA268A30B1450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719224, "uuid": "181272e0-8196-4ae4-a720-24776534e641", "value": "1536:Rcl4irg9wLxpkOaIRF2sKWacx0DfDEknuBU1MvJrizT7:Rcl4ir2oxpkDQQsN3ouSavuT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719224, "uuid": "1c5bf411-0b0c-4047-9367-e7405baaaf87", "value": 77640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719224, "uuid": "5547a75b-6929-474b-bdcf-20f82454d5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719224, "uuid": "0cc55293-48f7-4f89-9775-d20c78628e0c", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb22bf25-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704961, "uuid": "ac5de816-3b6e-45db-8022-4c8ba6c7b5ac", "comment": "Malware payload (Gafgyt)", "value": "2f9cb570c68a7d34b16a9d50311c220c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704961, "uuid": "943659cc-f6e9-49ad-beb0-b9bc91c94c40", "comment": "Malware payload (Gafgyt)", "value": "1a76ff8d2e66e7a99dfdc97ccd448f89dd90973a41ea9e9d3ebbcf05d1c1fe08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704961, "uuid": "dd98cd47-c82e-4081-9e0a-998ec8915bd4", "comment": "Malware payload (Gafgyt)", "value": "54ab9541304da8c56abeaa69559e1e87aef3e47e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704961, "uuid": "410cf57a-9026-49f9-944b-729ca164420e", "comment": "Malware payload (Gafgyt)", "value": "3265d532ce8c926eff9dbdc6c0ae1606ba663516433a2d85a448c93a7addcc9a2fc4e422bff0cb9c9c1e6db83cf3160f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704961, "uuid": "0c807ff5-596f-4c51-8215-b800abc2dd92", "value": "T1C6B31A037B0E0B83D1533DF02A7F2BF1979AFEE215A5A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704961, "uuid": "4927d643-cc51-4bdd-8730-904d8ed83a96", "value": "3072:5TbSGHdVzg8+/PL7ojKcXkmNG605d5h9pA3:5TbNEL7eKh8G6S5hw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704961, "uuid": "e535a80f-fc0f-4f43-9497-8967d184be38", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704961, "uuid": "c6ea929c-af3f-4f06-8767-dc73a2276f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704961, "uuid": "f568f76e-c107-4292-9dec-afd568b29dc2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c39d9cb-4613-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777718304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718304, "uuid": "bf83270c-ebd4-4f75-8a46-3f2862845c9b", "comment": "Malware payload", "value": "963136726d10faab6a565deef1a8cee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718304, "uuid": "eb28a6d4-2d3d-4073-bf6f-4e9f119896b8", "comment": "Malware payload", "value": "1ad3bc6b4146ce44122b7196bea46ace55fa7dfae2182d91d12b15ceb40d1f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718304, "uuid": "d9ceff55-5e9f-4fa1-bb38-509176af21ea", "comment": "Malware payload", "value": "5d83338b0c72be8e4fd73a57c37087a7833ef2bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718304, "uuid": "2045f11f-a927-4512-af11-2ebd01d54d41", "comment": "Malware payload", "value": "d4b6895432da213d5118cfa2b0c89d9e0e5fefd8bb46cf9e4e037289bed1fb49871457c1de00a224e963ac77ecfb06d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718304, "uuid": "0a407fc8-b79c-49ac-baac-adbbf1fe65c1", "value": "T11542B68182C2CD67C6D0937A5B6F8B7C33529281CB4FB717924CAA582D663CC5F1EE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718304, "uuid": "c4bcd848-1a8a-441b-ae52-9efdb02a98b6", "value": "192:ToTlKxlSAvLXY3KqRjb2F+dviESELs9jJAMAG8aJ7E9LQd:TIl6SA0KCTviESELsdJAMp8g7E9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777718304, "uuid": "c5037be4-b8ae-4940-a6ef-ed55989ca2b7", "value": 12875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777718304, "uuid": "dd564baf-7e97-494b-8e6b-e3818ab41cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718304, "uuid": "9626017a-f837-4053-862e-44934c4f0d27", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cf2298-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743310, "uuid": "5698c88f-0a4d-497d-a574-62c2ca491f61", "comment": "Malware payload (ConnectWise)", "value": "739bb631582f73c392767b008385336f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743310, "uuid": "b2e8050a-ea2a-4de7-9d0b-3954a6970b26", "comment": "Malware payload (ConnectWise)", "value": "1b3ad8b0acf42ecad2cedb315d81405b87ae3d6a57095ae969ce75664efebb23", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743310, "uuid": "8f70d509-437b-4785-87ae-9796102c7366", "comment": "Malware payload (ConnectWise)", "value": "898562778c7e9041b0fd755a13651f35d2a7d450", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743310, "uuid": "3f0206e1-0790-4761-a298-5bf64d66f0f2", "comment": "Malware payload (ConnectWise)", "value": "8e917df27411f7e0f4ae1e668676b74332786d1f3ca250c34eb95f7f9ae0ca27846dc5ac80bacc18ff3a772c5ce515f1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743310, "uuid": "d7214e96-cadd-42c8-8f21-2f856ce08e2b", "value": "T12C837C43B5D19871E9721D3118B1C9A15E3FBA211E348EBB239802AE5F741D0AE35F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743310, "uuid": "ab28c3fc-67b9-448c-a637-8013dcbde7db", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743310, "uuid": "472b1c0c-82cb-4c24-b9b3-33b698634094", "value": "1536:VXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHiS:lE3x5KBDYiKWm/iSw0fRMvygeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743310, "uuid": "d795ae65-4948-4599-80a0-781266546dcd", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743310, "uuid": "57e56854-af32-403f-a3af-7fccfe6343b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743310, "uuid": "3f08b97f-b272-404a-9280-3112fe0124e2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3452fde-4612-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777718262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718262, "uuid": "a93a7aec-0273-468f-b376-9ac062eb9e68", "comment": "Malware payload", "value": "c4ec018039322fd852787171b39b5d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718262, "uuid": "c22ab5dd-7288-4602-ab8b-0b80aa30f719", "comment": "Malware payload", "value": "1bbef41df81c8c9a92621423b93ad4bda2ca5c4633b296561080778824ef5796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718262, "uuid": "31b612f6-00e3-4ce3-9713-19081b1d0dd8", "comment": "Malware payload", "value": "407999092db48dfdbe3318d71240228fd90a23ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777718262, "uuid": "b5e06498-e9cb-4912-ad4e-239d657fb07a", "comment": "Malware payload", "value": "2e6f89645e3d7ac4329290e067458ffe91f2c9da4a4d8e07305b50adad34095d4d943f713c08949dec3473ada197f430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718262, "uuid": "335aa229-7269-4a7b-be4d-3ba04d79fe7f", "value": "T1E802AFF715214291E62882351271B9F7FCB636F23CFD4023026B2D54349645F9F1A9B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718262, "uuid": "b29d6fd8-f77f-40aa-9c2a-d590d05a91f2", "value": "192:6XuhUi9jNGMxiQtoRA4UhXK7CpAcpW191PoTjmX72IO0jLBlXUxo:6XuhrH7rDha7CprpW195oTG/O0jLExo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777718262, "uuid": "67bb29df-0754-494b-ab41-a815bdac0198", "value": 8208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777718262, "uuid": "e068d42c-ce55-42d5-9d61-3956409dd584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777718262, "uuid": "baabd2e1-19b3-4607-b449-10c76fae3eb5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6645bdb4-4605-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777712442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712442, "uuid": "6f3a5d33-0bf3-4e54-b723-5a87a7152af7", "comment": "Malware payload", "value": "cc9cff6d92a5d5f8cdb995e258c6acaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712442, "uuid": "1391a238-0588-4c1c-a8bc-d83267fd3f92", "comment": "Malware payload", "value": "1bcd7ede09c26442938d4c1ef237472bdbf2f3b3be5d752747ece4c5306f2918", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712442, "uuid": "3934eab5-6980-4418-af52-de38db022feb", "comment": "Malware payload", "value": "0b6372b87d6afaefc8a00a7f8dd0fb779631ddc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777712442, "uuid": "579035b6-15ec-44d0-868e-1986214c58e1", "comment": "Malware payload", "value": "b0dedd0ae778c67183a276600b5b8e920ed055475a7175d735ac431e815ee9da9213f01a2f8ab41b7c29f4b66e129751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712442, "uuid": "5fe2faa6-ca63-4f3f-a998-965e5fc72d5b", "value": "T1E1968CB3945224D8E1A9C9B4D51416527DB83C8B573873C7BAC472F61BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712442, "uuid": "6119ec70-059a-4318-aa4d-4ab2a7287e34", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQW:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777712442, "uuid": "68b74df4-2407-4b22-b3b6-89c6a7d28762", "value": 9306112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777712442, "uuid": "5bdbd795-f19f-452c-8bc4-bcd76b9e5acb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777712442, "uuid": "bed17112-bebb-43dc-b7f5-617abf073a10", "value": "1bcd7ede09c26442938d4c1ef237472bdbf2f3b3be5d752747ece4c5306f2918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e85c85-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777706114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706114, "uuid": "dbb97c22-7659-4a41-905c-4e7ecf2f31d0", "comment": "Malware payload (NanoCore)", "value": "b4f750b1860635dced91b274612e08e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706114, "uuid": "e1d026df-db18-4f84-b87e-a03fccc14a89", "comment": "Malware payload (NanoCore)", "value": "1bceacd39e0ef95d6acb852910a9a591045759fa2435a391dfaa50ef203e4ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706114, "uuid": "d1eea84f-fa9b-43ef-ad36-53938a27a43c", "comment": "Malware payload (NanoCore)", "value": "de6cb4ec10a77825b6ac0051b4498419176bcfa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706114, "uuid": "d9cfc104-9cfb-4d2e-a4be-99a870e84ebd", "comment": "Malware payload (NanoCore)", "value": "bde745c6a46905aa9f4d3b70324d239f53e89151fa76c3366c48a9254a5044a8b9139ac6e374ee4619a5de00d56d1f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706114, "uuid": "e0a9cb2d-8ff6-4b31-bde0-10342268f49d", "value": "T13F14C01677E98A3FE2DE86B9611201524379C2E39DD3F3DA28D414B38B663E50A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706114, "uuid": "11da8402-6e23-4d05-8b19-d8fc05dbc44e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706114, "uuid": "17ec11b8-9de7-4a43-840c-d3d3d85b7333", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIf9O1RxN+dAu8imqhVPd63DfOx:MLV6Bta6dtJmakIM5+wC86hV1UfUgrT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706114, "uuid": "b2252614-6f32-4443-88fa-8c81427db298", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706114, "uuid": "c0006d2a-89f5-41cb-8f4d-99fec6f9f45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706114, "uuid": "5a4694eb-2cf2-48fc-bb8e-24e4ca97cc93", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f631be4c-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736306, "uuid": "7bc3db3d-a157-418a-9222-675f350dd4a1", "comment": "Malware payload (Mirai)", "value": "d98710e26f7ccb1c6c080ab991050506", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736306, "uuid": "f7a5082b-24b4-44f0-afef-447e9b568364", "comment": "Malware payload (Mirai)", "value": "1c0e1b3dd158a38c63ea48fe60ab5e393549a4198469de0d1492e32ce2a18e7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736306, "uuid": "70bfe4f6-83e8-4ba8-a7f6-2751fdcada03", "comment": "Malware payload (Mirai)", "value": "6a4637d477a1bb3056e588aad05267411309ff3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736306, "uuid": "ab6becc6-c965-41d9-b783-5f8f0a3b396b", "comment": "Malware payload (Mirai)", "value": "0dc9a47c264eed964abaf54a507fe766a61c902c43e6cdee686fc76dfb95fa9c327ba5e8cfdc6ce0bf2e17bc423cc3d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736306, "uuid": "c4f5fe76-2e9e-4d3a-99e6-7532488600d0", "value": "T11D730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA19A515C0A51636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736306, "uuid": "93d08ab9-4e4b-4260-bcff-89aec46d031b", "value": "1536:Rcz8Mfl3USRL+r97S3Tl3ffUriW4C1qs3vLJ7LTaA1436Kk3u8ug:RcICl3USMsTl3HUrs6qs3TJ7L+K4JQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736306, "uuid": "8457933e-8bd9-4693-a06a-4a8e88f2e694", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736306, "uuid": "dadcf27f-22d6-4147-81c1-b27850c06f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736306, "uuid": "7a199407-5972-4ef3-b4e2-df00e49dd8ed", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2181b234-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777697724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697724, "uuid": "21b066e9-9e17-4c16-90c2-9be2ff3668a9", "comment": "Malware payload", "value": "4acdc8de680bd0a9e07b0322b9897ee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697724, "uuid": "c5464ffd-dfb4-4ebd-a3f4-e9a7ca6cabae", "comment": "Malware payload", "value": "1c397ada0d892653faac5489a6dbd187093efabd50953a90f60e85260e17fe5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697724, "uuid": "bf6dffa6-c46c-43b3-a6c3-33674e59b1bf", "comment": "Malware payload", "value": "8777cbf73ff0ccd3a5115fabeccbd288678dbd7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697724, "uuid": "cf02a0c0-378f-4465-acf8-2d91c886f693", "comment": "Malware payload", "value": "cd56a432aaf9fae176e5a9aebf08f189d780f4d146c48c32eb48c74afa13b37a137270e1beb1264aba5a212c883039f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697724, "uuid": "2fe6b0ff-1ccb-4dca-bd15-34bc260304aa", "value": "T1F2A4F15BB2E130F8D1779635C8A10A06E7B3B8355B214BAF0760865A1F237D0AD3AF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697724, "uuid": "a5d63860-8722-4d12-88d0-801371d42dc0", "value": "75c410d3cdd17cf4a33ccaf94384484f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697724, "uuid": "44039847-334c-43ee-9443-844e9a4eeeec", "value": "12288:jMsjo3iky45GRiKaBjIdYC/OD2J+Lxvlo7CW77WEdh:jME45NjZS4xdin77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697724, "uuid": "b1213786-9a98-44f9-81f8-ecdb0e131388", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697724, "uuid": "56356af9-5dd0-4e0e-9027-41a0130e7df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697724, "uuid": "799734d1-90e9-4f8f-850e-b55249eaef41", "value": "wmiprv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b22d96-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719233, "uuid": "d72daed6-6e42-4cb7-914e-348328ac2e5b", "comment": "Malware payload (Mirai)", "value": "6c4d797a31cbddc4165ebc274276464b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719233, "uuid": "5a0b4b08-a16a-4014-8918-e9e645507955", "comment": "Malware payload (Mirai)", "value": "1d01ea2e590420e4aa4f0b218d655f6a17288ffbbb1a0ff4ea47c5b5800c3d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719233, "uuid": "052da5ec-6579-4198-837b-fbd1e1d5589c", "comment": "Malware payload (Mirai)", "value": "d8fc5eb8b7b303979a089301e5737cef2dbd5f88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719233, "uuid": "4b2914ce-68c4-45cc-9979-99ba1adb381f", "comment": "Malware payload (Mirai)", "value": "012ebfd887dfc0764bbba31e7be6c85056708dd9647d404f194524b69296d4a2cd51b9bb13c801b257b4ac5f041ac01e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719233, "uuid": "9f1188e4-2d2c-4ec0-ac01-ff4b5bebde96", "value": "T16B53F26667E4C35DC3AF52786CC6732B0C74F27A71888DE35D84712928B66490F3A3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719233, "uuid": "aadc8eb5-b902-4fbd-986f-4a5584ff8d26", "value": "1536:/C3PX/h7QUtVoHufXKB3EIxLmQ0Sx1z9b8JiQYyoOAwJGnouy8Hy7:aHh7uHuCVEIdmexl9QEQYyoOdMoutk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719233, "uuid": "c0122771-ed82-470e-a840-f82b18e1de61", "value": 62672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719233, "uuid": "9e0dc6b7-d91e-4c4a-b33b-f57c5b188ab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719233, "uuid": "4fc8a498-1bb3-4ad4-aa23-0a26f33ceee4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471ca4be-45c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777686191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686191, "uuid": "2c3ab253-0353-4a4a-afd0-a8ff29b97536", "comment": "Malware payload", "value": "e689cb322c978566e0127013d2553c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686191, "uuid": "02fa7719-27d3-4613-8779-0b25fd972a36", "comment": "Malware payload", "value": "1ec89cdd311fec382d40434c6deb4d3ccfd55a7749d19b2ea807f671743d8d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686191, "uuid": "114ca2e3-a14c-46b9-995e-1cab137a32ef", "comment": "Malware payload", "value": "2307e2aeb0ecbbc0eef511a4c5f39820f5e72e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686191, "uuid": "e1f59b42-a8db-4128-b561-15cdae0af5af", "comment": "Malware payload", "value": "6c39a06aef59a357683ed5bf5f38c97ef3470232d1e5dbf8dfc53722695604893c123c20fe9a9ee9804eb4f63b1b28a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686191, "uuid": "0732bad2-00fe-405d-afe5-a76d66048750", "value": "T1A627337703D349E6F8A3643E7934834BE3646D9A1F7196EF0764931428778E48D3A3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686191, "uuid": "15abc329-5651-486b-b6ac-12b1e38d06cb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686191, "uuid": "bfb3b436-d3e6-4bf1-9eb2-70275c99d1d0", "value": "393216:FJAy0j+Pg3OVlSRlhsEGhxuEeN0LKH4Uvd2mHsnvDwHuc8mf4:FJAy0WVlVEEuHNyKY22MgEHhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777686191, "uuid": "93e857c4-e433-48fa-b176-2fb1ca3600e1", "value": 20531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777686191, "uuid": "675af3ea-bc50-4d22-98ec-09fb48f5db66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686191, "uuid": "c9f3e9f3-aa77-4712-912f-e4cd1a525683", "value": "tmpa_lpaox2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdac210-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745610, "uuid": "f24ce371-04e0-4566-ba93-1267201f39de", "comment": "Malware payload (Mirai)", "value": "5347275bed7762de27093fb9e5a7bf92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745610, "uuid": "0245f322-d556-4595-b76d-8c1034531210", "comment": "Malware payload (Mirai)", "value": "1ed7896252551aeef7ce84fc41e279e6a01cfd46d81524862e3d06c89dae1397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745610, "uuid": "5a081682-ebfc-49b5-b37a-065dd1e160ac", "comment": "Malware payload (Mirai)", "value": "d5eeb3dffda7644e06e1fe967c21ad3046279919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745610, "uuid": "24b33c1d-f1ad-42bc-a542-c94d57ec8f1f", "comment": "Malware payload (Mirai)", "value": "9624a5ff3e30cf522b4092fb87fc86b098eb3200d9f7b39300e160dc9b5f07d4ea32ca5a3bd6da2aeb723ae0e94c75d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745610, "uuid": "549c70c0-eb00-4fb4-8198-f950ab0b5ab6", "value": "T1E9C51744EEC740F5FE070E718167F33F8B346B05C420CEAADF94AE56EA3BA165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745610, "uuid": "88ad2a22-99bb-430d-b964-3187e9d5825e", "value": "49152:HSRnpOipBj8D+900Fl5jLOz3eyjfQVd8ldEAPFzLGBpikVYfqE:HSRnpOIBQg2zTfuqFzL+pih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745610, "uuid": "f7e167dc-a471-4103-a230-4c7fa0a3a411", "value": 2537144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745610, "uuid": "ca69b612-890a-4c92-903a-13b9453e02d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745610, "uuid": "e1312213-9739-4ba2-a23c-cb8c99d6280a", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6fb3fc-4653-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745850, "uuid": "999dfb2e-33ae-44ba-96bb-725bca8d0d3c", "comment": "Malware payload", "value": "a549327f41ed27b74c9ab626d3860d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745850, "uuid": "e980972c-2c24-4abf-a792-ff242f38c8af", "comment": "Malware payload", "value": "1f51554f232f319a27368e891f1b88f93dbc974d87a5ef5d87f9cd89077f4369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745850, "uuid": "b714f9f1-9b84-4ff2-987c-304fc92f362a", "comment": "Malware payload", "value": "3ae738c14bb72ee711aad907aa7ff454e4613120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745850, "uuid": "4fa55f52-0c50-4b89-b354-264558c25ab2", "comment": "Malware payload", "value": "e565f48003ae2c4d43eac06160363477a83cf1c094b26c140a77d67003173ffd4f15feaefa96d388733694ed1fba6bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745850, "uuid": "079e0662-0c60-46ed-83c4-a75576a87da8", "value": "T1ACB4B40CFE91F805DD2A3E73CFEA10048B7121C1AE22964631496FFD8BA537659E667C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745850, "uuid": "23e8c203-b16e-421f-9d89-c188e3ecfd02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745850, "uuid": "63bd1e26-9795-49db-8737-e8294802aaee", "value": "6144:Jmt8yZxqH9tpnde6VlWT8b9+YGQGmjz3FF6G4E5JxU/D9bu/V6x:JmtaPVle8gYGQ/jz3bR5gLc/V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745850, "uuid": "abdf94a9-987e-4270-8181-2c7648374cfe", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745850, "uuid": "9024ae0e-e0eb-49a7-8787-1412a2e144c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745850, "uuid": "bc6f8948-d22b-49ae-942b-6d7b71bcbfd2", "value": "dsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feebf4e-4640-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777737665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737665, "uuid": "d73c9ad9-be0c-4d75-ade1-e5af3638eb2a", "comment": "Malware payload (ConnectWise)", "value": "270d13d55f3584a8356c0db93573f360", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737665, "uuid": "27b05cb5-3a6e-49e6-bf98-039d89dd51de", "comment": "Malware payload (ConnectWise)", "value": "1f875719c156ec107752ef7ef272f6450b590808381f8aadafd780bf6b373c77", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737665, "uuid": "e8a04900-c021-446c-827a-650f16a90ccc", "comment": "Malware payload (ConnectWise)", "value": "4fdf9792f71c708008b56e2f53da043c6581a2bc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777737665, "uuid": "e3e6e4bf-158c-45c2-a108-e0219d1c0882", "comment": "Malware payload (ConnectWise)", "value": "6443dde7be99c9c71a6507b08aaf8ed7425472b77a2256fd69ae0d93940c15d71fa5d27a4dc80f599eba6edfc09a02e3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737665, "uuid": "56421867-71f0-40b0-a208-42216c94434c", "value": "T13E836C43B5D18876E9720E3118B1D9B4593F7E110E648EAF7398822E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737665, "uuid": "8689a489-923b-4186-8994-84bce1bd6a45", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737665, "uuid": "c2052345-e9ce-4692-832a-a3180fe5fa5c", "value": "1536:BoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYs7LJSC:7enkyfPAwiMq0RqRfbaWZJYYshSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777737665, "uuid": "d6af8c44-2b2f-4aef-b72b-5c3ea12e6e25", "value": 83200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777737665, "uuid": "2a547634-8bd5-4251-82c8-9961ef7d3e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777737665, "uuid": "c309ec86-cc0d-4bf7-8ceb-04f87065c882", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53edd307-4626-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777726585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726585, "uuid": "84d3d800-68f7-4c6e-a403-61076349c29b", "comment": "Malware payload", "value": "21d665203a43aaab6997434a7ec2d810", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726585, "uuid": "1854b240-eca0-48db-839a-52e1e094c93b", "comment": "Malware payload", "value": "1fe82cddc0ffe42b006544aef04b949d9c6f9943e8be62e8ca8c31a1a6edda3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726585, "uuid": "db2592c3-47eb-4c5a-8a74-3033c81f54ab", "comment": "Malware payload", "value": "98f12f2fb961e549664662c8b2948489ba5e7c9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726585, "uuid": "a3f6f636-57c7-4621-9f7b-4c42de803fea", "comment": "Malware payload", "value": "f03ddc0df037357338d7083ac6cfa983b9d99b4bb14718f90300f98985cf3a6a19f85644db50520169104508abffb15b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726585, "uuid": "a8ac1b1f-83e5-4077-a9aa-6d1827de0cb4", "value": "T16322941B735D8A23C7F527B016AB0795A3AEE680C744A38BC10DBD1066797040F7EAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726585, "uuid": "8a3cfdda-fc90-4a36-9283-46565998d678", "value": "192:/OmOSEHlKvkoexRhjDj0U0UzuFkBsF/xXt4sYRrqV+/lOv5OhSG:/OvlKvgxRhjDj0U0U6kW4sNkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777726585, "uuid": "9b639dc3-cf13-4960-896f-0ae9e43566bb", "value": 10246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777726585, "uuid": "96a2ea62-508a-476a-96fb-9a7da392da9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726585, "uuid": "09fcd5fc-6bf3-4a97-a50f-f22286c3c0d8", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8004092-461d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722968, "uuid": "cc28ef96-c449-48e4-a8bf-db26abdcf445", "comment": "Malware payload", "value": "5b092411daf28e5988fbc519e8d03da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722968, "uuid": "db3c54b8-b5f5-4b7e-9995-5e63c9e1b53f", "comment": "Malware payload", "value": "20204ad8a1886c2c7e64f181e8d30cac36caf3d0aa1fe1d1a33c6bb647ead67d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722968, "uuid": "1e5cf197-c4ca-404b-acf0-67252e250ccd", "comment": "Malware payload", "value": "7729e260b80b9d487d78bca734d05b21fecee310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722968, "uuid": "7e468612-3521-456d-a1fd-c44b701a58e6", "comment": "Malware payload", "value": "17bf8563b45d1ab5b34c81933a8df941e5dd913528ecd28bbba0b1f70035bfefee7c1caf0d0de14f30107fd1285633c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722968, "uuid": "3eb5eb4a-1817-4058-9211-bd08873f7d1c", "value": "T19F3713CBD4A3A2A4C88201A4794202C678CDD4DEC5FD5B2929CDDC227AD1DFE15CDAF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722968, "uuid": "f5eb29ba-d97a-40c9-a9b2-79747aba29f5", "value": "e297f2821b5f2d2351cf990dbab5d512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722968, "uuid": "68da8819-561b-4808-bb8f-ecafff9da1da", "value": "393216:PI0XQqhf/dD9TrTjR6Ji2riUargGTm8jAvb/NEocPUqS20F+tmqM:bXZ517R6JfriUAQb/NEo+UO0FW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722968, "uuid": "aead7c19-5bad-416f-a8e1-ff791b9e8e68", "value": 23199232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722968, "uuid": "fa47d561-57b2-4283-a091-24df8515f931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722968, "uuid": "7648cd46-5864-446d-8c08-5e67c2b56d81", "value": "astral.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67337f65-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746804, "uuid": "e3ca8c59-9e2f-4fcd-a32b-8851ed8d678d", "comment": "Malware payload (Mirai)", "value": "6cb9331f2672e74c22f8bf75951888ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746804, "uuid": "df355827-ea3f-4c9c-8ea8-2ea074955af2", "comment": "Malware payload (Mirai)", "value": "203432b0035b258118338c255cd77e9d9b153c0a577c9d227cf7983eb61c3533", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746804, "uuid": "8dd7ba23-2c64-4896-b804-1c47db41b0d2", "comment": "Malware payload (Mirai)", "value": "959b69d9a02a80ed4bb46ef2fd04489ac40ee414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746804, "uuid": "3738642c-ee66-48f1-b509-2a8b70ef2a92", "comment": "Malware payload (Mirai)", "value": "76a411b9b9c2be203e0647c72bb7b1b917c0c0d0d023042b97c1e08f65e5159ccd23bdd6950d1db7810788075b99d765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746804, "uuid": "dd54638d-bddb-46b0-a09f-8d193346bd7c", "value": "T1C5243C177E81C9FEC49AD1F04BEF91319A75F86D0635315A3790FFB12A09EA02B2D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746804, "uuid": "d9c05b74-8940-4b0e-9e95-eab54073188f", "value": "3072:/OgrkCC6KZRqjS/Bp6rN/ecO9/EqgnExKRolxb1o1a4mzFqburdLFkoV85ADlp6Y:/OgkCC6KZRqjEBp0NmsZRAfmlfbWH6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746804, "uuid": "bf112f58-43f5-42cd-a8ab-a15f30016a56", "value": 213616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746804, "uuid": "9b7d0dfa-8b18-422c-9bfa-516e88941f43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746804, "uuid": "90fc7fbb-442a-499b-9db8-90bb5d0612aa", "value": "bin.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ea757b-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777697705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697705, "uuid": "10accb98-8017-4ebc-86a8-570bdfa11b9f", "comment": "Malware payload", "value": "403b787070f339f7292240d33a1f619a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697705, "uuid": "763a38f8-6929-4fd0-b1d4-1553729842ab", "comment": "Malware payload", "value": "203858a2a480b9efc8e97209a38731941d985960eaa9fcf6045bb972f34b0761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697705, "uuid": "afe60c57-2655-4234-a0c6-ddba1ce829d2", "comment": "Malware payload", "value": "e95f1e3251d0c661728a709b41f206ab4df0b394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697705, "uuid": "09b4eb03-36ef-4cb4-9c48-77f5cade826c", "comment": "Malware payload", "value": "592f4408f73a73493acef3daf9219da00078c58397efdbd1abcfa513c43442c9e92bc353f58994ace0b74dfa304fe838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697705, "uuid": "4c03c3ed-acbe-452a-adb5-c4a3c3fcfdff", "value": "T134F36E4A335460F4E17B9278CDA25B46E7B2787A17B1634E437843BA5F33251AE3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697705, "uuid": "93dcc23b-c43e-4d61-bbe1-29b9a0b4fe8f", "value": "58e55310d66c611cb140f28166224b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697705, "uuid": "ab6a7b36-b383-421c-aeb5-7fbb09adc26c", "value": "3072:w7nVDG7iPEC7P6Tx5TksYq2KCTzo9I/A++cblAtlJ+56Kpv/f:0G7iPECL6TTTtjE4I/B+olerA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697705, "uuid": "17dee712-d4d4-44cf-89bd-ceb23524d182", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697705, "uuid": "df061bab-61d3-4d90-8d04-26dfa5b4589d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697705, "uuid": "e9a53d4e-9cf4-46f4-8a19-df1ea648b3b3", "value": "rkhuba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f704ef-464c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743072, "uuid": "8229c25c-38e1-4867-a406-c28669dbb4c7", "comment": "Malware payload (Mirai)", "value": "e1bf6b1b14980dd96730c19195ab8e57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743072, "uuid": "481df56e-9ab3-42b0-a8b1-ca92d587b1d7", "comment": "Malware payload (Mirai)", "value": "214f2470af822777d68c93a5f559b7b1e234862d2c26a665031ea7af5db9f30c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743072, "uuid": "6c85596d-a39d-4b47-b6ba-025dae534377", "comment": "Malware payload (Mirai)", "value": "11c8e3a6435e5d98d62ef0f1787185055cb6da4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743072, "uuid": "8c5b352d-bac7-414d-8529-4fb4448000aa", "comment": "Malware payload (Mirai)", "value": "7cfadd8408e26f3333e48a24e73d4da336fe9853921a280ca826b8e5b384463debc0691b8a8bd10f409c1413cc695b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743072, "uuid": "98f39edc-7d3a-49af-933e-ddac4ed19497", "value": "T1C124FA47B991CF12C1C111FEFE5E418D37136FB8D2EA72029D24AFA477868EA0E7A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743072, "uuid": "8247fd9b-30ec-4ac4-ae66-8c03fe29a084", "value": "6144:ag5yKywGnoQ8LKl9LpaaCoeyQoP5YZh0PTjzQ/:38KCoQ8+l3aaCvC5Yn0Ljz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743072, "uuid": "4d8b2fe2-08db-4101-9c02-d99e400d005b", "value": 221948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743072, "uuid": "16d2ce8d-c04d-4066-b0eb-193ac090e89e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743072, "uuid": "6cabde27-4985-4932-ad58-3ef30c823909", "value": "bin.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f175df-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734917, "uuid": "fa34e2f1-571b-4fd9-a325-427d7f761075", "comment": "Malware payload (Mirai)", "value": "1826cf307c972e39caf1c19eb207fdc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734917, "uuid": "191a701b-6a56-4a4f-b5cd-cf6a250a24b7", "comment": "Malware payload (Mirai)", "value": "22b3994523026a43c53cfbec190d3d61008a0cf5ca5fdbaf6107fb243646b95e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734917, "uuid": "12072679-eb28-4e32-b144-bac3417aa8e9", "comment": "Malware payload (Mirai)", "value": "af7b6e2a272f803ed2628eb80da3a8f901212fd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734917, "uuid": "29d041dc-4964-45b5-8dfa-86b293ae51f5", "comment": "Malware payload (Mirai)", "value": "57c2f8412d09b79b7a4a89d16a4ea41ca8d5322389a573889fe495d948b8356b3c1fb4d24fd14233c6365e2ef349166d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734917, "uuid": "467fde64-4a70-4652-8ca4-6fed1aa3bdfb", "value": "T15AE52B156F900EF7E86FCD3356EA4B02258DA40622D53F36B878D914FA5B60F4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734917, "uuid": "fe35f2b1-7ea5-400d-b518-0911efa65af4", "value": "49152:yOO23sF8S7xlbFBwh0D6J242IoQsFfs+CJLDQprvPT0:cQsd4kogprT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734917, "uuid": "cfb4f72d-dbae-4187-878e-609723f72249", "value": 3164640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734917, "uuid": "fb901419-85bf-4702-8902-816fbe05ade3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734917, "uuid": "b8732645-8f99-4b56-99cf-b2a91a8915b2", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a98002-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704959, "uuid": "62a428fd-06b9-4134-82d3-86a2d24f6f4c", "comment": "Malware payload (Gafgyt)", "value": "b40e65e2d906be1da305a303b7a63356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704959, "uuid": "51aa2ded-9377-4251-ae60-c4a8313ab038", "comment": "Malware payload (Gafgyt)", "value": "23151cda65543a19616aa1a26edfc44248a4d9143ba5bf9e13db53eca2c19d42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704959, "uuid": "939d2a92-fba4-4f50-a11b-009f23cff1c5", "comment": "Malware payload (Gafgyt)", "value": "50bc5d4d00b9dce247d4881c5eccd87e0316d422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704959, "uuid": "b0592c1f-2028-46d1-9958-aef8c610f7c7", "comment": "Malware payload (Gafgyt)", "value": "da69c0f82a5fa3cfa8b532ebd43585ef9f6fa87b0335fd1c25732ff3c93a9ea33072395f8ce5b0b553a06ef49605110f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704959, "uuid": "9af68354-5396-49d0-93d0-b8e7505e4c22", "value": "T1C1934923ED125F0AD20B64F0A1F59F351F22B8FA89975AD9E065DAE06543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704959, "uuid": "7d0ad42e-2568-4fb1-b296-24c986e7cffa", "value": "1536:CCZLXqXF9XBNwKYdo6nZz2ak0+Cvuy0/+ym5hV1qqpSm:tLqV9XBNXYdz2ak0+/yIm5hjqqpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704959, "uuid": "d15cf8e0-2da6-41ec-aaf5-dbfbbd413b80", "value": 92164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704959, "uuid": "a9fbec2b-9e00-413d-b63f-7849f06849b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704959, "uuid": "725c6f93-55c6-4744-9289-6ccbf7b7fce5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7b0c9a-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777706116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706116, "uuid": "8ad10994-2503-4542-a7f4-de518c817502", "comment": "Malware payload (NanoCore)", "value": "08bca9bf27f2f8d6f1ff23f12e2f0b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706116, "uuid": "6cc99a15-c898-4ea7-83b9-92f7811c0697", "comment": "Malware payload (NanoCore)", "value": "2397015877bf3f15b4b51b0c2137e4424b9043641daac653c7c759e34124770e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706116, "uuid": "6a00b34d-23cb-455d-aa1f-ccc30f167f34", "comment": "Malware payload (NanoCore)", "value": "5427c068c07b9257b577adc62f4c190d8f9f950e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706116, "uuid": "0c2c49f5-c79c-45a4-9f10-fa96051976f3", "comment": "Malware payload (NanoCore)", "value": "5b60a1afc9a49ef44bcb1530115b2326cfaf9f90c13b6605642ee919016f6e7fd716f0d1085f03789a8463156ac7ac11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706116, "uuid": "f0279093-0707-4767-9082-fcff17674e86", "value": "T13A14C01677E98A3FE2DE867D611201524379C2E39DD3F3DA28D414B38B663E50A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706116, "uuid": "95a5fbf6-0ec9-4cd9-a7f9-6f45318c0d97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706116, "uuid": "a7bd36dd-ffc3-4014-be6b-06c042748098", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIuhO1RxN+dAu8imqhVPd63DfOy:MLV6Bta6dtJmakIM5pwC86hV1UfUgrTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706116, "uuid": "198e5ec8-6f9e-4e47-ae52-d01d3674f44b", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706116, "uuid": "efaf10f7-0364-4ab6-81a6-95bf355a8e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706116, "uuid": "8df2175d-06cf-4bbb-93fa-9c51b6845bac", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bd2168-4633-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1777732388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732388, "uuid": "846fb52b-8cd4-45a9-a77d-34b3f987cf75", "comment": "Malware payload (ACRStealer)", "value": "cd09ddd1fe1fdb4e854da8cea1db5c4b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732388, "uuid": "b696f412-1a92-4dee-b564-f452f5bb5f04", "comment": "Malware payload (ACRStealer)", "value": "23da60d5e7ba58c154e8cd93d282bd1ec6756e45ea91568e7ccf4ab2e671bf03", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732388, "uuid": "a9e2b8d5-7836-46c6-8e44-a1e122863dbe", "comment": "Malware payload (ACRStealer)", "value": "9eb8cc1e5f060690260c9d02c99872a1c322bcad", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732388, "uuid": "9e69dfbf-d165-4f68-964f-cd0468bd5332", "comment": "Malware payload (ACRStealer)", "value": "bad54c0c64adad53ea66e7fc908a17ce6de1d0449d4af68ae8a18ba986a92854ddabf381eacafd9a4ff50dd67fef012b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732388, "uuid": "0e386bd4-b3e6-432a-bd7b-d9e952eb91f8", "value": "T1B2269E1FBDB958A9C099B13484336606F6757C014B2317C72AF4B6292F3A7E05EF9B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732388, "uuid": "89df18ae-7db5-4ea9-bb98-8c790cd456a4", "value": "4c75fb727d8aa92120e30dd58622bf9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732388, "uuid": "f103d65e-dfe4-4074-8078-c01deae9951d", "value": "49152:6yVrfDNdTumcKa972J0t9FFfzEcwX0wVoSgMFv8G8Uj8s/N38bwUUqjo:6yp8L5x6VHV1as/N38jfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732388, "uuid": "fc48cf00-a9be-4b66-8949-0228e2e20382", "value": 4847616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732388, "uuid": "aa0e9c30-43b1-4d8e-b68b-71574e98172d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732388, "uuid": "0ee76991-666e-4d76-bc81-c50e23bb4a84", "value": "runtime_validator.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21652c6-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736648, "uuid": "8bc314a3-8126-4f8a-8e1b-f15630c9a98f", "comment": "Malware payload (Mirai)", "value": "5b36fbfc7cfe6095e5764981fbb2c3c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736648, "uuid": "10172cb9-4166-446d-86db-8924410c9718", "comment": "Malware payload (Mirai)", "value": "24112c8277c661c71002d06ace82e1ce89f455ad7aa5f3c19c7f4c76a804790a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736648, "uuid": "2fc9d4e1-9c38-4c32-9e1d-0f799bdc94bb", "comment": "Malware payload (Mirai)", "value": "90d4acb7ac654c84471aafb438573893ac9e7741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736648, "uuid": "3407960a-e697-4c96-ac32-200891aa72ac", "comment": "Malware payload (Mirai)", "value": "fc96a518eb6ffaec5dc912f33a54d4d05a680f7138d79834b89d8b5b5198309e5e141e2fc9817c1edf511c0e8d350d39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736648, "uuid": "5a7a7ddb-b59e-4737-b8dc-a78cf4948c9a", "value": "T17F731A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736648, "uuid": "ca446467-24eb-4d8b-90c0-3c8a9b62bff0", "value": "1536:eNn8UxkW50thqBtIC1R4/LsdH0ZBYHSZvNNSVzfpnDM4ioyuuz6Nd42+:wxkW0hCtIUOSqWgjMbyuuz6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736648, "uuid": "7c713524-4a10-4de5-b3d2-2aa956eaab29", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736648, "uuid": "399cb21a-63cb-4c51-831b-c1472c3682fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736648, "uuid": "b74b819d-00fb-4e44-8a2d-0f37a15061d5", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec46aa0f-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725552, "uuid": "6404ef32-2ef5-4e72-92e8-789c036a9c4f", "comment": "Malware payload", "value": "862ccdf71b76aef43c3352fe6a7dd4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725552, "uuid": "a54a2b30-1cc9-4c3f-92eb-501fd65d72ba", "comment": "Malware payload", "value": "24779c641a1a6d3c89cba4c3f00f78a8035f843ca91521428e245f80af1a2b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725552, "uuid": "2cf98e4b-3fc1-44f2-91e9-14f0a992827f", "comment": "Malware payload", "value": "90be999b63c7906d444e7a241d34a00619ba235b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725552, "uuid": "0b4ca4f2-d875-48e2-92b2-d63b5f5f0f1f", "comment": "Malware payload", "value": "92adcacc9ab003bb6cb3bc3fc30401fe1bbd48afe1a2d8008f0f714bca6b57566af6b7f67ed80f0fbe2e2647f39a09cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725552, "uuid": "37ebbd7f-c926-437e-b5d7-edebeff85dde", "value": "T10014F1487BA44551DD7E6AB4C6CB33229B30D2171443D70B3CCDC1D8AE97BD6980ADEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725552, "uuid": "705e4a22-f143-4b63-82ad-78c30e1e9c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725552, "uuid": "fe9506e5-2df2-418a-b3ae-96d50a21c48e", "value": "6144:GI2BuHRWqRgtQXStHLVO3mnINdUVjBmbBBqxG:32BuHRWsAHG62dCBaqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725552, "uuid": "46f49bca-6e48-4c55-baae-a86e0df710d1", "value": 204536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725552, "uuid": "babf991b-ae88-4b59-9402-7ad2bc47de86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725552, "uuid": "d4ecda16-303f-402f-bcb9-2f67b18b8445", "value": "360 total.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccc892d-45c5-11f1-a769-42010a9c0008", "comment": "Malware payload (UnixStealer)", "timestamp": 1777684805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684805, "uuid": "d2138940-fb2d-42f2-900e-1f1699eabc8b", "comment": "Malware payload (UnixStealer)", "value": "724ed8c5ff0101d7751956f5d894ff11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684805, "uuid": "922d7353-8a74-4170-a452-9d4273c7d6fe", "comment": "Malware payload (UnixStealer)", "value": "24846cde9f6e334cc47d202040aa01e1fff9104f74b79c28a4a305e241b15377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684805, "uuid": "eeabe110-e1bc-40e5-ac23-513e6e2f0a4b", "comment": "Malware payload (UnixStealer)", "value": "ea414a0d0ef018dd6aec6b8b8e9166ed4f53aa11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684805, "uuid": "bb7804df-160b-4ce0-932f-572d1b3aaec5", "comment": "Malware payload (UnixStealer)", "value": "274282a8763daf22e1dbc20a0cc6da7cddf225aba3c1fb07615fcb73fa1543ef3cf68ca75c483c38e2dcb826fe06ba33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684805, "uuid": "c6a46ada-0674-4555-9175-090ff1812c61", "value": "T1AB545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684805, "uuid": "a2689995-f105-4ba2-a1f3-a2c88dc9a17c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684805, "uuid": "816cfa34-421c-40cf-aed8-494fd0ca31f8", "value": "6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUu:Hh6OTyejyThvFhIpQrAHYR/H7Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777684805, "uuid": "0da01463-f5e8-420d-9e14-0515e1012bb4", "value": 303619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777684805, "uuid": "594791d1-3158-412e-aa71-48341aac1980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684805, "uuid": "91d99c55-34cb-4f40-aa80-0c3c605227df", "value": "tmp3217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b02bd9d-4653-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745897, "uuid": "0e34ae0b-479c-4dd4-bee1-eef485fcc418", "comment": "Malware payload", "value": "7daa01705af0ce487e6b5f41c50e521a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745897, "uuid": "22083a8c-23fa-48a9-b21a-64d24c849cf8", "comment": "Malware payload", "value": "25e00987d62b5a88b54419bd4756b1e517b172e3af18185325d05b37f6451593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745897, "uuid": "ea583959-1c6f-4a7a-8513-a183f4cd1184", "comment": "Malware payload", "value": "956aee5ff04cdf69c0206a3944760d0bca355d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745897, "uuid": "019fc1f5-dfab-4e14-8db0-93ddde977235", "comment": "Malware payload", "value": "6df0bd9403b6e20cac7b34a29dd8dfc1e9807286039a190ea160abe8e885f5376822cd990d015392510dd1f3a9007f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745897, "uuid": "40033e76-d96c-4996-89b8-da6f232fb685", "value": "T17D6533A4A43696C8DCE957B5C4A0552F5D487E04A85FC3E088120822FBF9FDACDD63F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745897, "uuid": "6f278a2d-ab26-45a3-ad5f-c45efde8616c", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745897, "uuid": "80f26d74-8495-4c60-82ed-6e68b2df5744", "value": "24576:iRERW2A3weUZtYT5cFBSSeoSZrK1GkQWak6mBrl0701dSuWKeXqTMLol9m:3c2swbsT5cbeDQGD5mlMuSu14qMUlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745897, "uuid": "96ee09b6-034e-4943-b824-c9bdf1d47e49", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745897, "uuid": "567aa39f-e33e-4f59-8d0d-48f020c3b99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745897, "uuid": "dbb822b2-2d92-4aaa-b8d1-d54ab001773e", "value": "appload.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7204760-45bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777680876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680876, "uuid": "7391cde3-d2a5-4319-94a3-f23ae4cc5ed0", "comment": "Malware payload", "value": "6eb27bb4ac12fea3710797eaa387192c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680876, "uuid": "772fae1e-a717-4c0a-909e-4c874532155c", "comment": "Malware payload", "value": "26f5da8506e000681e9658af3572fdcf7a8a0e8dbcc315bc63f68e1301b986a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680876, "uuid": "05494bdb-194c-4874-9471-c60d96183740", "comment": "Malware payload", "value": "770019d72f4a11957695aed4a39868ab1b47648d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680876, "uuid": "7045c058-3d14-4110-8513-a9c5aa8df719", "comment": "Malware payload", "value": "3dc065cc02d40dc01645b760d0b24a2f11cce3b1a6abba10f23b01158c48ea543916f77ceda52e0b53b4e347276f4367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680876, "uuid": "4cbdcd23-02b4-4d4b-b17c-0035a0c4b3ac", "value": "T1DC52D804A7E48139D6BA0F749EB265105A33F7564932CE1F258C928B5B27380EDE2F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680876, "uuid": "b1f49d98-22d7-4513-95ac-fdc9f3752f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680876, "uuid": "cdb06bf8-d93f-4a32-8a19-716c245fc4f5", "value": "192:o3ED4poDaVm2iJJdMBizTcPKw+rmbQSaZxGKxOkhEVVEMKRDTQ7W7vm:uEyVmciw+rmbQSgxLQR/EMKxgW7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777680876, "uuid": "9ddc6363-b8b3-42f2-bd2c-7e7029b3dc84", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777680876, "uuid": "696d9ceb-0866-43b0-900f-ffebe8a725cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680876, "uuid": "f4bee01f-9948-4f3f-a52c-b0a08e514ecf", "value": "CoreWorker_uAiDssFFiZsYbQu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f7a833-45e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777700035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700035, "uuid": "7f45c504-e4a1-47bb-90c0-c3f275f75978", "comment": "Malware payload", "value": "0918ec875e01ea0804e92d70ff9c4be8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700035, "uuid": "35e203e1-cc99-4ff5-be16-3172c4906da0", "comment": "Malware payload", "value": "273a8917338ddb784c49338ca9d7d1bf9ff937982bcfb3ffb7d54ab12a533404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700035, "uuid": "914ecc1a-ae60-4eb7-8b99-4c9ac6cacbb5", "comment": "Malware payload", "value": "5dbd42410a11e5b02d5ba1ddc0829e6707ec3e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700035, "uuid": "426b1f25-b884-4a9f-a8bd-3033b96554ef", "comment": "Malware payload", "value": "f405688d0160800fd14614138ecacf96d3e3b80168cde8a05658e46fa1bea434093df8449aedbe535498f1d9cc6b5ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700035, "uuid": "8252bdb3-66f5-465d-8a50-b06fc94a6221", "value": "T16873F649F9829F11D8D813BBFE0E018D33536798E3EE71129E116F11A7CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700035, "uuid": "0a61dc36-a88b-44a8-828e-e5db9d2ffda6", "value": "1536:K9nhz1Sz+9crO9rQQh0n28ZoZnknrw6iYhf8XllzfisgAXU5wbZn:IZU+GrOaQh0No2nrw6iYhMVgAE5wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777700035, "uuid": "c6e748f7-76f8-48b0-a7b1-9473fed998ad", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777700035, "uuid": "b2a67931-45aa-414e-91ed-8f252f2fe5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700035, "uuid": "05677130-6120-4650-9459-4474708f1170", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cb554c-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723902, "uuid": "4227ffab-7b0e-4b68-9cf9-855c30cc5b13", "comment": "Malware payload", "value": "b680120595090f34f00a1f7e1280574c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723902, "uuid": "e8dca78d-1608-4e7b-a810-9f8ee580a86f", "comment": "Malware payload", "value": "280b89a246cc3d28fbe79dd3fe3d0fa0a58e9ad7fbb4ae7dc4a94d7c2a99f412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723902, "uuid": "e6b8d9f4-b0ba-4d06-8c20-9d2cc3e81c3e", "comment": "Malware payload", "value": "49c11e1096beb627931f0be6881c6644f3c20ca8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723902, "uuid": "834760c1-c517-43c1-bb97-f6e2b98fc873", "comment": "Malware payload", "value": "f748ce4e981f026ab6b497ecaf41a49ed04d12efe97ba067f97b882301d559be723e5dc7eec5c9b31847232316b463a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723902, "uuid": "efc22dbd-57cd-48be-a5a5-4f7c80b96ea1", "value": "T1DAD18D56DE948A95C009A33BD35C5CB87E263FD90B96C3D0B1548CC1535345AC87DB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723902, "uuid": "a8c32b16-99cd-4458-9daf-628c1fb760ac", "value": "192:M2hFvrUL0ZixYhko10nMlZ4SRVV+5PMCK+:M2hlYL0ZixYhk+Fv1R2PO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723902, "uuid": "5b7e7566-1118-47ed-b6fc-4001b0e8ed94", "value": 6740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723902, "uuid": "27352fb2-70ce-465f-982a-35726cdae10a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723902, "uuid": "9083a138-7398-400b-bb7d-578d5900e5af", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089333bc-45c5-11f1-a769-42010a9c0008", "comment": "Malware payload (UnixStealer)", "timestamp": 1777684797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684797, "uuid": "a800c5d6-4dc3-4715-8349-ef9d3ecc9d11", "comment": "Malware payload (UnixStealer)", "value": "15e7e5d905c1497f8233ec52359a7805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684797, "uuid": "2c414720-67dc-4a6c-9995-8044d7fdf3dd", "comment": "Malware payload (UnixStealer)", "value": "28ff1dd6d34df59813c8d440e70cad170bd75b9b44a817a2e378d3013122503d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684797, "uuid": "7deff3b1-678a-467e-b3a1-8e7f9e31f1c4", "comment": "Malware payload (UnixStealer)", "value": "3e08a69de9a551ce50698ae6eb2050bf56a77e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684797, "uuid": "8ba0b96e-2efa-4dd3-91ab-1c909b05cc1c", "comment": "Malware payload (UnixStealer)", "value": "16f7a5a47a0646e67af6eb79b0252ec94f20b5fd5d766f1839c798bb673c031740d889e2024405a8683e775837661431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UnixStealer", "colour": "#682E74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684797, "uuid": "05ab70d8-6bdb-43b2-9337-05cfce635116", "value": "T147C502CA261CC2E5FC197430A81597C70FB6EE92C86CD89AAEF809530FD39C1159DF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684797, "uuid": "504ca30f-b92e-404c-a5a9-dd6d1c8f0826", "value": "6837fcf760c79dbb28743f1d0e3b2833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684797, "uuid": "5a48255c-94ef-4bf0-a408-c0faf699829c", "value": "24576:XGoxsPxrSC+cFQMLnHS92Pc10tw0P0AhoYqByNquUeIZ6/guXXhxll9Au/2U4b2+:CjMOKjyouX9boAO1w+6Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777684797, "uuid": "2316515b-d0e5-4faf-80c0-9e641112e155", "value": 2550096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777684797, "uuid": "33faf2d8-7a48-4542-bc8a-3fe0bafd0909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684797, "uuid": "e3f7d27e-501e-412d-a779-ea3e9590b711", "value": "build_hidden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2825e20-45cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777688116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688116, "uuid": "51f15124-6e44-4fc4-901d-dda91a48d819", "comment": "Malware payload", "value": "b4c1b8bedde4466a64f2fe16c405fc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688116, "uuid": "eb80f0ae-035c-4bb9-9364-6019689268fe", "comment": "Malware payload", "value": "296b228b19d74c154432ae9133a88e8b94464ef3d97bc234d1ff711ea73734ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688116, "uuid": "741b915d-f07e-49bb-a2a6-b72b04e9b59b", "comment": "Malware payload", "value": "1b79fb035decaf31d3bd63a9bbaf49b93d23a468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688116, "uuid": "1e9b39ba-9cd9-47d3-bf37-29de59227fdd", "comment": "Malware payload", "value": "1395fdd63519bf805d92af7e06f6096f3592795e09ce566ed171956e12d99726ae420aa6d2d8ca9525d4792ce53a78a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688116, "uuid": "314532bf-b1e6-4644-a548-199baff949ec", "value": "T1E654920CFE91E805CD5A3E77CFE610044B7125C22E21968636A9AFFC8B9537758E61BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688116, "uuid": "48a3e75a-82cc-4d44-8535-c32b14f2b410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688116, "uuid": "164cedaa-3aad-4d20-82d7-2710b78faacf", "value": "3072:g9u4odtr0cikfxahRftzi1T2RW0Qj9MLG06QEXbCAaVsrOwVL:Kdod/GhvmNm+jP0BWbmGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777688116, "uuid": "200bcde0-8340-44b6-bc8c-c9010a46bcac", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777688116, "uuid": "ee4283b1-6bef-4a70-9fd3-9e472b2c31e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688116, "uuid": "ba6da947-f636-4e85-8e98-574100db5318", "value": "\u043a\u0432\u0433\u0448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec9de9-4656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777747092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747092, "uuid": "07f3ea8f-9ff8-4560-92e6-d9043892adf5", "comment": "Malware payload", "value": "33a29bde403e3336e872a2d3eb28e179", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747092, "uuid": "4ef9db01-6c42-495e-852a-57c49d3e50b1", "comment": "Malware payload", "value": "29af3abb8c6dae8bc9c21a8feb004fa46921665a17d81eb4f90e4d9a83c1cbff", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747092, "uuid": "cca57ff3-7a25-4ebf-ab4b-563cb76d1f65", "comment": "Malware payload", "value": "98d3b3e414dc04ce2eab041c143896b1bcbce83c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747092, "uuid": "fdc7a2e4-00d5-4809-98a7-dc0dbb59ae96", "comment": "Malware payload", "value": "7e05b1cd098607014eba63d053a130c15fc3af7ba40d4f302ea0a385d499fc73c2b5fb5ff6a542284e61c9e470b6b454", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747092, "uuid": "cc0e5b86-c8d6-4fe7-bdf9-8494d1980566", "value": "T1B9F0A08AC4AD1D360A7D8A13A320EB6830152462ABF67BF8D585D7218B5B038B341F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747092, "uuid": "92bffd09-e14d-4119-b48e-b1bef90b67a3", "value": "12:ZCk17Tyyy0yowq9Ov0GyVpoQGy76ULnI+yLd+JM+0RwbFUO:ZCk17Tyyy0ytq9Ov0GyVpoQ976ULI+cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747092, "uuid": "518a79e1-c02b-4a47-8533-f8bc4b4fd904", "value": 452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747092, "uuid": "a979190a-aa22-4871-8fd7-db7447e7b366", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747092, "uuid": "27f138f9-fe95-4159-9fac-dfdb440747ea", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90504f84-4617-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777720244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720244, "uuid": "5db0a707-1c43-4c12-9f07-471310da126c", "comment": "Malware payload", "value": "2f2ae5238caa77620f5e329d3c284336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720244, "uuid": "475dbfdd-6d65-4048-8509-f4579d27bee8", "comment": "Malware payload", "value": "2a8fa185477fb7805ec8ad3d17ca5c493ff0707fdb136c6037e7a13f076729ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720244, "uuid": "8a2c92ae-3457-4ef3-a4a7-50cd1f771fa3", "comment": "Malware payload", "value": "951c8a007280356f5e611cdf8ad3c192739ee05b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720244, "uuid": "54eaa49d-9ebb-4f60-9e22-1e9107d7f9a8", "comment": "Malware payload", "value": "b31c1ad8b2386504833fa6e3a5de0e591992103aeff09603033e66e8eb85a2691dc1b73e8df8f1130211bf7bda59cdd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720244, "uuid": "bbcdf571-700e-49a2-ae17-2e63d120b1e3", "value": "T1FD52B85B77809CB7DD85DE3A0AAF4B16319FE006A180773FB22DD604780268E1DE3E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720244, "uuid": "65c1f17c-67a3-4382-89f7-328244024c7e", "value": "192:fVe7ahNoO4ZFum+AQUfazvw/ZocqkCF8TOap5WBBG:d+p7Z0/OAvwBNRcycW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777720244, "uuid": "4de56f62-6f67-4eae-8342-a9be11f45eec", "value": 13588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777720244, "uuid": "1fbd5cd4-0fa4-4238-876f-7179f0ca9aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720244, "uuid": "e3e0fd58-d70b-4c54-8999-311a8aef8d14", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f504e5c5-4658-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777748330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748330, "uuid": "0b3ee318-1018-464c-9a12-0d0ca9181385", "comment": "Malware payload", "value": "26ebd5d514a58f878c15d70b1bd37850", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748330, "uuid": "84c865d2-700d-4589-aa6e-e3d478375d7f", "comment": "Malware payload", "value": "2a9d3bb7fe42cb3fe8df5347f6e92a5f770d13d9d2b5dd47d3e09f7f8a2acd3d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748330, "uuid": "84bf084a-d62b-48aa-8b97-9158aa5aa1df", "comment": "Malware payload", "value": "3db54a1663b8d2fb28397df44a1e6c3cc2867471", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748330, "uuid": "ac8f0819-e737-4768-84fb-f437c86844b5", "comment": "Malware payload", "value": "591ac9c505a9de07dc2b0cbbc046a0a4e8660e5a6fca6d6a50151900045a4a533ad8f970b118f0e549aa036a0db709d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748330, "uuid": "e42084cc-6ca6-4547-a801-4a0392f8f448", "value": "T11232C0467742FA23E072309433AF1B5D86433AC1AB530F3A4E64A5A77EA00C73674F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748330, "uuid": "f280ead9-62d0-4ddd-b7c1-5cd40152e0c7", "value": "192:n7lQwMqlCjNBkSkM2IcHUhD3Xn1vFtfpLMLUSUKnhi3kc55VvhRVqIsoP5r4gS7e:n7awMqWBQTHcD3X1v3feLUSUKnhm7PZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748330, "uuid": "2de15e74-6209-46ce-8643-f8286d64d8e1", "value": 11992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748330, "uuid": "f93f656a-409a-4376-8a55-bc278bac996d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748330, "uuid": "9ba4d458-3477-4622-a820-574bb0fd4a6c", "value": "$RAK7IC4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675bcf50-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725329, "uuid": "c3f8c3cd-1dcb-446c-9a9b-5dc81a553007", "comment": "Malware payload", "value": "552661d2e790bd7438f0029b26ccd338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725329, "uuid": "cc37117a-9db8-4e2e-87d1-04f65e47c4d5", "comment": "Malware payload", "value": "2b12094f3fea6829708fb1468577c733667604e88acc0354090652a0c950113d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725329, "uuid": "98198a2e-48ad-4d2f-bab9-e596ee5af532", "comment": "Malware payload", "value": "442780c4fc6aefea3354d8a0f6b72d533b887a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725329, "uuid": "f505594f-89b0-484f-87d6-7465f7e5c0b9", "comment": "Malware payload", "value": "9c69864c1c4278de9ccdb0dbadd77d75acb523d2a19c2bb09ee7ffd9e9ea173a216e45aa2155dcdb546856a4f276ca68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725329, "uuid": "13692f4f-3afe-4f91-8112-dd7290699946", "value": "T14473F64673EC8247E3BF4F3D9872211786B5B966F496D3CD88C811982CE27807991FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725329, "uuid": "837d0901-0531-423f-af4c-956e150cdc27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725329, "uuid": "5800c214-1c3a-4ab1-9fd5-e6921cfc06bd", "value": "1536:ZwHFzCJHfySl7sCahThScIruaYlTny/NXMThECyT7c7xI40HE:ZY2JHqevYlbaMThEC7l/0HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725329, "uuid": "0b444233-d8ff-4263-b1e6-7d2c453c9cd7", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725329, "uuid": "f1ddc263-ce10-44f8-9e7f-45e005b3e03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725329, "uuid": "3110e414-c7d9-4277-8959-3ccdc7554950", "value": "ShieldGuardVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50009348-45f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777703815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703815, "uuid": "d5af3c76-a6aa-4485-b599-e4c1f00fe4a3", "comment": "Malware payload", "value": "ea80eb112328876f38f4bfdfe64a4e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703815, "uuid": "28a2f87c-b114-4ce2-89db-ebfd1ab1b636", "comment": "Malware payload", "value": "2dad3859c9f669335c7c52871ac1c8d6c51c99eb0f7d2ecbd20795289d387695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703815, "uuid": "7b924cb1-30b2-494f-8ba3-c99293bedfab", "comment": "Malware payload", "value": "2fa78eb54803d4889600e4deb92103614fa189e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703815, "uuid": "ca58149d-a455-47ee-86b4-645530ff2ca0", "comment": "Malware payload", "value": "a7abba5ea4eed8cef7fba87ea42e9f9bef4f68cde0b5f42fdc71f618c213010bb2170a989f751d9b7c698cabd9398fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703815, "uuid": "715c2c81-4ab6-4b81-ad8f-8900b5655b83", "value": "T101A513F3DE832A9BD47075303EA4760D82B178A71E738B5A02ED39875A56DC0851FACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703815, "uuid": "67bc6489-153b-4de6-883d-5da863833658", "value": "db913b86a5b5d3b8b7318f1f82bd6bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703815, "uuid": "10307c80-331d-43e6-99ec-366509844ba9", "value": "24576:QKnrmxgnBuqnWnMH75YxplVkyY94NdePpyBmSYCjWUG0Q8dZ:QIgqy+zudL9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777703815, "uuid": "7971d357-ef83-4d1b-b434-804629aef95d", "value": 2142544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777703815, "uuid": "b9882317-8a03-4d9f-a094-31063e06a06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703815, "uuid": "7e213666-c3b4-439b-b24b-d0d469b0e5c7", "value": "SecuriteInfo.com.Trojan.PWS.Siggen5.33119.6735.25451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7404e50-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734912, "uuid": "64acdd65-98b6-462f-9c0f-1d870bbc5cf5", "comment": "Malware payload (Mirai)", "value": "0606751f6a50c40c4b2a83a3c94f83f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734912, "uuid": "699d31fa-3613-4c06-b62e-809c6ca49e27", "comment": "Malware payload (Mirai)", "value": "2e3da45ea758fd41514e3b440daa09270eb194df0a49c416f32874294898e706", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734912, "uuid": "4f492805-8269-4eab-84e5-d21e793dc418", "comment": "Malware payload (Mirai)", "value": "cecfd0c562115281d196e7181a66cfd4456c662f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734912, "uuid": "e7d52fd0-eb89-44a3-95d0-96a745c99402", "comment": "Malware payload (Mirai)", "value": "68c9b5f9517340721c5f059fb9bff7f2968b7f8ff0911304c9076c504b8ae41f76b6ce939e7d899c190ad3930c04e750", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734912, "uuid": "ac7afcd2-e5f1-4646-ae98-54d539f899d6", "value": "T124B57C47B708B9BEF646733784574A0E24047F12C0815F33A2B5F4AD5E7A1A91F3A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734912, "uuid": "56c5d2b6-f079-4173-a9ef-b3eb08605347", "value": "24576:CmN2XQnrXKVxWijPmsSfVMEFU+Ehh8WXH0GLW5GqIvQvZbhrkqnkv6:CmN2XwrXK3Pq3E38WXH0mBqHvZbhrBkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734912, "uuid": "631d85c0-1dbb-4e6b-84ff-093eb23a3822", "value": 2322940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734912, "uuid": "db0817ed-f194-4dcc-965e-29a7d3e3f920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734912, "uuid": "b75da937-d8f3-41fc-b0ee-0cedc9bf2b53", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266bc809-4628-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777727368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727368, "uuid": "a2931f26-d12c-4caa-85a9-7259c5727587", "comment": "Malware payload", "value": "0837691f5969f3a571752b4752c96f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proton_rat", "colour": "#A796BC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727368, "uuid": "ac0eac06-7db8-41dd-9f7c-e13e8df2b646", "comment": "Malware payload", "value": "2f20b2820626c1e20aea3029165dfb5080af836a74cef98ff354998ead5b474e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proton_rat", "colour": "#A796BC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727368, "uuid": "2482ca6a-d044-442d-870c-d367e085755d", "comment": "Malware payload", "value": "7587f17ae41029a904c662874a3916b55f398716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proton_rat", "colour": "#A796BC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727368, "uuid": "71575880-6b63-42ea-bb5b-96027197023e", "comment": "Malware payload", "value": "90cba0a6d4d9403ad959042085bcbb1d40b7fd77ebb4ea532feb0d0e162bd8acd2a63c5a0093ef9304fbc00e45b0ca4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proton_rat", "colour": "#A796BC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727368, "uuid": "6ce7ff05-ca1b-4aee-8417-4fe2ad062ae4", "value": "T1EEF3198131EE5F29EA7907F9E3E35B84DB7CE8154386E31F60902420FD383D6B55269A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727368, "uuid": "f72a3963-0433-4f38-879a-4399092fbbc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727368, "uuid": "18431a85-bd84-4023-9c0d-6479f27e629f", "value": "3072:jD9R1W3GMNAx7d28n7zJyzBMwutgjyXzbVpzSAguU:g3GMNy7dlEQScbWAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777727368, "uuid": "628ab526-9634-42c4-bf48-cefbe8afd6b3", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777727368, "uuid": "cda97bd8-8afa-4407-ac2d-7fbd4c373358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727368, "uuid": "80f5fe81-970f-4091-8f72-4bd192ec77ea", "value": "starkbucks.it.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d16d8d5-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766114, "uuid": "8d988b71-b7be-47fd-9054-0cfc36821507", "comment": "Malware payload (Mirai)", "value": "353e8027378f89d8608cb735e3f7ed63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766114, "uuid": "f5dbcdea-2b2b-47c3-9f33-668a263051ce", "comment": "Malware payload (Mirai)", "value": "2f95cf7ff5dc555a8bb1eb7da372a0b717048b52e2bb63fe77336852c7246de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766114, "uuid": "238b1114-7b2f-47d2-affc-13c4f5c29c8b", "comment": "Malware payload (Mirai)", "value": "4a34b0dffc8a5b529246941aad256e7d6233be03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766114, "uuid": "afd65ad2-5a2a-4a20-90c5-980d525c5095", "comment": "Malware payload (Mirai)", "value": "517f1db0507285554d3bb70a788f41ba77942e8b8b483c5d3d2c49a75cbccc27d6a8a058a0c35e307ab79507ba09c052", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766114, "uuid": "bbb79700-6ed2-495c-98ad-ecadf9f1cf13", "value": "T128040905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766114, "uuid": "5b07d806-45a9-4f82-87bc-7a1cc3edecd1", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2worKFLYV0fCtZ1SD39rsJzjM9fx49SY29:t3nEr5dfHPq7UTo+FsvR9X0l65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766114, "uuid": "227c328b-105a-4692-87e2-a728d73d1219", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766114, "uuid": "0d63e1c3-0c08-44a3-8ef3-444f284af0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766114, "uuid": "85ee1785-47f0-41b0-b602-daea89537339", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cb5f03-466a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777755817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777755817, "uuid": "b472edf2-cbcd-4cbb-b2de-ce5d531a090c", "comment": "Malware payload", "value": "01896fbb58e8edefc5a8392e467c2260", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777755817, "uuid": "26543d78-0ff9-471f-8208-5fbcda5e9bf6", "comment": "Malware payload", "value": "2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777755817, "uuid": "7be25dfe-f7c4-4695-8a42-bf1d4253206a", "comment": "Malware payload", "value": "0827b2893ea31c1dd307ac4d465edba631afa845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777755817, "uuid": "8ace825e-eac7-4cbc-81f2-8b23ac2a3ddd", "comment": "Malware payload", "value": "6177ad68ca0d30426d23f80d7b6f9cda4883fd4d2036453c291367b99a7ff3b1c7e1f492a0895c846c09ba7e572e2ed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777755817, "uuid": "f562444c-d481-497b-a723-0de4b6c295aa", "value": "T187364AC7FC9049A5C0AEA33589629253BA717C486F3023D76B50FF282F76BD06A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777755817, "uuid": "32047ef3-a43b-4002-a6d3-140bdad7991e", "value": "49152:DajV5ZeB/Ng/lqNA+PAHnxw/Bu5R4z6zFJGbvz/TtEpfLesr9sr20fwJLMoGI596:DseZxNjCR4cE6SkGI59lEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777755817, "uuid": "37326cc3-7a1b-4ab5-82e2-480c9d652150", "value": 5329044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777755817, "uuid": "1093da14-7c5c-418e-8bfa-aceb76b1f775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777755817, "uuid": "b5a879e2-4d30-4a81-b32b-f92dd7187405", "value": "2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0fa1e2-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725283, "uuid": "90e5910d-e945-41ff-b012-d45d01aec457", "comment": "Malware payload", "value": "67fe4d2c216d24549bd88ba29566073f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725283, "uuid": "c1b6821f-3821-4459-b527-4e24da354d12", "comment": "Malware payload", "value": "2fef647dd33e9312d456a49196b8ad4b4d42954f10940bf45b94c87016644b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725283, "uuid": "31bb2ba7-dd1b-4ffb-b6d5-95f3ab7e8437", "comment": "Malware payload", "value": "36148397390c1f7b936b31d9ddfd3c518a5b1024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725283, "uuid": "a439b0ea-21b6-4285-9ac8-10d56c7fbd0c", "comment": "Malware payload", "value": "c2c70787088e1b4ea22ac53a53784abf75c857cd66f2219a6994bc5c78054eec5cddea2def9a04d585fb43d76e1ee261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725283, "uuid": "80384910-c6e4-4b70-8400-2973b33c9e71", "value": "T1D742B69259E2CC2BD7D19F7A6B5F87AD3321E283C28F6B27521C99183C1768C5F22741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725283, "uuid": "ebb9ddf6-2e63-4176-ad60-b1f28beec5ab", "value": "192:f2eDVSDWbJe1ol753gd5ib9JZPYf1b5668SG:f2eaWbJb5qib6f1bE6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725283, "uuid": "11ebb651-e3a8-4952-944b-1e5cbad0d6d2", "value": 12792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725283, "uuid": "0b8047d8-fa49-4f70-b7a9-18399482de36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725283, "uuid": "151bd4e9-67a2-48d7-bdd2-2f4277e65e4f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100a12c-465c-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749907, "uuid": "20a6d24b-1dbd-43af-ade3-ab192c0a364c", "comment": "Malware payload (ConnectWise)", "value": "bfe9a304b08b8b5bf9a6aa5ed13b18f8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749907, "uuid": "3fc9cc66-ae06-4c81-b441-360ca59af282", "comment": "Malware payload (ConnectWise)", "value": "304b1984a41b3544738b405efa1cb88ded18dbc09933c0be6259ad4940213bf7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749907, "uuid": "9e62ad32-9349-4b1a-8d78-e1559c0d7f8f", "comment": "Malware payload (ConnectWise)", "value": "d919a2df54f4556c2f1ddfc1e33b4326db430cfd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749907, "uuid": "a58076f0-215f-4aa0-bb69-dbc051a83350", "comment": "Malware payload (ConnectWise)", "value": "219e57052c4c68cb0ab0c29367a694f64baeebaf41fa260479d1a5206f950ae4acd40c45b172e5cb9c2deef2e65ea964", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749907, "uuid": "cf8056ec-8659-4882-b3ef-a9393459869c", "value": "T109836C43B5D18476E9720E3118B1D9B4593FBE110EA48EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749907, "uuid": "c919ae14-614f-44b1-a63d-fbf942785484", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749907, "uuid": "ae306000-c71e-432d-bc45-249042b1cce5", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv7nJ4:4enkyfPAwiMq0RqRfbaWZJYYvt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749907, "uuid": "18178a1f-95ef-4328-a453-a1c4c766a038", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749907, "uuid": "75dfc998-e310-42f6-9a06-7283b3c87364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749907, "uuid": "d4638588-5bbc-439c-a7be-411397bf7ddd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce67fc1b-45bc-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777681264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681264, "uuid": "2ed02b72-0e27-40d7-9fcb-f21584b3784a", "comment": "Malware payload (SheetRAT)", "value": "d2a75acfccac69f196cde58a3ebb278c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681264, "uuid": "ad001eae-1b14-49da-a7e2-31bc1c2ced7f", "comment": "Malware payload (SheetRAT)", "value": "30a69ebcfce22e0a4944730a59d5ee1bcbd4ae5fe65687dafa540d2e7d9778ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681264, "uuid": "0d8b433c-e5e2-4187-9389-13e26a9a03ab", "comment": "Malware payload (SheetRAT)", "value": "dc59342b304702f04f9f465ab15404535d14f943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681264, "uuid": "a3a1473e-ced8-4d1b-8aba-b3a00464bad8", "comment": "Malware payload (SheetRAT)", "value": "4f4053fc82e902bedc11fc47674bf3ab73d8dc659347404b97132a480db2e1adb602526c70a8443730ccfee9bad49c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681264, "uuid": "8f9595c4-2527-4234-8a7c-7d9822816138", "value": "T16535CF0527E6DE01E23E637D406482C843FDA9045D86DF5693E53AFB2BCE392EB1614B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681264, "uuid": "9873c8ed-da95-4918-b302-44026329339e", "value": "24576:eXgCOX6eCAblLznOnK4s8UdF7asuBPL2XV9:eXgCC7b4c3bavj2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777681264, "uuid": "7cc35390-76f4-4ea6-abea-647db4316152", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777681264, "uuid": "610c6763-3852-4148-a8b6-3c8feed7a311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681264, "uuid": "cb280427-8fe9-4cec-bc17-2842a09afcd8", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8c4429-4627-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777727086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727086, "uuid": "dc93563a-5c8d-4532-b1a8-9238fa5516e2", "comment": "Malware payload", "value": "3ef795d304a15fc7adc44833d944fcc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727086, "uuid": "3a8888db-5db6-4c70-95cf-9117d29419a8", "comment": "Malware payload", "value": "325c5698efe8e95ed1d11f7f2a48f24c648eea08aed88659709d58f1a9960fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727086, "uuid": "7cc0ab6d-88d5-40b7-b216-dfaa6f6e8429", "comment": "Malware payload", "value": "f474b79fe979aa0cb4b696197864f782dd24e2cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727086, "uuid": "b2f70c7c-9597-40a2-acf9-d666f6af6a61", "comment": "Malware payload", "value": "55760f4a71e06c3106fd1935098ff761585309d167144777ba0a28e139c01757bed5d578a382800c9770e9407b364b90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727086, "uuid": "d4c7b679-bd94-4cf2-ba47-a62c3082ce17", "value": "T1F852A58F5724AFFEF6E9C7348AF3873592D8229292C0C78EE15CD4050D6970A9D1EB46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727086, "uuid": "3666165e-f130-47e8-b48a-f50d95ec645c", "value": "192:yLn5hNoB1XzV01ZD3ePb3ZDxd3O3dsHuw/8UekTCP5WBBG:yLqB1jV01ZD3ePbhxdyouw/cPcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777727086, "uuid": "c175f97e-2955-461b-a48a-282354b6e4b5", "value": 13380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777727086, "uuid": "a2f947c0-e4a6-479b-b857-7e3e74d4e750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727086, "uuid": "5bc62d4c-03d7-450f-8c51-edd94117686a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6cead4-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719221, "uuid": "ee5827a7-b2b9-4ed6-9ab5-c1ef249418f9", "comment": "Malware payload (Mirai)", "value": "3fcfe2c22293d6ecde279e3fa5502eee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719221, "uuid": "4ef01b6a-3de8-42bb-852a-8568b12456b4", "comment": "Malware payload (Mirai)", "value": "3266d6ebd1b3e16683d43a5c726cc08d89870fdc9e9aa41332c72d33ab6598b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719221, "uuid": "6af3d145-1e53-48bc-9511-2f3b10007c8c", "comment": "Malware payload (Mirai)", "value": "1df2bfbb93a165cd2bd37bd917c9d691be478042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719221, "uuid": "ae229e33-1653-441a-9d13-6456312c63ab", "comment": "Malware payload (Mirai)", "value": "9b9d62801a5d5fe8c90f76be1de254f1b72f0de80d14cae5ae2fadb34a7b282e0f4e9e96f5396b249bdff16a342e4470", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719221, "uuid": "503857a3-308e-4ad5-bb26-89ddf7c4f96c", "value": "T16A8302B448B3CC91CEE22879CB71ACD465968EFA89D478126D4092F0244D61E79EC9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719221, "uuid": "64b6b6cf-5bd8-43ec-8851-187968bc9e9e", "value": "1536:wiEOdBdCN1ygJm4OT0Zvki0PFatoUls88LOX+5u1eW7W:7g1yeUU2PctjszLo+5uL7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719221, "uuid": "22bffebd-ad0f-4060-933a-4af92a0cd293", "value": 84180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719221, "uuid": "fc6bc287-c81c-4e37-bf47-75d14a8f96c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719221, "uuid": "81f3de84-02ee-45ca-9090-794a7f322a7c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9466538-45e4-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777698435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698435, "uuid": "fd5a3b14-11ea-4818-a0ec-1920f9d05214", "comment": "Malware payload (CountLoader)", "value": "5b327c6e4f1630c3efdd69ea670f65bf", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698435, "uuid": "a0580c95-65d8-4300-8503-ed53161c8f35", "comment": "Malware payload (CountLoader)", "value": "32c2cb18086de11c830b1ec301f5e54998b6fb07c7270dd08d8e0907d00b633a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698435, "uuid": "778fe422-7501-4705-9810-e390fcba8e3c", "comment": "Malware payload (CountLoader)", "value": "dd60f382aa8bfdea024b36192aac4b5b6b0cfa05", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698435, "uuid": "c1fa1d75-fe66-4a3b-91d4-bdeda60968a4", "comment": "Malware payload (CountLoader)", "value": "ef3e5b91495b878a9f29c04ecf0a4d896af57b981e2f52380de408ada91212f625e3e79734022b71f6662fae203b9f58", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698435, "uuid": "e1a81ad3-b811-47b1-8b70-2e81d7f683ac", "value": "T1F7063A50A88608B0D127053898DB73EF13388D1A4B75A7F396D4797A7DBB2E54C3237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698435, "uuid": "bb370471-b881-45d1-acfa-f22c16a037d1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698435, "uuid": "ca796553-a755-46f0-8341-61051056f380", "value": "49152:0PnpvI9zsgspJOtdknmAY3IjMXab9aTyw8bsusT664:UxI9zsHnmAyI1qusT74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777698435, "uuid": "48fa6540-aa8a-4acd-9fe7-18fdaf78bdd9", "value": 3979264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777698435, "uuid": "11b234aa-44cd-400b-b27b-a33d2b232ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698435, "uuid": "fd52d8b6-9aed-4ebf-b8da-0087b8b5786e", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca022d4-464f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744155, "uuid": "89954f2e-c6ce-4b1d-ad23-66fb9b14faeb", "comment": "Malware payload", "value": "f1225540d8f63d4ecc377047c0fb0e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744155, "uuid": "fe0e373f-57d6-428c-b421-123ad40fe2df", "comment": "Malware payload", "value": "3340e282b20981c45c3ceb330ec3a2ae5ed41113ad98c342726e40e951080b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744155, "uuid": "56e0909c-137d-4a82-9d6a-3d100f73d653", "comment": "Malware payload", "value": "2caebe725c6f3860486ca04cf8a46b84cd96417b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744155, "uuid": "5376d028-6ef2-4419-bced-43227eda78c6", "comment": "Malware payload", "value": "cc0d8c54b32ca6399776103a16bf8bbeeccc6e0ee8366c5c518dd6686f0aa06c2efcc4864c2b14f1a52ed8eddae89cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744155, "uuid": "fba87e4c-db83-4228-92a9-499307f23599", "value": "T134B2C078D1281986FFABA97E5DD2F7C133D68AD9758E654751C0CB022522A373702DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744155, "uuid": "5c669287-fc4f-455e-85b8-bc6a86b673ae", "value": "384:cl00SlVLf3bSPwsDncvT+LPFn53XFK1uWSpeRRkQFJTnFwqO9jM4uVcqgw05VxJJ:g0llZuPwsTzLt5AvJjkQFlFwv9g4uVc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744155, "uuid": "ac25db03-2230-4487-b426-c5d394d0083e", "value": 23832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744155, "uuid": "2d14a0c7-2611-403b-b3cb-5a900315b594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744155, "uuid": "d6930c53-db7f-4382-bd53-1d26e3a35c18", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70a9bf-45ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701882, "uuid": "c659e210-d8b8-4cbd-bc09-41882c5872ab", "comment": "Malware payload (Mirai)", "value": "19dfcbd3726d6803844fb30dc04502ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701882, "uuid": "6ef80a6a-c6f2-4721-9e37-b6d5f7859671", "comment": "Malware payload (Mirai)", "value": "336db0baaeb3528aad5ec906dbd2253827900e60d697be3e8d830c232c7d07d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701882, "uuid": "22bd17ae-5870-4d05-ae5b-3e69892c7fc6", "comment": "Malware payload (Mirai)", "value": "25081bdec05f64eb4f313420c82d8de957e30026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701882, "uuid": "ce7aa1d4-b66e-49ef-9da9-cbcd2aca6e1d", "comment": "Malware payload (Mirai)", "value": "49b1bcfc553d5a123fbe55d83a1aa3e06f32048137c7ffa01a97278f4c85199be0236ee52fae72c2e2961937aa8cd9bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701882, "uuid": "c2e7c3c4-a727-478d-aece-9829163d4b57", "value": "T162C44A59A8419791D5D02BBBFF1E934873131B38E3EFB0069D196B246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701882, "uuid": "c8026603-98ba-4d21-a70d-73b782c07e0f", "value": "12288:TqqtEpaU1C3yYLDaYwwHC7TLuEFKnRyckTDKyYYV0A8TKpYajQEOr0SefYiyURW:TftFyYYwHCJLckT9OAc+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701882, "uuid": "7d612c1c-8c3d-4f54-b9b9-024a9bdbabdc", "value": 576764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701882, "uuid": "eb25aeb9-32cf-4598-ba0f-e0c6aaef57ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701882, "uuid": "c1f76007-6516-4506-905d-f586cd9478a6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e77dd-465b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777749591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749591, "uuid": "4873aac8-0aee-4363-851b-4803c9e8cfb3", "comment": "Malware payload", "value": "7681b05922405c6b4bdbba02af2289ab", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749591, "uuid": "c3438f20-014d-43ff-a037-7ba4ce84045b", "comment": "Malware payload", "value": "343a723eea59c7eecdc6b559837d703dd592fb1d42dc39651b06570fd144a81e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749591, "uuid": "dc30005f-5e1a-4501-9b8a-118a76ceb168", "comment": "Malware payload", "value": "7009e3a2996a12d3edd52ddd7e513259d89ccc04", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749591, "uuid": "4256da3e-a0f4-4277-a89e-1a63784298b7", "comment": "Malware payload", "value": "19f83d60582d440fcae53ac86a331637fff843b0976ce5f643e262c569d2a97fc33057ea8dfa5b7dffe5d1d6c97863ba", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749591, "uuid": "d34ab1b5-56d0-4ec6-be98-655106c0d38c", "value": "T14546E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749591, "uuid": "53bdbc23-1c25-4ee7-adb3-d7f21be7918d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749591, "uuid": "9b84fed0-f3c8-4e6e-8cf8-34d55c3de5b6", "value": "98304:7zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:7hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749591, "uuid": "e7908303-8fe0-4370-892b-2af819166f08", "value": 5687216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749591, "uuid": "7f1dc70a-a9e5-4a99-8a1a-9afb2a912109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749591, "uuid": "55e5689b-f756-4efb-8ed1-8f57a0681b60", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117431f2-4631-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777731198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731198, "uuid": "426872ed-c82a-4088-9549-9ddbc7ba186b", "comment": "Malware payload", "value": "53b9a409b250a1c6f01aaa52b069d549", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731198, "uuid": "6b66dd0b-5825-482e-bdca-9ac5539be5bb", "comment": "Malware payload", "value": "347e3ef094831fd280628c711804603f695b020e365606174a6ba118ebf56cff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731198, "uuid": "e6444e15-4a2c-494c-a380-8803bd223961", "comment": "Malware payload", "value": "fcb84d4f82d756b5afc784d79ea28a013749ed78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731198, "uuid": "4fb65b61-1cc4-4f41-9baf-ff6ab24cd73f", "comment": "Malware payload", "value": "929f0d731d1319be935eccb6f5be628f84358c84b12d2fdbbc5377c2a0c9948e9515743e364de4390cc7b329d4bfdc2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731198, "uuid": "26565108-8c03-4aee-ac76-7a47cb74400f", "value": "T15B16331785C45C43B033B799A65CBD91CA6AE9224F4608F95B0B691810F8CEE2C7FBD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731198, "uuid": "8d249c67-5198-49fe-9935-684bccd01d2a", "value": "98304:HUWbUrKCsIXSyTYgOuqwOYFDynk9WInLqc8mOA/KoV:08APsyT3EwOYFDzPv8mOuxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777731198, "uuid": "45507f86-cdf0-47a3-a5ae-f0c3427f700a", "value": 4021043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777731198, "uuid": "cb13d391-9911-406a-a57c-bfa143ed0a7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731198, "uuid": "c2b7875c-499d-4359-b81b-3a75fe0acad3", "value": "BottingCentral.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f044260-461b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777721745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721745, "uuid": "95f5db61-0575-4606-949a-5b9e6588ffa2", "comment": "Malware payload", "value": "27368965f154ffbfc84a48a9cbb3793c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721745, "uuid": "aad2d4d2-1874-48af-bb4a-8caed3de6fc0", "comment": "Malware payload", "value": "3485ce754879209e59d5700f176448657a17f7048f7d246ca218fc255e43da7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721745, "uuid": "3d07cbe3-383e-4179-9dfd-08b739569862", "comment": "Malware payload", "value": "8febfaff7d69b9c51435cddde2a07b741cbfb6ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721745, "uuid": "f39d9d0f-dde2-4a33-a093-4b4a97db54e9", "comment": "Malware payload", "value": "b5268f1c7c687c45dce6d611158f5696cc3a4532d78910bb03a0c9e0ef15b48997ed573176edda3153f6a0957f97d86d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721745, "uuid": "3b7a8c95-67f7-409a-b8b8-2167e712de3c", "value": "T1D312621B93B8AE17C8D1E33130D35325A3AAA6C6C59C874F69086CDD7A963841D3F399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721745, "uuid": "679f8277-d97e-4ecb-a676-61c8df94203e", "value": "192:CFDOSeOyzYMkcahJH3PgKYsy/z0/FIsgfc2hU0vxP5oJSG:0rMkcofnYLLXVSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777721745, "uuid": "6b8d7719-a57a-47b3-a95e-ca566fdc264a", "value": 9891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777721745, "uuid": "d65b3cbb-5e3a-43ef-8be4-c802c123e737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721745, "uuid": "1df7c4c1-f19e-4d32-a34c-fab9eded39d8", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc215d30-45ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701849, "uuid": "6ed8d3e2-2bcc-4e4b-aca4-684c88d5fb69", "comment": "Malware payload (Mirai)", "value": "bec95007444cbb715edd06727c67aec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701849, "uuid": "b956e368-d342-4e4c-9a02-e101597de842", "comment": "Malware payload (Mirai)", "value": "34c085e9180b5d76db3014a6c3f8e27fbb1d76e0e42db528721dd9a28f3bcac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701849, "uuid": "7175ebfb-3b26-4a1c-87ac-4637d7325789", "comment": "Malware payload (Mirai)", "value": "dea9b13bf13ca566986640d3d862bee6e48fe44c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701849, "uuid": "a857a77b-0d3a-452c-ad02-d9460f59b86c", "comment": "Malware payload (Mirai)", "value": "d3f32caa58051437d0dd9c7a35c623c97e82504a5caa81d6b80caf209ca15ba5057094453e614a60a3d316ec11dc70d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701849, "uuid": "945bf5d9-a988-4cff-ad3c-7f50f8d4bafb", "value": "T13544238589D3A5C9083DF7F2347D835D7093D76E1F0C6B24AE04BB618AC049B6E05B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701849, "uuid": "9ef82c2b-c6b4-43d1-9cb2-3d177e19450e", "value": "6144:SOmnHFXZoowWJnIAKx0TaqZ6do8QjvQxOqfGK44VF9gljyY8Wqekv:SOwFJoowWVIA80RZuojbQTfZ44VF9gxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701849, "uuid": "df2503f6-b92a-4d18-b71b-462c22416a93", "value": 277320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701849, "uuid": "5f02f9ea-8105-4289-9d4c-33978e1b91d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701849, "uuid": "9e4d3e86-9eb3-413f-a772-07d6be249852", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9734516-4629-11f1-a769-42010a9c0008", "comment": "Malware payload (AZORult)", "timestamp": 1777728124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728124, "uuid": "0eb06d54-80e6-4cef-96a1-717a69e4ce13", "comment": "Malware payload (AZORult)", "value": "6b12afb775ec4b8a046f79f79164b5a8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlg-eu-cc", "colour": "#C9AD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728124, "uuid": "ccfbac64-3f50-408d-8eb1-6ad1f72e38a6", "comment": "Malware payload (AZORult)", "value": "353b74e4fca84879a4f7406e1ab7972761bfec524b15294b9feab567b8d0744b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlg-eu-cc", "colour": "#C9AD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728124, "uuid": "38e511ee-7e51-4306-b812-44cfc662ff0f", "comment": "Malware payload (AZORult)", "value": "04e23dced5030e6ed1be15829a50b912fd386391", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlg-eu-cc", "colour": "#C9AD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728124, "uuid": "fb9447c1-487a-4b83-b531-4dd8bb63030d", "comment": "Malware payload (AZORult)", "value": "73eff15b336ffae4c77daad35f301f5226033245787a96fd85beea7214efdf213005948e8339ac305cf4f2d8ca1c14e4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "dnlg-eu-cc", "colour": "#C9AD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728124, "uuid": "55361392-acb7-4cb0-8f00-a920aa3eb16d", "value": "T178B32A6EF7C18277D02408BDCD45A1B9907975302E391822F7E64F6CD9F96C26A6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728124, "uuid": "15a30dfc-9587-4fc7-9169-ccb9a3c5663c", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728124, "uuid": "3690b3b7-afb6-4a6e-98c0-a8a5e04adb98", "value": "3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgiNq:faZ1tme++wiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777728124, "uuid": "976141f6-395b-45f8-a27a-c35a26d3063b", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777728124, "uuid": "919dbb84-8ec9-4c6e-af12-38a2b50496f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728124, "uuid": "6743cbc2-6e4d-48a4-900e-7d3b018d387f", "value": "keygen-step-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf59a4b-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736641, "uuid": "fbc17819-20c8-4b4a-8598-a4e2c1cc84d3", "comment": "Malware payload (Mirai)", "value": "9b8440b46b37051fea10f502a5a63b17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736641, "uuid": "38fc2a4a-fde1-43bb-a3e1-cff187c06286", "comment": "Malware payload (Mirai)", "value": "35e068d9614a0a2d71ac4a935b45ff11d9e674c124da14e0df092d72003f0d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736641, "uuid": "4fc3f91e-a33d-456e-a254-0d0f0cabba73", "comment": "Malware payload (Mirai)", "value": "cfc93b7353493219b1c1147f13e00bb2f8486444", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736641, "uuid": "79443add-ebf9-417e-a019-11f455e25d1d", "comment": "Malware payload (Mirai)", "value": "cb748f021a2aea2932db33d9372716658aa291f22b0a62bbcb8c10ac26cf06fe82dba004c0a1aecaf2a9ec2629692307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736641, "uuid": "2e2970ba-125b-4f34-827d-3170728c5217", "value": "T1EC438E36C47FADA8C5858638A42149741F63F50882A7AFFA9BC587645047FFCF6083E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736641, "uuid": "c715d679-1da3-40f6-8015-31e4bf1cfeaa", "value": "1536:rHdIcHE2ZwtdWbKWjUKbq9V9R3qLw2h5Cwmd42+:rHFHE2Znuz9ZqLw2h5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736641, "uuid": "e2a0e3b2-84c6-4788-bdfd-a8721f336b16", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736641, "uuid": "958bcf70-1bcf-4834-91b2-14c8bc728472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736641, "uuid": "bbf2975c-135d-48dd-9c68-1dbfe70236c4", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49331a94-464d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777743317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743317, "uuid": "3b23d9bd-4347-4c48-b07f-42b2df9f63d0", "comment": "Malware payload", "value": "a2d70eaf5aa7e9e57a5a4a17f6815da1", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743317, "uuid": "e047359b-15d4-4d7a-a428-67e12fe97f62", "comment": "Malware payload", "value": "35f92d6f8194d4f6529f209c01f2cfc54492f15834dabb96d0e339fd72f7b8d3", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743317, "uuid": "d7e63292-cd39-44ff-a3ab-f181b394a04f", "comment": "Malware payload", "value": "7e2faa4b097a55f1ce27b8ea52e1ff4f058ac1b1", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743317, "uuid": "48026f40-d7b4-451c-a0eb-57b7dbf58a4b", "comment": "Malware payload", "value": "86c58ba177456dda6a1189d5a5cfbec889d9b7e38cb1b2abec90e043003f53e3ae0c23fe36e122e1f5d7c51975a1e87c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743317, "uuid": "6311df54-f24e-44c2-92e6-39dbb19829fb", "value": "T11B46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743317, "uuid": "2fba74b8-a437-44ba-be27-4af6c9c8ca88", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743317, "uuid": "ae718a6c-8df3-4b8c-a3eb-ab34d14202bf", "value": "49152:kfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8ifk:Iqs6efP3rn/TYGVxz3GBwRVkGuyXOMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743317, "uuid": "5c4822ec-85c0-4c07-9388-231feda45896", "value": 5698184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743317, "uuid": "5d17c2b9-2451-4ac9-b665-a6ad154c1c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743317, "uuid": "8fadf4fe-e6c3-4e5a-a44b-c717929f6cbb", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f47776-45ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777702918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702918, "uuid": "ae92e30b-1748-46bc-bb36-c74e54cda535", "comment": "Malware payload (Mirai)", "value": "02ab0edd84876a6ecade2146cc53b22d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702918, "uuid": "6bc37ecf-17e9-4ad0-9105-2d75f49dcc76", "comment": "Malware payload (Mirai)", "value": "3628140634d2b0e9583359421bcf8d08e0fc667fc434fc7b4dcc4bb8fb6fa6f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702918, "uuid": "c162419a-379e-498b-963a-c0e50bc829e1", "comment": "Malware payload (Mirai)", "value": "c4102467ce1ef7cf314e78d363fc7b9525d1c3bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702918, "uuid": "92e6fc8c-e79e-4445-84ab-667cb75d6643", "comment": "Malware payload (Mirai)", "value": "c78f9e0e9b4c34a2200d7aa2d293870cf089be8f0b551c4d72a1212baddd335812122337cf9f85d4d7150b5f6b8b6dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702918, "uuid": "71c809f2-8aee-4df4-bdd7-e53dc64d1c88", "value": "T12A63511E2A618FADFB6D873447B75E21F24873D212E2C640E15CE9015EA034E785FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702918, "uuid": "33a86e16-d772-440c-aaca-e1a0cff0ed25", "value": "1536:FqZqWtGWyu8jDZApvDMNYdDiwZwnRwbZnF:FGGWMlAGNYdDiwZoRwbZnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777702918, "uuid": "520b874d-243e-4144-ba14-2f9cb4c96048", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777702918, "uuid": "eb293f99-5258-4cc1-9a65-6a451f915881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702918, "uuid": "7649257d-8481-4b49-ae62-948f40599bf8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d447f60f-45dc-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777695018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695018, "uuid": "dea17aeb-85a6-40d0-8003-9e9e86cf07fb", "comment": "Malware payload (SalatStealer)", "value": "d9501e2e56f8166eb7cf28d124428538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695018, "uuid": "f0fed922-a276-4b50-aa46-b845d3e4c407", "comment": "Malware payload (SalatStealer)", "value": "37930e1df920a9122d1f384a18f1ebd304882d382927d40d42f40aa77c200ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695018, "uuid": "c19372f1-8338-4bfe-afd5-b0ae6ea979fa", "comment": "Malware payload (SalatStealer)", "value": "042067b36d828939400e40dc14eb63e571ae7c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777695018, "uuid": "2295b9ea-3101-4030-81d4-c8a0ccee8ed9", "comment": "Malware payload (SalatStealer)", "value": "61df71165fd96a6df877069a8de228c5d002db95abafbf28841ee3d0b3857f545a97aed2ba04e6f93408edb0985b41db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695018, "uuid": "c6eb9133-c023-4aac-a2fa-233f12b72a73", "value": "T174E66C19E253CF6E187713E055655FFCAEEE710E6A6A1687D0F9E24732E606C80BF840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695018, "uuid": "b7d79ed9-2f09-4f31-8b9a-43fcedfb21ca", "value": "1cc1bcaa1fbe3c4be89ec64e10dd828a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695018, "uuid": "bbf68239-22e5-4d74-96d0-c0b85a2d5694", "value": "98304:HzFuefLSUVPIsp9Z2k0qbtyK4kpAWgcX7gH9EcHW89:HzFuKLFVQsx54Rqi9EIW89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777695018, "uuid": "334e9b7a-9549-4738-8b88-f25feedf80bd", "value": 15023428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777695018, "uuid": "e419bb5b-5d85-4ddc-afd7-827bc810b356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777695018, "uuid": "cbdbfab6-2a25-4464-9fd6-297c4249fc7f", "value": "BootstrapperNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe9d797-45c1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777683199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683199, "uuid": "aaf13c6c-2421-4424-b693-fa60c2a338b1", "comment": "Malware payload (SalatStealer)", "value": "055cd687bfa96d99f0d1f042cd55c3b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683199, "uuid": "103cea96-846c-4aca-b559-3b7b81f94069", "comment": "Malware payload (SalatStealer)", "value": "37a2b1d8867f6171e6d4683ca18ef92b24ab2dbcb4e582769e1aa2dda2de5f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683199, "uuid": "d9ef2a44-ab87-4aa8-85e0-4068fa6a2a6c", "comment": "Malware payload (SalatStealer)", "value": "a2b8135cd5dcd689d882eb417552489f3e0f5c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683199, "uuid": "bb060e2f-1516-4daa-986f-f2d30c851aad", "comment": "Malware payload (SalatStealer)", "value": "1869e305ac177b15652073d6dc61d573660b085b39bb354f214095c2123038db4a4a669978256476b4a6cc4f038584ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683199, "uuid": "e19795f6-bcee-4e37-8e08-64cbb5254ee6", "value": "T1A4F5335CFB2F91BDD64942306B94B4765AF46BC2AF8C696344E8106EF3DC299F837801", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683199, "uuid": "f157f45d-79fd-4f08-897d-f767eb8be78a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683199, "uuid": "805da032-5975-4953-bd64-faab5ab09e31", "value": "98304:sZiIgG60ktoIMnBET2gk3XSPNRzHsIiOp4JPWM/H3:yiIgGBTBET2gm8fTDPpfM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777683199, "uuid": "aa1b8781-20c6-43e7-b8fb-b5a5146b8c75", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777683199, "uuid": "c66f3fd0-1c7d-446c-aa6c-d1276ff6b19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683199, "uuid": "7bce65b1-c210-4c31-a34f-8dffdb3c2ba5", "value": "adadad.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc1968e-45c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777686175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686175, "uuid": "03a384bd-faab-4727-8cd9-65440200db44", "comment": "Malware payload", "value": "d89f78e0ea12671eb30d65277269357f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686175, "uuid": "4e633c5a-c10b-48ff-8793-d0c5968c0eb4", "comment": "Malware payload", "value": "37dc7575fb82f76d19799d0a2b5f5f7ec60d4994468176ce30af543861316742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686175, "uuid": "79079001-7fac-428f-8b4c-a2bb3184e8fa", "comment": "Malware payload", "value": "ec63aa2a3737202267204f748406ccaba93d5f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686175, "uuid": "33e598cc-7cee-4701-a0c1-5fdb78b491f7", "comment": "Malware payload", "value": "a5c189840dce3aba870a5a3b570cf9b1a773cafe44b47efde2fdfb600a8273f077b7bedff9bfc1c2382273b4c7f19fe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686175, "uuid": "44e85e3c-86d7-4c92-b3d0-37a5a774ed1b", "value": "T1ACD7E026B6B40056E8BAD078CA875613DB30FC56533097DB54A8B5BA2F77BE11F39308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686175, "uuid": "e628af15-0cf5-4374-9ddb-76e3df7e4bb3", "value": "93623be26b7327838e48168dc54768a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686175, "uuid": "c0f54a31-5719-4674-9ceb-f5ad2dd8f04a", "value": "393216:wtvpj1XmstgUzBAc343L5Bg6+PTVpgtqO5f1CPwDvt3uFhCQgFe9XbXRfZyEh4Ny:wlpj1XmstgUzBAc34bp+CiSigc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777686175, "uuid": "78b51933-7244-483b-9654-26ce84c68a36", "value": 63195136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777686175, "uuid": "3d241f85-7e7a-4d48-b087-f09646eb2cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686175, "uuid": "8b994b4f-d7db-4163-b634-56ec66dd21e6", "value": "WindowsUpdateHelper_v16_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f2e991-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719227, "uuid": "aba8dd1b-b6b0-404a-8fb8-e5de418e837e", "comment": "Malware payload (Mirai)", "value": "b09a43faf8c0d4314e34ce12ecbf0305", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719227, "uuid": "ec960e66-10ad-4a92-bddb-754da1c3cce7", "comment": "Malware payload (Mirai)", "value": "37f80e6bdd3741e37e47f1db262c47521f551d4487e3b94d24a9a31f93549182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719227, "uuid": "ab52bc34-f1f5-401e-9c00-dc45925bdcfb", "comment": "Malware payload (Mirai)", "value": "db2200086de2b499566b8255386265bb06f0b878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719227, "uuid": "1ba0116a-5363-4b61-ba8c-4244b56055a3", "comment": "Malware payload (Mirai)", "value": "a1a44f6142f9c2ba2df195d635b251e5053963217136aad0036d9b9ea1fede722f99e70fa2993aab98f9d15573bc425b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719227, "uuid": "a5d44179-c072-47b7-a268-e7c2579e0d13", "value": "T1F2747713C8254894E1148CF2226773659E4783BB88D72AF3ED5649A1FF2381F61BAFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719227, "uuid": "ae404123-b872-477e-a5b5-6a4af706517e", "value": "3072:bZk5dxdetTQ+u8F658wjQhsH4WRTS6b+joCTNT:b25k/u8F655LhRbSjos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719227, "uuid": "43ce0858-3be6-46c8-8a7b-6e345092b5be", "value": 358596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719227, "uuid": "19dcf49c-88ca-49e6-827a-e0649b3582c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719227, "uuid": "6da2da8f-38d1-4adc-8942-c0f009919c49", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c435d9b3-4601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777710882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710882, "uuid": "189866cb-0147-4229-9754-e9f790a406ea", "comment": "Malware payload", "value": "a5f13d99d439e4bd2238dd665cf01144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710882, "uuid": "b8cccaf2-4df8-4cdb-9e6a-902fb437e882", "comment": "Malware payload", "value": "387a43c154fce792e97eebe9774ead6a10d8b71652c1752db4042a2702b3cd67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710882, "uuid": "6a7b520c-9256-4a69-85f4-652619583203", "comment": "Malware payload", "value": "91ef02359d36b6f53ac954ef3132e78840094fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710882, "uuid": "ff6fe2dd-159b-4952-bc5c-bba74cf60749", "comment": "Malware payload", "value": "019c6c568042f1785c7f472c7561628110dbe7bf65bacee1cc2263f78ece9d4662137e45d0bca3245f11a2c4f1d0b190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710882, "uuid": "15bac1d3-0fea-4471-8132-2782bd2fa136", "value": "T1D608B446B601CDC7F466927494974FE0A372ECB18AB1836722A93B1D7FFE34C4EA1494", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710882, "uuid": "b6db1d4c-f936-4bf2-b5e9-7f44707610ce", "value": "134463e32c3cbe702e5ab6a4147754d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710882, "uuid": "ca68890d-9f07-46e3-b2b0-58fb02dbd35f", "value": "196608:plJj5fMJPUjfMNLHTiy33fMArDx4C5GRlgoOXFtQFjxXATZk27vbMxJ3ENHXLFhG:TX125NxbGRPifw2VFHiE1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777710882, "uuid": "f64ab0af-6bc5-4062-b39a-ada3358e72da", "value": 81067904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777710882, "uuid": "f3aebfa0-9b4e-4baa-a184-ad60bffe38a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710882, "uuid": "f828352b-6ae3-409c-9935-9f66ae378c6a", "value": "abn-826581000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecdeabf-45f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777705075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705075, "uuid": "1b20ddb3-3378-4307-9f07-76c1b5b3d68a", "comment": "Malware payload (Gafgyt)", "value": "5c1c227da05e9e47c87346034785691c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705075, "uuid": "edb223da-e6fc-402c-8113-997b2d2ec883", "comment": "Malware payload (Gafgyt)", "value": "399eca48573a754f09efb664417d899ed3db5b533ad3c622b1e6f294e5d19f44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705075, "uuid": "07e34309-a300-42db-84e5-bae032ceb097", "comment": "Malware payload (Gafgyt)", "value": "4dee8b454ed19cda846ca7fa13d4cc66ac33e23e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705075, "uuid": "5628e4c5-7522-408e-9435-af783cd658b5", "comment": "Malware payload (Gafgyt)", "value": "6c755ffcb4ecc9cff6cc2a89675beac5a7862c6dd4d89144cda2ea57ac4997ade9c983020eed57d44b818f6106d617ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705075, "uuid": "5adf5307-73dc-4e24-8539-a59f4bfce709", "value": "T1F7B32A17B9528B12C1C215B6FB4E564976136BFCE3EF3212C9249F603B874EB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705075, "uuid": "374190e6-40e6-4b94-93d4-6f0b916c607a", "value": "1536:yLnB+No4uILdyu8HUUjQJ+O3a/1T/TIpPtMbiXfM6RJZf6jRS5yYL5hFp7Bvr:ThZ4PGatTmfM6RJZf6jwQa5hFp7lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777705075, "uuid": "06c91911-a587-44d8-a610-674f2c394673", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777705075, "uuid": "1f00d1cf-9fa9-4561-ba03-db524aaaa1c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705075, "uuid": "30e086a6-809c-409f-9139-6863ac4e63c3", "value": "ar6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bdd008-4658-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777748254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748254, "uuid": "485d91b1-222f-4382-956a-9be2a5f4adcb", "comment": "Malware payload (Mirai)", "value": "fe4513bf27a27ab30b1933d5bb6766ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748254, "uuid": "0b7d9834-c775-403f-8744-3efa8420159e", "comment": "Malware payload (Mirai)", "value": "3abda9d430ba4cabb480d7941429ac66046efae4ebb589a5f0727f5fa2b551b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748254, "uuid": "16122afe-0e67-4b15-a6f7-26f962f12dfa", "comment": "Malware payload (Mirai)", "value": "de2fdb38df9588a5efaa4acf738f3c628cf3ba84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748254, "uuid": "9088d1e5-5830-4976-9997-15823ffe01ed", "comment": "Malware payload (Mirai)", "value": "f3fb9617ae2145eab6edd8789c20341db57b9d9c7413dd20ca6c85b2389c1c7c3ba799ab094d3120c59ef91b2d9cb5f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748254, "uuid": "9c1e9cc7-6993-4a02-8669-51850399f932", "value": "T154B339C1BA43D4F5EC1641307177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748254, "uuid": "346b0700-6eab-40f6-a2ce-5e53660ded09", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wLzSr9bMFfl1:Pbj4doYGFB0/45gdH9ul1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748254, "uuid": "0270670d-be5f-4928-a1b1-9d392ab51f78", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748254, "uuid": "04a2d72e-ef33-45b6-8c18-9ce886e4ec9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748254, "uuid": "767db315-5fd0-4723-a514-cda45d069612", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8efdf5-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745365, "uuid": "c77cf81e-8ddb-45d6-b085-55e322fd798d", "comment": "Malware payload (Mirai)", "value": "0c89e392b38adbb089aa74d8a1adfce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745365, "uuid": "f05637fb-022b-49bd-8293-a451aa7f2ca3", "comment": "Malware payload (Mirai)", "value": "3adcbd5b408f114c772931ab5eb8bff97269cbb22fb54d1db061bc32638c3cf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745365, "uuid": "7d63d56d-36ed-4408-95e6-bb4147f75cef", "comment": "Malware payload (Mirai)", "value": "2bc8f97add86a52d8e1e8fb2c82bb256dc59c18f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745365, "uuid": "111a9024-c9a7-4a1a-a08d-b5f28bf01068", "comment": "Malware payload (Mirai)", "value": "bbab806a680048bc9e16b547cd049eb11e92145519174c22bc2f84aa0ca8b98d188c188401f44c2069353e81f3bb9e0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745365, "uuid": "baea758c-2945-47b1-a037-e8c58d4be271", "value": "T1B324EA47B991CF12C1C111FEFE5E418D37136FB8D2EA72029D24AFA477868EA0E7A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745365, "uuid": "11e91601-dd0d-4887-8f6c-158ad52f887f", "value": "6144:agzyKywGnoQ8LKl9LpaaCoeyQoP5YZh0PTj9Q/:3+KCoQ8+l3aaCvC5Yn0Lj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745365, "uuid": "482b481a-0d1f-48df-af16-81793af966ff", "value": 221948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745365, "uuid": "3f91c4a4-8509-400e-b5b5-2febed9f0f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745365, "uuid": "e5d0fdd5-ce6b-42f5-8c2c-c8e5620077a9", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b3ae79-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777706105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706105, "uuid": "9339a410-f14a-4522-9b03-7d26c678d720", "comment": "Malware payload (NanoCore)", "value": "a5f8868b6a7491472743c006fb86b672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706105, "uuid": "800e8ea6-4ccf-4f7b-bdfb-45aa251c60b2", "comment": "Malware payload (NanoCore)", "value": "3afb13708c11829f7869f047570105d1845f060d1c5f4d930ba0934751e5a919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706105, "uuid": "b403e339-0fd5-4ff7-85d9-1b26c1250cb4", "comment": "Malware payload (NanoCore)", "value": "bc71dc329f3db924d18cab44fbaeab392f796595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706105, "uuid": "22f05894-7453-4af2-b580-601e0b78c396", "comment": "Malware payload (NanoCore)", "value": "a87dbc53f76ea98d87b1df76714bb59fb577e6a626971764847b8be786b3765b6c1fe84c3e827fb55cc75b92806522ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706105, "uuid": "0c8979a9-afb5-400c-8c0d-9110460e4038", "value": "T1AB14CF157BB84A3EE2DE8679612202179378C2E3EDC3F3DA58D454B75B667E40A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706105, "uuid": "600b5ed5-0bcc-4072-87f2-2e8aa48a5eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706105, "uuid": "5733d3d2-90c7-4981-a208-0da95b60a2fd", "value": "6144:MLV6Bta6dtJmakIM5GplNzULgm7SB7e+x:MLV6Btpmkxzcb87ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706105, "uuid": "105455b7-b27e-4f4d-9e36-dcb404cd6fbf", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706105, "uuid": "6a978903-e37c-4fba-b224-905fbe030ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706105, "uuid": "4c8c85e8-4460-406a-a4f4-0ee02b234505", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92844c3b-4651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745158, "uuid": "d9b7fea9-9488-43e9-9d7c-a77e71223b59", "comment": "Malware payload", "value": "a65fc0682c3f9e0d94ea8f264cea37d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745158, "uuid": "c0ca1117-e63d-425e-9131-d7adc745bbf5", "comment": "Malware payload", "value": "3bae288acc773473af39c1cf45198dd5cba79bd082d6ddb46243cee02c3eaa01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745158, "uuid": "7b2061df-48d6-4be3-a8ec-0911279499bc", "comment": "Malware payload", "value": "ea7c90ba3eec87ff2032510c9cbe68202970f46f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745158, "uuid": "09eba101-1ca8-4193-9658-d285b5009eaa", "comment": "Malware payload", "value": "4ff00546332557ea36dd8b7988a75c65fe67a2559628bf7e0355bb78221398654548af3fdb3a7c6470a7594a932e39b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745158, "uuid": "17e61522-51be-44cf-ae5d-3a77ac888feb", "value": "T1EC132896FD419B12C6C155BBFF1E428D7727036CE2EA33039A2AAB2037879560E6B115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745158, "uuid": "7bd55268-1c37-4e12-a027-6f1765c0029a", "value": "768:uMyITIxhYTMlwhw9ttBOp3QyNAvKVm9EIlPnqaCaTN87vgI:5YHlwgtBOpgQAyaiaTJGvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745158, "uuid": "9d78888a-4d7f-4a02-acc6-2017c89bfa43", "value": 43508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745158, "uuid": "09ff0752-fbbf-49a1-abef-ea1849c08792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745158, "uuid": "cd7e8d3e-ffa8-4880-85f8-ffecfdab6aa1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c132f1f-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740638, "uuid": "102ff238-3247-4fee-88b1-8ec713c8dabd", "comment": "Malware payload", "value": "51ffeeedadee8dff9db4055c2357c744", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740638, "uuid": "b7c00aea-bd9f-4750-b72f-8832deeb0184", "comment": "Malware payload", "value": "3bc07f542f2bf065a2b4bb00a0a541ff87e3d013a1b76f417ca5b06f490c837e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740638, "uuid": "265e172f-7f4a-4655-8eb7-f80a3f1e0ca6", "comment": "Malware payload", "value": "90704adc6a3e749200a18e0db490eea3f19175a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740638, "uuid": "922be6d2-1d59-4f86-8a17-027ef4650d75", "comment": "Malware payload", "value": "30bdc84d8e0e5fe2eda7f9fde8a497335dfcf19edbe0d84eeba96d386c648007ab9a8e522dffd11f6f1f696fccc3deb4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740638, "uuid": "b7afe37d-eea5-4287-a3ae-461b1d159b14", "value": "T172E13382BDD6CE3BCCE9627A1673C6203372C551AB439B17210C48753D83AAC6D76B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740638, "uuid": "8185b1e3-918d-469e-878a-9189f303a14a", "value": "96:8xJFWLccScsfULmg/vdpklpqxMYc3O9Ff721a5BI31HBgVcgOu8+TiImDW:tccSvfBg/F+QGO9FfN+1H6VcggDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740638, "uuid": "ab8bb74c-66a5-410a-a64e-9b3345d26648", "value": 7316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740638, "uuid": "d32299a4-ffb6-4244-b0f7-eba7d7a2154e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740638, "uuid": "4df3b4b2-7446-41f6-bed6-004f44ca8d1d", "value": "3bc07f542f2bf065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860c6d5b-45d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777689732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777689732, "uuid": "b6124bbf-1ca2-48a6-9b0c-4bd1216e0b83", "comment": "Malware payload", "value": "892c4fe5f33f77b850c8419f450d1745", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777689732, "uuid": "532205d3-c757-421e-9927-8aec58de0941", "comment": "Malware payload", "value": "3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777689732, "uuid": "2ee0b481-ba9c-4147-b0ca-fc72a67d1a25", "comment": "Malware payload", "value": "490e76dfbe99a5931cbd3baae5756d6e1e89c69a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777689732, "uuid": "97b5d83f-98db-4fdd-99af-c5f8d503e4a2", "comment": "Malware payload", "value": "bb968d6919cb4238c4303e8f8d52caa1e0632475995baea96e647810842025ed03b82e4d6d0d5fa65efed91ad98037c1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777689732, "uuid": "3fbc2c8b-f879-4c52-9526-4e7aa7482d2e", "value": "T1D926233AFB783180F55C6DB0BB04998453EFAEDA469CCF5062447F198CFA69096CD836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777689732, "uuid": "7fcd3874-2f8c-4e19-9508-03b0184911bf", "value": "98304:1Ve/Sb1DHcZv7bNNFEtBnHNS5thUOwwbZXdHJ04EJZ:nUSeR7bnCnn85thBJbh0LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777689732, "uuid": "138bee8b-9a2a-4e1b-a9df-98c57803f7a4", "value": 4786181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777689732, "uuid": "1fad3ba0-491a-4e82-a36c-df6a0cd72aa0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777689732, "uuid": "6a030417-9a5d-4206-90cc-26087bfcca92", "value": "01052026_1546_Tax-Number52563.img.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d14284-4650-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744513, "uuid": "e1589c56-b2ad-4bb5-95c8-7117412daf38", "comment": "Malware payload", "value": "f90a11bbe62122e3285a4c359e886911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744513, "uuid": "3aee385c-1930-4b06-a670-b251287aa77f", "comment": "Malware payload", "value": "3c1998cddb861041de44bf4072194bc469b5e3afb465c361e83765a7a892d1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744513, "uuid": "494d2b3a-053f-4bd4-8d6a-9a361caaeda4", "comment": "Malware payload", "value": "dbfab40b022ad2a3801bd6524b957fc78d299b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744513, "uuid": "27da8b0d-5d97-43ad-aa04-d92157de3d91", "comment": "Malware payload", "value": "ca86294c1300d64f8d5468a46d09b2331b5a3556480ce67beffa24b74420706c7399ff011fa0c28549ea44861634e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744513, "uuid": "ff7850ff-9673-455d-aa1f-cbab4373477d", "value": "T1B3D19E846F92C50AE34808B344BCA3D59AA3712A40A9867BE8E45258514F6DBDF0CEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744513, "uuid": "947db44e-0f93-42f9-bd01-286a04e6983f", "value": "192:F3cQPuf13y19wt4VVvPkq3hTpWOltZZEaBHKEJzyw:1cQPufwmyVlPkq3hTp/ftBow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744513, "uuid": "df8cd5f4-1736-43a8-b67f-66140b68f934", "value": 6292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744513, "uuid": "15e87e7b-6fd4-4249-8622-c4e9e2ff0022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744513, "uuid": "f49c27e5-67b5-4c83-ae7d-24a49d9f872a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e27a85-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725221, "uuid": "ed23a202-9230-4c7d-8afe-6c2b1e3ba983", "comment": "Malware payload", "value": "0fcaf826b152694da8fb577f4478f977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725221, "uuid": "1ecabb03-aed8-4a4f-9caf-4c42fdafba0e", "comment": "Malware payload", "value": "3c8b24b4e004edcfc3bbc879794c10a6c1d375a2bd33353a860602ae937dd29b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725221, "uuid": "e3d81835-4d11-4d1a-8eee-eb6ef1b5fd7e", "comment": "Malware payload", "value": "6add581b06f9086c1e63429e8647acfe5aa4d85c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725221, "uuid": "9b25cb77-5816-4fc2-af5c-6ed39d000f00", "comment": "Malware payload", "value": "94eaa0cef222e99689467159bda11971688276b263325027e342ae61d8bcdaf531f080958408930b9eb706232bbf948f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725221, "uuid": "d2e15544-3629-4157-bf22-e13d2a5ba720", "value": "T147F1AF477723D306F21C0A3320FD13E16A87A564E4E8E77B69441D8D105B6CB6F5E9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725221, "uuid": "76ef630d-cff3-45fd-8353-068c40381f3a", "value": "192:fCIkCcguVMlhTpWOltZZEaBHKEkWY0LHESt3F16p:fcguVMlhTp/ftBSUkSNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725221, "uuid": "bad57138-61c6-4407-90da-3b5bcdaaac39", "value": 8096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725221, "uuid": "109b55e4-bc7a-46bb-a9dd-b406c7fc52e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725221, "uuid": "0c64d86f-b12e-478e-8be8-4035c663bd09", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9437b3-45d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777690787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777690787, "uuid": "f192ff45-6bd9-4316-92bc-19f09aad4df5", "comment": "Malware payload", "value": "9d78cdd15864c64fc8097d3968bf98b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777690787, "uuid": "7d09d038-2335-457a-8d88-0f6eda7c085c", "comment": "Malware payload", "value": "3c90e471fd29b79cc740a47881e6bbd1bad7cd43b4b49436342be0a09f99a8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777690787, "uuid": "4b24fdd3-96dd-4205-8d8c-f05ae6b100f8", "comment": "Malware payload", "value": "c7654c43359e16b6c686b0e305db35a25d0894e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777690787, "uuid": "fc13a38a-b85c-4d14-a6d1-5dc185eaf98c", "comment": "Malware payload", "value": "76d16ee2a168698d15c14e11a6f566c060bf19115daf8d45ae6667e7ab8d6cd921026b4f93abed751bf64c5543a29c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777690787, "uuid": "d649266f-fb05-48cc-bae6-1c001c86f23f", "value": "T1FC74238EB7FE76C6CDE538AC85658B9A8ECD4A4554FECA050CFB918903E1013DE22F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777690787, "uuid": "ae3561e6-bc42-41be-b2b6-21433bed2b72", "value": "6144:66oJxyKwdJ3uPSRfC1dO5NM2fM3YVdK9Z6Mhpx2ywxSJx14kpaB1NoWywoOetgWU:VoJw13Esa1dWMz3omHXwxWvDQB1F2ttI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777690787, "uuid": "9f202212-db04-4e6a-8637-a71faa7ff6a3", "value": 366930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777690787, "uuid": "d697a785-e1f5-4a68-8181-c78335f8e563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777690787, "uuid": "7807eccf-a8a9-4702-9ec2-55ec01bac082", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d923c6-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736312, "uuid": "3e2522af-a6f9-4b10-8bcd-0fd3eef1e9f7", "comment": "Malware payload", "value": "0f63a812e06b9381d000a8551bfc3b87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736312, "uuid": "d3f7da9c-1acc-4772-9d36-c7532c5a3ce2", "comment": "Malware payload", "value": "3d3617a8d14bc72e340242a8c613ddb7fc0e91c4edd97508ba0fdd8548cc1d58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736312, "uuid": "94d54616-6e4f-4de3-8e50-35c5571408c1", "comment": "Malware payload", "value": "6d370beef7114e08e0d23466ad64664a4ace48cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736312, "uuid": "024fa9b6-3c45-46e8-8923-f81c7119133c", "comment": "Malware payload", "value": "16f4568c91fbc3c52cd5458bb5d6816110e6043f67817ce3f69f76c4e4e547241716c56c52040018fbb4bef9e778ada5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736312, "uuid": "f59f028f-f327-41d5-8578-30ea9579fe65", "value": "T147762A97B8924952C4E43637BCBE81C432630EBA9BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736312, "uuid": "f84e2098-c97e-4a72-8102-5685927b3442", "value": "49152:gvQ3F8K4V6I9k6QE3Qd9hjxw513d0+q04B1cSVP4GFsbmyWkdup5Ev+:ab6I9klEgd9hjxw51A4GFsKV/E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736312, "uuid": "4a148d93-30b4-4ab2-a60d-bdd00610f53b", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736312, "uuid": "0bf26b8c-a016-4032-978d-65be1f068859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736312, "uuid": "6b9df565-aff3-487a-9d47-f05a1ba2572b", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61939db3-45c1-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777683229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683229, "uuid": "d0ba18ef-9bb7-44b7-8a2f-d8886c51c357", "comment": "Malware payload (SalatStealer)", "value": "9fa0b28d1d3bff5ccc378ef7e8157ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683229, "uuid": "fb6e6ae7-b8d8-4e3f-901b-c361e82f1b40", "comment": "Malware payload (SalatStealer)", "value": "3d8034186da15b34b83c7137ccc676c3961dcd130184a372a64e6a4a9e99e704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683229, "uuid": "402b7a1a-9e6a-4cdb-afd0-cc1ae95cabab", "comment": "Malware payload (SalatStealer)", "value": "4793f1b1cb87719a77d86a5286e9498d33354d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683229, "uuid": "2dcb5959-aefc-4278-bb2e-379973550747", "comment": "Malware payload (SalatStealer)", "value": "0f6f00e4d7bc41d7742f3393f9f21e2827f3cdd8ff6aa502099a6259a942166d5b7bf86cde41ac0749e8dc902671c8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683229, "uuid": "a1d93c11-d42d-4327-a7cd-9b4a98e7f208", "value": "T1F9C66B11FADB95F1E903583140ABB37F63315D048B28DB9BEB547B2AF87B6A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683229, "uuid": "dcb446f7-ec52-42ac-a002-ed646a61cb14", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683229, "uuid": "89a8e385-1404-40d4-be06-6403e38b9960", "value": "98304:IVsukg+HJPjCB7/cFK+It/To5A4qoEuO/:4kges7gecyPBuO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777683229, "uuid": "ac200df8-7258-4e34-aefa-244d12b98eee", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777683229, "uuid": "fa04bf53-546f-4406-9edd-66a7046957ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683229, "uuid": "d88f0c93-01ed-4a7a-9af1-867fd21eeca0", "value": "adadad.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f6a160-45bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777681681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681681, "uuid": "f2e99114-0f2c-4d5c-bf18-20c09502f5ff", "comment": "Malware payload (Mirai)", "value": "66093c49047176021209ca629cdbaef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681681, "uuid": "868255cd-ca0d-48f8-83d2-753192cc3224", "comment": "Malware payload (Mirai)", "value": "3d863bb880ea313958b9aeb2e1d4562fa37a59eea4c7be379fae65e916af8f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681681, "uuid": "d9b0f6b0-60f1-4897-971e-30fe8754426e", "comment": "Malware payload (Mirai)", "value": "1778425c98e19a61bba3afcaaf879bf4213056dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681681, "uuid": "7bb5a5fe-eb98-4436-a9cc-8339ab2744af", "comment": "Malware payload (Mirai)", "value": "45ee1624d137613a64d0db56e1a01587dc10328c1b2383f2b315a07cb3fa7107ae72ff65cb7608378cda89556b495749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681681, "uuid": "5fbff5f4-a490-477e-940a-7b7fbab677dc", "value": "T104E32A45F8514B23C6C612BBFB5E428D3B2A17E9D3EE72039D216F21378696B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681681, "uuid": "88348fff-b7d1-407f-aa9c-99450417979c", "value": "3072:ZNIVWFaoWBYyqYLRZlyxUhY8+H4AUaTTUPRFZSaUAd5:ZNIVWFaZqeyxU2BH4A1TTEZPUAd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777681681, "uuid": "1b4e418a-42d2-4dcd-809f-b6c8e6277993", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777681681, "uuid": "c762ed95-e972-4cb5-a188-ec592721b18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681681, "uuid": "db20c70c-27ac-4eb4-85cc-a161c51726e0", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da75b98a-45e4-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777698464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698464, "uuid": "8d40686e-a9db-468c-b00e-1acf4f80961f", "comment": "Malware payload (CountLoader)", "value": "dfe6b4b221b1464e3ef22a183407c550", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698464, "uuid": "b44fd122-5bf9-429f-acf1-c6012c40e9ff", "comment": "Malware payload (CountLoader)", "value": "3da2bec8f6847815ed65291578c164fadd7ef9f38601f87f2b033f373a7f5967", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698464, "uuid": "a94f4e20-62af-4907-9f46-11c4140b923c", "comment": "Malware payload (CountLoader)", "value": "551775cb5215438ebb0b7516678476a77e31bbe1", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698464, "uuid": "9d1168f7-0b7c-4a84-be6e-d1c322a1a175", "comment": "Malware payload (CountLoader)", "value": "dc2db56bc0d3e22adb39a47cc733a69cc762054f6a3e508a7b65e77a80f11a5e2b23f677e16362f7f431587da3d3f9a7", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698464, "uuid": "b920c8dc-5bc1-4e50-a77d-dd513d6fab1d", "value": "T17C063A50A8864870D1270538D8DB73FF13288D1A4B75A7F3A2D4797A7DBB2E54C2237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698464, "uuid": "420d8f09-4351-40ae-b35b-501ee28909ef", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698464, "uuid": "0f7f1e40-315d-4fbd-9a33-3eb920edb249", "value": "49152:KPnpvI9zsgspJOtdknmAY3IjMXab9aTyw8bsusT664:+xI9zsHnmAyI1qusT74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777698464, "uuid": "7667d9e1-a998-4c4e-94c4-76264afe8484", "value": 3975680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777698464, "uuid": "6b93926b-acc3-4795-8e9d-f73c54cb348f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698464, "uuid": "22f8c348-d0b3-42a7-bca3-765a8f35a5ed", "value": "downloadlink.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c19d1c3-4658-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777748127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748127, "uuid": "31ac704c-1c10-4804-aeee-b3aabe794e7d", "comment": "Malware payload (Mirai)", "value": "3c7306e52502fcd8b42b1fde7fe63a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748127, "uuid": "7a62cafe-96ff-4bf5-a4cf-e2abe8101087", "comment": "Malware payload (Mirai)", "value": "3dbaaeb0dc554470da79441e67fcdfc278e4e73f987aca3dca919d9c030f4217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748127, "uuid": "790423e9-4d31-4503-a3d5-0a8ae782a1ba", "comment": "Malware payload (Mirai)", "value": "cee561d5753666e63dd68f0d5d6951424d45a512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748127, "uuid": "5710553c-1576-4383-829e-886178427e0d", "comment": "Malware payload (Mirai)", "value": "ed958b8d33a069ea68fc18e7e7ebc22954aa7dc0323992e9247ec8f2448ccfc938a033d0e285f077f8986e8ef8c7c201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748127, "uuid": "1d1ee297-41c5-42bc-a070-52c210354971", "value": "T13FB55B55FC509A56C6E096BAFB5D828C33232BB8D3DF70179D0487343BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748127, "uuid": "8300bf30-c072-4d8e-bae4-96ff30f48e12", "value": "49152:A9kMMVQim0vNz+iRWpgt8I8wIsb+REVpIvPla:A9eVQQvVlRWpXwI0pIla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748127, "uuid": "4a317dbc-2447-4407-9289-c807c320f6d1", "value": 2482068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748127, "uuid": "3595cadd-7ae4-4b3f-b2d4-6829c4656448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748127, "uuid": "03af8c6c-44fb-4639-91c1-8fe1e7d123f2", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3e2a42-465a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749174, "uuid": "25f6b13a-2542-4c5e-b3f4-e46067054199", "comment": "Malware payload (ConnectWise)", "value": "1f30d199ec6d54b94eb1b4e319703640", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749174, "uuid": "5b5349b4-43e7-472e-8bdd-529eb5007078", "comment": "Malware payload (ConnectWise)", "value": "3f120875c46c94e1fb4b939c631f690f2655e50a393a80803c9736b013eca23e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749174, "uuid": "5d22bdfc-8631-466d-9efa-7db18a8312ad", "comment": "Malware payload (ConnectWise)", "value": "81af22349ffcd3531b3b28f310e03b3a6e4f4880", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749174, "uuid": "645d77c2-8f16-4adb-b268-7c6a8a44c5e0", "comment": "Malware payload (ConnectWise)", "value": "59c481195bc7cf7565e993cacb526dec5e105aef88d26e8a7e5d841bdfad8ad58453d330cfe7dbd3ab0170e03b1a5f64", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749174, "uuid": "45f94504-c70c-4560-99fa-5cd38927565f", "value": "T10446E021B3D995B6D17F0678D87A82A99A74BC044711C7EF5394BE3D2D32FC04A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749174, "uuid": "8fd81091-67e5-4003-89c9-9ed8b82d7ce2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749174, "uuid": "dd5f52c8-80c2-4209-a9b4-7d31d200cd13", "value": "49152:uEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:bEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749174, "uuid": "686eaf2c-5034-40fe-9d3a-7f8ec81e2566", "value": 5837920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749174, "uuid": "9e78d063-99ed-4755-90ce-3d3e0300f91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749174, "uuid": "21cc9429-6263-4580-9eb2-c0b4b88bf4ed", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035abd2-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694635, "uuid": "d63e2683-dd16-4dec-9091-237bc786cd71", "comment": "Malware payload (Mirai)", "value": "d00a423e8cf66a3b7388d4910cdb646e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694635, "uuid": "78b1aa44-1dbe-4f0b-b5fb-fefc681287a8", "comment": "Malware payload (Mirai)", "value": "3f514c546041fcf8402e68749f0c793f45f7c10faba42f1ad615af2614371292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694635, "uuid": "4acb9976-cad7-4b97-a119-02d1a3c0db23", "comment": "Malware payload (Mirai)", "value": "26b1173d345051a1637b883d7f4e168cafc6f019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694635, "uuid": "8ff3da93-6cf1-48de-8e57-b2eb26d8464b", "comment": "Malware payload (Mirai)", "value": "9ea04202f563c7acc588495b5e7bab79088ac04ee36dc3a3df12c627e25e28067be22a41ce68e45e0fb07491cb1e6a6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694635, "uuid": "6513d42f-b4a8-4e74-950e-68f8ef1dd689", "value": "T157634923AA16AF46C04764F065F28E744B63FD694D631EFAA665EDE04083EDCF1093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694635, "uuid": "b35720c3-7e26-4bcf-8265-f857815db221", "value": "1536:/5BZk+RaGwtIsDq0WlFrzyBoRzhQwKsKhpHVr5CVXWmerw:xbk+R5CD4llNGXsiVr59prw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694635, "uuid": "b8cd2cc2-00bc-4b6a-89ad-1bf97f0ec025", "value": 72136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694635, "uuid": "f89ddf91-286f-4d2a-9705-7b6e613c2ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694635, "uuid": "ef11b1ac-d3c4-43c1-bfc1-5d69cf7a521b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7622fe-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736080, "uuid": "20487b58-f2b0-4317-89e7-b6794777cd1f", "comment": "Malware payload", "value": "2cfc221a8b1172329fe207649cd0e60b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736080, "uuid": "9ad53334-6592-4dfa-b090-5273c73da559", "comment": "Malware payload", "value": "400b678722c164b0beddf6059b02ff84707a457fbccf31390d14cd674408d79a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736080, "uuid": "28a2d0b7-df90-40fc-b83c-93b2dc2d197d", "comment": "Malware payload", "value": "2c989f9aae191de61f872a67d602a911f466d94c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736080, "uuid": "bf8cc94a-aea1-4959-8530-8b28dc0673d2", "comment": "Malware payload", "value": "7cb434fdfccfc8760fc721673d526c8c217ee6c41008c62593cbdd54d01eff1a014b2d2e5901ea0f81a02d1877be72f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736080, "uuid": "ab20f951-4cf4-4ca9-ba8d-ed0a1ce686f5", "value": "T133F08CFC04B868B49456EA42B41782B8A40BDC8214FA2F688E8CA5E4C4CAA10F000BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736080, "uuid": "04c7be60-e642-4b70-8f91-94d3a37e04a4", "value": "12:xtzfd7bgevQzfd761gevQzfdJevQzfd/evQzfd//ev/:xtTd7bgzTd761gzTdJzTd/zTd//E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736080, "uuid": "1036132f-db2c-40cb-a51d-8c3de13c8ac1", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736080, "uuid": "49d08dcc-a0f8-43ef-8229-af3bea4f8a5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736080, "uuid": "a8d763fb-879a-4091-b1d5-78f215b85368", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1224d9ed-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777682666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682666, "uuid": "69b0503f-b31b-48af-af96-8d03b101532c", "comment": "Malware payload", "value": "2c979f4f3f60b8bddd35ce17a7dbc382", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682666, "uuid": "e0a2ac74-e397-4d7f-8e74-c00a47289aa0", "comment": "Malware payload", "value": "40a26879a3e21fd182e3ee945fcb63b4af12d8b730d1550c61f24925316cf929", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682666, "uuid": "fe1eca4f-3425-43a0-9cac-91a13f332f35", "comment": "Malware payload", "value": "d20818af3380aabc2ffd85ffbb7a4f9f5b085102", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682666, "uuid": "2dc76aee-215c-4e29-9a3d-ee16d03fee8d", "comment": "Malware payload", "value": "cb36a1dbf1a6eb4f2191184c85d4a7bc2de4907dd2c3e901142e3ea9d877080e7dc57166e1c6ebbea495a1ff97de703f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682666, "uuid": "678f6672-e92a-420d-b17e-c387914a785a", "value": "T1CB0309A5D623C4ECCC56D2F86FF7C476B9A9F8CC0564752A038086303E969281F7E55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682666, "uuid": "2c096691-e538-47f1-a6e4-8befa87bb21b", "value": "aab37c12b7eab909b831018c2c8d8aee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682666, "uuid": "975cb6af-522b-4543-a391-485865959735", "value": "768:RwJUaxPqsXPFRZQdBY8kBjGSa7RliQTqEikzlvlfpxhsx2F:aDFqsSk8kBqSa7RliQTqEiKJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682666, "uuid": "38c4fcbb-dfd3-4f64-a1b6-aef88519a976", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682666, "uuid": "e5b425a0-8c59-4f67-8c9f-01eb8312f252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682666, "uuid": "e434e1df-eaf3-4386-a90e-242cec71f3bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31393b5a-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719225, "uuid": "d5a4fc4f-6feb-457c-9cc1-2647f30ed952", "comment": "Malware payload (Mirai)", "value": "927835838ee8c2fa5007f679f1b6f593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719225, "uuid": "cffe6992-55b4-474b-a08d-48c1ca3331ec", "comment": "Malware payload (Mirai)", "value": "4223eedf80e2aced47310c7c02bf4ba62a91646ba164ba42db3abb42abf78ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719225, "uuid": "337acc6e-a61b-476b-9a3a-080864f5443f", "comment": "Malware payload (Mirai)", "value": "b6ecec97037640e36386954e2a44c6b8bfe85c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719225, "uuid": "38e52326-deda-45c5-963f-46c13e992bbd", "comment": "Malware payload (Mirai)", "value": "9bd2ea9598003345d9d3845643136e1e38810cec1b0f90cb361558c3009e35c882937503bdce54cae754191ea181a5aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719225, "uuid": "f07bdcf0-2165-4d9e-a48b-cafededc3e1e", "value": "T133645513D9164895E5258CF222673385AC4B83BB8CE722E3ED5A49A1FF3145F41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719225, "uuid": "b800c808-ea78-415e-9fec-9c3d20b94ef7", "value": "3072:Dx9OP4mj0N/XgFAhEs2UTT6LgB+joCcq3esy:DEG1hEiTajorqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719225, "uuid": "cf196ed3-826f-4b71-815b-f3229ec9bbf5", "value": 336748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719225, "uuid": "e3d19915-7a42-4e24-9b07-0acb5cbcfb8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719225, "uuid": "a63c7f86-3887-4852-9206-68d37e07e021", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2712bf64-464c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777742831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742831, "uuid": "a3ba0bbd-b2ba-44d4-94bb-7a5fbe82d613", "comment": "Malware payload", "value": "1e0ac4e2a61f799c74a4d8f8ac9ee399", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742831, "uuid": "9aeb053d-3ee9-412e-93f7-784224b00a47", "comment": "Malware payload", "value": "424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742831, "uuid": "b0dd03ff-b27f-42eb-9eb8-06ed85eef221", "comment": "Malware payload", "value": "568f47a33a9557a6724a650f59f9d07ebd56f7d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742831, "uuid": "321d692e-ca8c-4cbd-a35b-4bf95aad9c0b", "comment": "Malware payload", "value": "844e876b601f089cc2d3d04205f453bcd81ae827e32cf3095ab1a228a3088d801392d474b1b6f1fac565e1f3240a99e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742831, "uuid": "03763538-c01b-4249-bd00-b107898b3fc9", "value": "T1081216E9B3E5143BA1617F4CF140C449E8716CACC053BD06A9219B5E9F8C738B36EE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742831, "uuid": "540a4fcb-8211-4b06-b2dd-355440d06f3c", "value": "96:mla21T1IVoF6mdiydTdI9E1q2xW2lTlIFI2aZ2aO26nC52JE2JT2pYd02Y/2Yk2r:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777742831, "uuid": "e4e6de64-e443-4e35-9fd1-ca6f66e75b74", "value": 9582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777742831, "uuid": "4dc02aca-f27b-46fb-baa8-01704b9cb81a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742831, "uuid": "e6b17b46-bf07-4b98-af9d-aa9f213eb859", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5359eb59-4620-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777724007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724007, "uuid": "b9a2bb14-746d-49d6-b60c-86d913a115b3", "comment": "Malware payload (LummaStealer)", "value": "686e1dec7e4355ca7b3e8a07f68666a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724007, "uuid": "f0a14425-0c43-4270-bf18-02f5f75ce146", "comment": "Malware payload (LummaStealer)", "value": "4314d1cf829cfa4fbce788a6c0161a7f1c9ecb6a1f0db653d03712f2e99569f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724007, "uuid": "f4b5e9d6-e700-45ba-b4d3-82b79eca143c", "comment": "Malware payload (LummaStealer)", "value": "ec4433fd6afd94f9b619118f79515014768b44e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724007, "uuid": "e745af1f-31ab-4196-94f1-1b40edcd5602", "comment": "Malware payload (LummaStealer)", "value": "8038d45ea21cbd78a3073af154340c259a1016017400ee5ac57d7d204009b4791800863600eeaba00d10f6e18c28a0a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724007, "uuid": "1b0b16eb-b025-47c2-996f-5504ff744406", "value": "T13EC52C40FED248F2D483693534BB72BFA73858094B3D9A47DA503EB9FA7B7601823645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724007, "uuid": "9fa50a90-be8a-4d2b-8a30-f2c6153766eb", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724007, "uuid": "7a6e061f-8966-457c-b4d4-d1fc4572551e", "value": "24576:nW8GIP6jjwRnvQ/LqeTALwDPvSY5a/eRzVjmR5p5ykA3joEZdUgedavirb3gW5DV:nnFP8vow+QjAKEbQWR2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724007, "uuid": "c3322fa5-d0ca-409c-9eee-6a4ad411abc0", "value": 2568408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724007, "uuid": "728db0ee-fb74-442f-abc6-2100a004b30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724007, "uuid": "01bcc8de-6f1a-4dc8-9d54-a3218690bf0d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc88bcf5-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704964, "uuid": "aa893a93-5a9f-4fc4-8dd2-6875179f648f", "comment": "Malware payload (Gafgyt)", "value": "f38c04283b046353ee80630fbd9a028d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704964, "uuid": "68376452-ab6a-4a45-af6e-b7471cbb4b6c", "comment": "Malware payload (Gafgyt)", "value": "432ffe197d3a092d45ad1d273da093acb1c98451606fb75fe9988155c579ab06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704964, "uuid": "59dd27b0-5d68-4e2c-a18a-83ccc099c17e", "comment": "Malware payload (Gafgyt)", "value": "9cc9590965bddcdd4d028c2acaeba81220ee8ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704964, "uuid": "c113c39f-bc29-442a-8f78-3edbaab64e57", "comment": "Malware payload (Gafgyt)", "value": "5047122ffe7146ad168457f43ec51dafd37ac2fa48aee1bad057db54b5aecbf09f41d35863151ebf71fd98d1604269e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704964, "uuid": "ff9ce9fd-08d7-487b-ab9e-a9b1b69b9888", "value": "T1EBC32917F9419F41C1C325BAFB8EA64933136FF8E3EE7102D9249F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704964, "uuid": "d2431136-09cd-410a-a078-d82d938e0ee0", "value": "3072:CT6VR25nJosoaEDh6mNwaMBgqi/sCkRXr5h/pi1n:CO/25nesoaEF6mNwaUgYCkR75ho1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704964, "uuid": "da30adfd-9526-49c5-b356-f71e709b11f9", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704964, "uuid": "a78124a8-2601-4d17-8172-38d622929fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704964, "uuid": "deef86ac-9143-45df-b720-586c5c7988ec", "value": "ar7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a38acf-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736634, "uuid": "105fef16-f074-4d30-9d9b-81697d4d4a1e", "comment": "Malware payload (Mirai)", "value": "cb0e9cae07fb24e94b10e21e880ae7b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736634, "uuid": "a0482621-485e-4211-a3cb-19efc7afbc63", "comment": "Malware payload (Mirai)", "value": "43999e54b0a43902d3b97409eeee33b6eb18586b31d4a28cb8978bc0cd6dcf40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736634, "uuid": "d3df86e4-9a54-4717-a567-1df6b7324704", "comment": "Malware payload (Mirai)", "value": "f4827a6bb5ea69ecb21ed6030c543b365facab5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736634, "uuid": "cc80aa48-6e85-4dd6-9ea5-e96caf1dc4d0", "comment": "Malware payload (Mirai)", "value": "7c9007a8565c1ac8171d86ddee12f63cec1e33a871409fe35cdc64d5b043c0eab92075ddf646badec328db16e4d40d50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736634, "uuid": "051ec807-4dd3-4891-89c5-b77ddeb53f84", "value": "T1183317C4E903DDFDDC5619712137EB328772F13B1029EA87E7ACAA22AC46B41D44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736634, "uuid": "30525137-3ddf-4ec0-8a42-bacefe7ee9fe", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoT2poQzWxS2RAfah5zQ:AUyntv6cuEZ437KAgoypoeiSi1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736634, "uuid": "b78f90cc-64f3-4f9b-9c32-5c30ac8476d7", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736634, "uuid": "6b904a5c-1e2b-430d-b435-0a5b73895551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736634, "uuid": "58882e93-c161-4daa-a17f-c1dac9aefe83", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf5dd84-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736314, "uuid": "b831d801-0bf2-422c-b014-3ec7e5a8e0e5", "comment": "Malware payload", "value": "52a7ef7be0e6e652ebad685cb4c11ff0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736314, "uuid": "c089f1b1-6b6d-4e92-8282-5d243ef35f94", "comment": "Malware payload", "value": "43f0e31cbac46ae746cf83e0730b5ed2ff987a6e02dc323788dad54fbc1bce9e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736314, "uuid": "7eb9a66f-e819-4741-950d-de6416584a58", "comment": "Malware payload", "value": "ad875e5e397df837e1eae460614c89b7313ece1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736314, "uuid": "8907eb92-5305-4e56-b92b-efebf86d1b27", "comment": "Malware payload", "value": "23a3008434724e48065a29c55842a36b9210b4af539ee142c7b4ef88ab98a387e6b230ee591ac7528d5dd6a04c423e7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736314, "uuid": "429f0f07-e363-4811-bcf0-b589b8ab8f28", "value": "T151763B87B8924952C4E43A37BCBE81C432634EB99BC7565B6D04EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736314, "uuid": "c8695935-2304-4d11-af6c-20001ff15e11", "value": "49152:P5xNekq7aBHAYP59wlLVmCveTH2mkGW6pU+5cO78gyqo5E+:fNu7s9h9wlLVmCve9cO78zqaE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736314, "uuid": "3754ea30-6557-4d36-831b-9420140191dd", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736314, "uuid": "d198410e-d7de-48c1-ac9b-c8788803f9a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736314, "uuid": "2d23d292-0982-4648-95bc-d75ac302270d", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7171f2f-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777706109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706109, "uuid": "f102b2a5-3307-40b2-b91b-81989ea10105", "comment": "Malware payload (NanoCore)", "value": "02bfc053552c88e2428ba7dbc8b6d9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706109, "uuid": "85c61ccc-0fa8-4ea6-baab-c40c594f6a33", "comment": "Malware payload (NanoCore)", "value": "46e49034d830a5801c1eb8834866e79cf53c537ac7126a9cb284cf2c2d6d96a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706109, "uuid": "1db79ffe-e7ec-4242-b73a-208ad347f586", "comment": "Malware payload (NanoCore)", "value": "cce509b81b5eac524b62ed17d225ecc7f4ed887f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706109, "uuid": "bda734b8-4c45-43cf-827e-635aa3323e08", "comment": "Malware payload (NanoCore)", "value": "9f32df23793640aa33c8f05bd35a4ecc761d6767984a974c73b386c56bebcb40b412584cac6ca07055a408f64aae0af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706109, "uuid": "bb3c353e-2523-4e9c-855d-ac47796f5225", "value": "T19C14CF6A37A8893FD2CE86B9611212538379C2E799C3F3DE28D455B74B627E10B071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706109, "uuid": "c3dbeab8-ca3e-4a45-942d-1a3676c632c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706109, "uuid": "fc36a018-bfb4-4a9b-9a49-8b243b29d410", "value": "6144:MLV6Bta6dtJmakIM53NLiVdjyTMyIdWu+:MLV6Btpmk2kjyIfMu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706109, "uuid": "3cbd0d6a-b334-48e5-bd53-14e2220ab183", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706109, "uuid": "ee7b6704-9bb0-48d7-a9be-3ea7da29295e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706109, "uuid": "d6ca216e-06ac-4e5f-85c7-b552175647b1", "value": "02bfc053552c88e2428ba7dbc8b6d9a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7065ca-45cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777687862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687862, "uuid": "3a31569d-30a6-4b3d-b486-aaadbff5096e", "comment": "Malware payload", "value": "b8a1217c31dc3e69407800f5da4cfea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687862, "uuid": "6d9d747f-e29e-4471-95fc-f5cd8bd51877", "comment": "Malware payload", "value": "47a9b1d333be590277d0dbcfbd1146fd18f37870150de5bd7c277434fb64abac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687862, "uuid": "808e87ba-ffee-446b-94c9-2411e67dcdfd", "comment": "Malware payload", "value": "0796c16f33b8cd05eb2470ff09855a36785d86e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687862, "uuid": "212061dd-4b72-4e19-99ec-052dadcbb71f", "comment": "Malware payload", "value": "c044a0c28118d03d57385ff97a7c15a1dc95f28258671db19e5fc867a2fa4845415d03b35c9146ec2b8d3d57e0594229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687862, "uuid": "c330175c-957e-4b52-bae4-a322dc94af8a", "value": "T1DBC4C41CFE81F814DE2A3CB7CEE910005B7164C1AE1295563119AFFE8B663B759E227C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687862, "uuid": "3222d3f6-54fa-44bd-beb4-93068e41834a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687862, "uuid": "2efb78eb-1d4b-4759-a598-6d08154729f0", "value": "12288:p4O8G6nXumH2PVle8g8UObadhPO9nLVI:yg6nXumt9Obad6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777687862, "uuid": "a9db3be1-60b4-483f-a1ab-c3137952b269", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777687862, "uuid": "8550c702-de1a-4a5c-85cc-e12651f72ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687862, "uuid": "8c10c3d5-88e4-43ed-ae0a-336ec9c44d29", "value": "Xyq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aad613a-45bd-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777681526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681526, "uuid": "c6234668-1c3a-41eb-98ed-5b2589a9a9ab", "comment": "Malware payload (SheetRAT)", "value": "c652f61208b6195eaf6f034b97361474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681526, "uuid": "6e81fec3-6442-40ef-83ab-13c5b533697f", "comment": "Malware payload (SheetRAT)", "value": "47aa89ca575ade3b5d2b80a1f24e387af23661db9f03e009fdf120f2b33cdc21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681526, "uuid": "8c67d99d-d09f-43a0-9f2c-6f31061525d0", "comment": "Malware payload (SheetRAT)", "value": "da874ef58840ac3e0f0ae1b3b7286439339d570f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681526, "uuid": "836955f3-3763-4746-8347-eda58cc05d38", "comment": "Malware payload (SheetRAT)", "value": "89c5149d23e7c45d536b0459cb6239ab6f5e2680cfcbad4d08aab305062355dce78e9777b1be0bd6d16184b7e2b6f87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681526, "uuid": "74f064fe-6240-4047-b345-5cfafd72c56f", "value": "T156F6336537DDD5F5CB9307BC2DD9CAA14AB3D0611F1293C72B600702AA51AE1377A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681526, "uuid": "67bdd143-a40b-49cd-955a-41f6301b198a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681526, "uuid": "9dfd4a40-7144-463f-bf91-db47077840fc", "value": "98304:MB5t8GxiuoaN5zNpYU+XNSY4/3pAePUN9tk:MBYGtt5zNaUyM/3KNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777681526, "uuid": "1f2a29c9-3858-41b7-b0cb-5767bc6aba3f", "value": 16318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777681526, "uuid": "336ecc4b-6002-4ce3-a2cb-26b547948415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681526, "uuid": "6adf4f54-1805-4a13-af41-692f0bd88480", "value": "jjsploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580188ae-4644-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777739477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739477, "uuid": "aa92abf0-9314-4f31-9107-550c35930c58", "comment": "Malware payload (ConnectWise)", "value": "967dec057078ddc261b03e55e0dba70f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739477, "uuid": "07aeeea4-de8e-4f03-96ea-97975ae25456", "comment": "Malware payload (ConnectWise)", "value": "47eef4a089230024b8cbd1eaa7a5e324bf3da82497d8d02cf218f4e336570765", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739477, "uuid": "c2f84c40-3abe-45aa-b018-9dd8fa18b1fb", "comment": "Malware payload (ConnectWise)", "value": "6dce2b7283e16bc07fec896102b54f54ff69d5e2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739477, "uuid": "05710782-7ab6-46fa-8bab-72eef650ff06", "comment": "Malware payload (ConnectWise)", "value": "0d9bb6e22433a4414e4ba9437237ba0866724f340382b739fe7fca361e262add2032b039b01243470a06e3c49135902a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739477, "uuid": "47b9368a-c536-4077-a5ee-cb372fa381cc", "value": "T10746F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739477, "uuid": "59a76543-1c2d-43a5-9c17-3bd8332a0021", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739477, "uuid": "e0bebaea-0cda-4e24-b27b-62e510ba8e39", "value": "49152:3fRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:Lqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777739477, "uuid": "44d85ea1-2e1e-46c8-ac50-babd3fc2625e", "value": 5654176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777739477, "uuid": "9381d883-32fc-4e3a-9aa3-e67aa273e948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739477, "uuid": "f9d232fa-34e8-4935-b640-8801c191be3f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e101e2af-4601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777710930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710930, "uuid": "9c9b290e-fd15-4491-8cce-a28d92cb8a0d", "comment": "Malware payload", "value": "b406e34cd6a7ec15831569c8a19739b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.e", "colour": "#ADC6A0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710930, "uuid": "9cb036db-d393-4eea-b082-29af920f0747", "comment": "Malware payload", "value": "49e3b6fae519cf4c5091a37d6be6d8c343412de11c73993c494d29e905d2bb6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.e", "colour": "#ADC6A0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710930, "uuid": "6b86d56c-41a2-40bb-93b4-a980afbcf1a4", "comment": "Malware payload", "value": "f5ea9a2e7242c562dbc4c183edefb3897c41efa0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.e", "colour": "#ADC6A0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777710930, "uuid": "def29f52-82be-4b56-b67e-fde1060fb9e1", "comment": "Malware payload", "value": "3c3b0e07b312a64c08e189bb68163ecd382043c0f1a8a55a8e658d3811f5d05adcb4dc8c46fba615572ac4b377807f58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.e", "colour": "#ADC6A0", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710930, "uuid": "c5f0223a-baa3-41a1-ba32-6314395ad273", "value": "T187147C41B480C076D9AF05316875DFB6697EB9300F60A9CBB3845E7E8E706C1D735A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710930, "uuid": "8b7989b5-9d90-4a6a-adfc-65671f93821b", "value": "1ec8c0670e66f84186f4e8bf6abd8af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710930, "uuid": "ef3bc196-968c-419e-a69a-e5d998974176", "value": "3072:p1H7fHNFgmTN+WR/wcR4qp66WzRFQzME+JqNAnyccW9t+uDp2cX1gxNqL6Xo:/zN//wj6WzRWgEqLnywtgUL4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777710930, "uuid": "d662447f-60a5-4228-a9f3-89836e242969", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777710930, "uuid": "6bbcbf94-f4ef-4f67-83f5-90f7670bb504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777710930, "uuid": "9f8494fc-bd05-443a-b218-2606a5a73dcb", "value": "NTInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4623c62f-4653-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745889, "uuid": "b9633bfa-b988-429b-83e8-356a02939a15", "comment": "Malware payload (Mirai)", "value": "3198f9b59c0fcc66aea5a8d20c1e4913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745889, "uuid": "5a3c9971-458a-4e40-903e-4396e9faca31", "comment": "Malware payload (Mirai)", "value": "4ba109db5e27f287058be5a36b34d7944d91bb71b3ce8b37cd1434fa67774c7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745889, "uuid": "60b19914-4eb0-4cbd-8201-2b479fb1dd96", "comment": "Malware payload (Mirai)", "value": "509ddd6a998ce9460abde917797c780532d768e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745889, "uuid": "c30f3501-e080-4d6a-ad44-0a6649b3f994", "comment": "Malware payload (Mirai)", "value": "bcf59b7df5abccc49445d80643c48560cc070b9c8bd22249aa2568e180216fd006381a5d5b92c541463cf61e3e0d9400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745889, "uuid": "4a3b6c11-4150-4609-87e8-813d90423f3e", "value": "T144B57C47B708B9BEF686733784574A0E34047F12C0815F33A2B5F4AD5E6A1A91F396CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745889, "uuid": "235c5d4a-caba-4ab1-83ad-278fb5fb5cdb", "value": "49152:r4N2aqvXcTNZXXuXfnHo59s8xZbhrBkO40:r4N27Y+X/V8xbBkO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745889, "uuid": "43197c67-f96b-481d-870a-3ea14a8c4296", "value": 2306428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745889, "uuid": "d0da94d7-1592-4f34-a8e8-86eb014023f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745889, "uuid": "627dd2b5-bab0-4ae4-9504-0c370b62e8b5", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fa6971-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741708, "uuid": "c75b3679-72b5-4cf4-ae69-6d6178815c2d", "comment": "Malware payload (ConnectWise)", "value": "de89312ac2f21d6c4a6cf16cc603cdb9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741708, "uuid": "9e1eafcf-7cfe-42de-bcc2-139da6ab0f7d", "comment": "Malware payload (ConnectWise)", "value": "4cd3c78ca63a60db05307549510e1015a68ca18952da49cca39a9c9cb7bf08ee", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741708, "uuid": "608ffc81-0588-45e6-aea5-bd371ca0de99", "comment": "Malware payload (ConnectWise)", "value": "ad0e805f6b330716a46cd58c8d7913f47bc490c0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741708, "uuid": "e3f37584-5c63-4455-82ce-bdab459e8337", "comment": "Malware payload (ConnectWise)", "value": "6bf54ab3874c50270def2da1037cfcf48fcb20c8b0257c163638f5107ac2da3be0a8737b524924accdbced084fff538d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741708, "uuid": "345d67c2-ec48-4dd1-855c-b3a58aec70de", "value": "T1BD836B43B5D18476E9720E3118B1D9B4593FBE210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741708, "uuid": "7e5b7356-87e1-4401-8137-b9a36807ec91", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741708, "uuid": "19c74dfb-8330-41ae-87c0-c02e1c27af20", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYD7DJY:wenkyfPAwiMq0RqRfbaWZJYYDJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741708, "uuid": "685dfff2-0575-4543-b4a1-0bc6b1d78a37", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741708, "uuid": "f0fd9cf9-7407-41a4-ad5b-255ee012a104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741708, "uuid": "a559d23a-aadf-4689-ad80-17edf2609eb2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4399ab32-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743308, "uuid": "5faed2df-f27c-4991-8dff-59d5b2abe815", "comment": "Malware payload (ConnectWise)", "value": "d78926d3b13299a4c6aad02f6249d4e1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743308, "uuid": "b45bcee3-0626-4048-b8e2-8c5c63de0d8f", "comment": "Malware payload (ConnectWise)", "value": "4cf72ab8b3baa7297f533000dcad9988c693d80ffea5e0c35bf9e4856e48fff6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743308, "uuid": "bb1904a7-664a-4846-8763-48494efa7978", "comment": "Malware payload (ConnectWise)", "value": "ecab434c9eaa060b6dff2dbba590a9c878a8d1c3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743308, "uuid": "b68b01b9-1a6e-4d4d-95aa-4aae9f722850", "comment": "Malware payload (ConnectWise)", "value": "d8e802eb84bf31fe49998416980c7ff545dc9fb26c0e6d306c7d39960e6e365899e2e7263fc56407a15f514dc3c17d90", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743308, "uuid": "c8f63e95-37ef-4d5b-9862-29499b78dfcc", "value": "T127837C43B5D19871E9721D3118B1C9A15E3FBA211E348EBB239802AE5F741D0AE35F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743308, "uuid": "b4ad513e-76e5-4a3e-8ce4-1112dd5a40cc", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743308, "uuid": "7d2bbdbd-e9b8-4692-8fb2-0a2b747a37d5", "value": "1536:VXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHiq:lE3x5KBDYiKWm/iSw0fRMvygeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743308, "uuid": "63d2ee77-189a-49d7-84df-fd6551d9d9f2", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743308, "uuid": "524cef11-e30d-4341-8c2d-7fbb6640de41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743308, "uuid": "f5b8e939-a1f1-4168-bf83-aa696d13e225", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3418d51f-4651-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745000, "uuid": "ad281dad-4dc4-42d8-b0f4-3cecd75d60bb", "comment": "Malware payload (Mirai)", "value": "9677209478c415e35384a95955f54454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745000, "uuid": "39b75350-fa45-415a-8eaf-67648b3b35af", "comment": "Malware payload (Mirai)", "value": "4d41900d5f8e1e978fe6124842b72704963ce807996dc9d6e5a1493372af0e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745000, "uuid": "8b98e660-8422-4764-a461-ee1d48f5adb8", "comment": "Malware payload (Mirai)", "value": "7193c2eaf4599c3fded9fe1e18e42317b08af067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745000, "uuid": "a107c52b-fdf2-4b1b-8d62-dfd3baa66cce", "comment": "Malware payload (Mirai)", "value": "0bf53da4a03e1ba49bcb6ad331988411a45ed9301047dbcdb5c33156a743b12374aad488e92527a8ab9d555d2ecbb32e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745000, "uuid": "6d3a2d75-dc91-42fd-838a-6e5da82ea120", "value": "T10A242A027B0D0A03D1432DF4267B07E04B9BBD6138FAE681754AFEC957B1DB2654AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745000, "uuid": "e17c574f-e670-4afc-9aee-9ea3d4a869a5", "value": "3072:zM5cM2Y+trMsjTcv1wNwQxpRDzTi3S3Lrvdl9PBjXknGSrK:AYtRj4v9QxTDzTSS33vd1jSrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745000, "uuid": "6f9c0db4-db73-47d7-9e54-719873532828", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745000, "uuid": "e0551fea-5b36-405c-a94e-719e6f75f398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745000, "uuid": "d24fac6d-6ac2-43a3-8d09-913dadaf956b", "value": "bin.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fdc851-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743664, "uuid": "84054fe8-f42e-46c3-b120-6d8a081d6717", "comment": "Malware payload (Mirai)", "value": "15f2ceab5ea4fd0b08aa8dc895b3aebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743664, "uuid": "33b393b2-b77b-4636-8c2a-686dcb120fcc", "comment": "Malware payload (Mirai)", "value": "4dbbb0cfc201eff642b7ceb3f5466867c57c1992ab80c9d63f2ec4474a342828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743664, "uuid": "4a19ea90-3a87-4f25-95b7-5a26cb505325", "comment": "Malware payload (Mirai)", "value": "7e2352524afbb185bcb775f0e5341c3335109cbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743664, "uuid": "f91cb1a7-979c-490b-adf8-941450f7862f", "comment": "Malware payload (Mirai)", "value": "9d075aa3a9553e0e868b4389e52dca5e653247f863d17200a9b9ad7730f486f187f642cf84c4329f2d18349b13b21fe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743664, "uuid": "6eb9f39d-8350-42f4-80bc-ea2eaac4ceca", "value": "T12F14F74AB9519F11C5D235FEFA9F819833136BA8D3FA7102DD246F6033C699B0B7A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743664, "uuid": "5de9ffb8-9625-4c56-bc54-472a4fb96cee", "value": "6144:58RUuKSPuCUBPE2hofrka7fU3FjCwEAb//Xpl4jQPj:qRUchUtPhofrka7UFjCwEoHpl4jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743664, "uuid": "cdfef4a3-3b2a-4518-851d-adaf7e296bc5", "value": 201276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743664, "uuid": "44ea5011-85f6-49bf-a510-3eb4bd7414e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743664, "uuid": "6745513d-e0cf-4a51-8920-b2e49f08f083", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4a170e-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734684, "uuid": "9063f9d7-2806-47c0-a8c7-829089ff21d3", "comment": "Malware payload (Mirai)", "value": "2ef62ac47ae9dde0a0d56d056a62e2c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734684, "uuid": "a130ceb8-1958-4559-bf16-12d8a624bbb4", "comment": "Malware payload (Mirai)", "value": "4dfec9b7cd5d733c4873b773316e804d380f90ae5562fb7b2cc7a9304b6fabf8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734684, "uuid": "dbec5f09-0a71-4d24-96b3-1e935407c6f2", "comment": "Malware payload (Mirai)", "value": "0b82037bf6ea3da19efed3d82206ab49ee2f3bfc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734684, "uuid": "eecf5228-f79d-4bfc-bae7-d0d9d18e74c5", "comment": "Malware payload (Mirai)", "value": "fa810fa62561f8dae9f808553e7cc3a3e8349bca3dec7b6b9bb312c707f7b58546866d8d149d01e2a217edd866c81107", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734684, "uuid": "8d63a406-5470-4b23-851a-9ff5368f2874", "value": "T10F73E942BA47CEF3D40714F041B7B63F8E31FD3A493285A9EB65BDA1CA635C16216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734684, "uuid": "5990678b-d9d7-4d06-bf7c-7876a941acff", "value": "1536:SGl11IuDxOIX9GtkxBP4nIjyjk+V34uWPceanwnvbiXaGYDJo0q+s:SGl16uDx1XPBP4nIjyL3eUeanGjiXXYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734684, "uuid": "3d5f99ec-e7b9-4e3c-a11f-84c6a9f893f4", "value": 80328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734684, "uuid": "10c4b8fe-75da-441c-8ab2-415a22aab930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734684, "uuid": "662cb529-4a58-493c-a6eb-adfc3a73bb01", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae90b83-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777682654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682654, "uuid": "0c0b0179-fe7c-4ce4-84e4-0661ec966d7d", "comment": "Malware payload (Smoke Loader)", "value": "847786b420c9d76055f5cbc7a6f937a0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682654, "uuid": "23247c7b-68d7-4026-a86c-d2f26c86c326", "comment": "Malware payload (Smoke Loader)", "value": "4e49801ddec08de825baf255c439cc1aa2bf7928ace9ecf596f1ad8f159423a1", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682654, "uuid": "ae12dd99-bec4-4fbf-ac9b-4a09489fd20a", "comment": "Malware payload (Smoke Loader)", "value": "34b5967b3ecc64bd6109a0a012c44c50584a042f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682654, "uuid": "d68c3d76-2dca-4e97-a46c-96d88b0c4479", "comment": "Malware payload (Smoke Loader)", "value": "cbb2b9528b52ad1a91abd38757ad49184109ba6ff8a2686bce6eb03cadfef16b00a797a1ead3e88996adb2f9fa7bcf25", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682654, "uuid": "5b1252ad-98c5-4f96-a54e-a74f25be9634", "value": "T11B54DF61A7F90619F2F66F39A9B44A06597A7C5BAF74C2CF1540460E2D72AC0CCB4F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682654, "uuid": "8e7ab0d5-72f2-4286-abca-1a5121f2f00f", "value": "6144:MW08NK139pFN6egoLigV/j5RBLnkHTkLCBgTEdEOjc2:/K17FyaigV/j5RBjyTkLCBBmOjc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682654, "uuid": "5eb9d46f-f70e-44ef-b3e8-84d181cb64d6", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682654, "uuid": "72e59d3a-3bc8-482b-ba80-8002ae6ac13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682654, "uuid": "cebc49e5-2d8a-403a-afaa-ce7e35710e94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56ab912-461c-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1777722481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722481, "uuid": "11164b81-58c3-4ac7-8395-a6ef4a78fe31", "comment": "Malware payload (XenoRAT)", "value": "b3889cd27c0cb8bc40d78b5ffe7b689d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722481, "uuid": "03546ada-de9f-4040-b744-f2c09450aebc", "comment": "Malware payload (XenoRAT)", "value": "4e7a4564f7bcd8a7175d25fca21306650e5b9ba03c05526ed53a41d92a2c0fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722481, "uuid": "27e430ed-2d84-47ad-8370-34534eb7b71e", "comment": "Malware payload (XenoRAT)", "value": "b1736322aed4c15e0581012976b28c862d93d6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722481, "uuid": "8a6e8468-ac7c-4f8f-82f5-94f305f9d42c", "comment": "Malware payload (XenoRAT)", "value": "392152f585af9360c4146995230c8e9bb950eb408ee2820020080383a3e498d57cec8c4c0f09d593fbe3bff8487569d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722481, "uuid": "0e45573e-b3e6-443a-ba64-c05c8f21a219", "value": "T15E84F1927A98C773ED655AFE5427489A1373BC3BC960F19934DC22E827833E24922753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722481, "uuid": "cfa98415-a854-4a17-a3b7-ab1ff9828f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722481, "uuid": "cd29e15c-b391-4b1e-9b86-82470c47d254", "value": "6144:jf2aOVO3YIbwyUqo1mboOD1/Wz/L/GKizOP1H2EbiWJqkdG:jf2aOwIFym1qm/L/GKhPl2YJqkdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722481, "uuid": "90f3210a-a302-40a7-8f96-be292de75f3d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722481, "uuid": "ac928bd6-3639-445b-98f2-c2de259b2b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722481, "uuid": "0e9f747d-63c1-4b71-8226-40e6bb2b4f10", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c778c22-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743430, "uuid": "e3dae6e7-1b4a-4832-bcc9-7b85f9c39798", "comment": "Malware payload (Mirai)", "value": "1ace626983f8180ce7eb41a89b6275be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743430, "uuid": "02661143-84f1-42ba-9958-adce81d13f4a", "comment": "Malware payload (Mirai)", "value": "4eb18a9b9fc84f8dea3d6ca013c188eda15a2b0a5ee2a43acfe7948ca20125b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743430, "uuid": "beac8869-8809-4816-a6a3-c7de697d3af3", "comment": "Malware payload (Mirai)", "value": "3b260c8bf82e00b71b8cfd5145c107ee114385e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743430, "uuid": "f9487e3f-91a2-4112-afef-9c5e2cda79f7", "comment": "Malware payload (Mirai)", "value": "1b24a6d99d370d14d19435d9575f411557769011212d7e8a300eb7f392ec6b14d53ffc3850a90d753ed630f0f99598a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743430, "uuid": "b566bea8-1b49-4f6b-99df-e5ef7ecdd096", "value": "T101F26AA3CD252E18D26AC6B470318F3527A3A850918B5FBF157AC27D9093DDCF6463B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743430, "uuid": "353b7964-e4b1-43f3-a8e7-30d019bd0333", "value": "768:zuTMO4QJDoVK0Pfia0omDiuOxeFo/0ydsGfQzHv24WtdCOI:zRkJAK0PfFjmlOX/qlb240dCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743430, "uuid": "78517cdb-2304-484d-bb60-ae89dd467589", "value": 35156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743430, "uuid": "9673792d-30c8-44dd-a82c-8fc481348a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743430, "uuid": "f7f5c4c2-92a3-45f8-b466-8a48cd935d27", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eec9018-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745609, "uuid": "bae45a87-123d-4e1c-b33b-0b394942f9af", "comment": "Malware payload (Mirai)", "value": "aa338f7e365ba6393e093424bdf8fb7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745609, "uuid": "c96e4ae9-8efa-4efc-804e-fa8efc8e430f", "comment": "Malware payload (Mirai)", "value": "4f4a933a2dbc8d7874be931b8682d1e1f41ae87034859d45f7c5a693f9bdf94e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745609, "uuid": "61be6371-2fba-4cb1-920c-7183a0e9501c", "comment": "Malware payload (Mirai)", "value": "e5c511592ddf5a3dc57b985b82a3d48067effc0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745609, "uuid": "55058f87-92d0-4e4d-b605-924d56f0a1a5", "comment": "Malware payload (Mirai)", "value": "94a8114e8e9ca74af57034e05eaf5aae1dcc8c15211e32e397d1d9c7279dfab670aa851c2b34f09f3b73bfd594c41dad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745609, "uuid": "5050786e-9459-4e54-863d-ea39cf51dcc2", "value": "T18804F741EA43CEB3E55300F102B787314A71FD3A6C66D542E3BCBDB4AA615C1AA1A37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745609, "uuid": "1df8870c-b63e-42c5-a60f-ff965156b7db", "value": "3072:Z/bU19bccFLdAM/DGr87c6AImt3QuD7xx33o9Wz34mXlpye:Z4RFLdDVmImvT348zImHye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745609, "uuid": "90538ab0-f2cb-482b-a707-56d433c4beea", "value": 188900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745609, "uuid": "c1dc23c8-b190-4847-8313-c13adba821a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745609, "uuid": "e3315866-b9d1-45a6-b524-526c7291b935", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fc608b-464d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777743312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743312, "uuid": "3f34c5da-c42a-4be5-995c-2bfdf1bba4ba", "comment": "Malware payload", "value": "4948532620334d4ed8bbbcdfa891b4d5", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743312, "uuid": "214646ad-ec56-4bc3-95a5-3904f61502f7", "comment": "Malware payload", "value": "5038baf7c8255047abbf77399963f770bd1114ba468fe4711fdbc329961414d3", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743312, "uuid": "b91c643e-bdc6-4687-b43f-5a113cd30660", "comment": "Malware payload", "value": "05e41a5ef2cebf8387fe2b804a110343150147ad", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743312, "uuid": "a5568664-ae9a-42bd-a991-ef0fefca185d", "comment": "Malware payload", "value": "ac593bfbbf6a16bfae5ba57d9f7b188ab95a4d44d6c12180e3baa2c70a2f61b061845fcf2c06fd483d17e3d2667a1b9d", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743312, "uuid": "5930e0b8-145f-474d-9bbc-60a8550cd600", "value": "T1E346F011B3DA95B9C0BF0638D87A5269AA74BC044712C7EF57D4BD692D32BC04E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743312, "uuid": "71a38983-6f6c-4fcf-9542-47b1b2863aaf", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743312, "uuid": "991b1bc7-0e5e-4111-bdc7-a9bcac86d159", "value": "98304:mFs6efP09BNKtMj3Mgay69FHG2O0fIT2GWC:ifefP0wtCckYRFY2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743312, "uuid": "a23cd1e7-2670-4a2f-ba85-5d07b0c1ca1a", "value": 5639992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743312, "uuid": "99aacc52-c323-4f17-be29-7f35607fe2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743312, "uuid": "12ba8984-a119-4089-a96a-37a5a21c09d3", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ff723d-463d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736324, "uuid": "05f7670d-1230-4db9-a0a0-8fc8e7e1ca9a", "comment": "Malware payload", "value": "27171aac3639db7fbc92c40c21d80136", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736324, "uuid": "42e965d3-841d-4f7c-a435-0dfe3ea44bae", "comment": "Malware payload", "value": "50b9f469457c0f70e879273490c242defb85f65b372ce297feb3ba4f76621430", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736324, "uuid": "d4d7f4d0-4084-481c-bf09-41db2b1f9b3b", "comment": "Malware payload", "value": "f474c3c33434b1043cf1563a7890556baca85a8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736324, "uuid": "d0c26b34-e888-428b-bdf6-a06c4716d709", "comment": "Malware payload", "value": "7e5cb03952eb795c61a8fe3836395cb2ef5bd5d93ac0940b897665b2ba48c0d7e6e0efe623d9b61ec4b9a679f868bb41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736324, "uuid": "c43cc451-53ef-4abc-b1ed-3fe161ab4b9e", "value": "T196767C91FB48A136DA460A3248670B30B3A15D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736324, "uuid": "435ebf78-a288-4d8b-a278-3d683f5a3552", "value": "49152:PCKwGYUgc+7O1NbVL3dyhGi/p8VWzxqRR1eiHVRW8Pwy9/MtJGflHHUt5Ee:AUtJNbVEhGZoCTji8Pl/GJGflnUjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736324, "uuid": "b1382fb3-f0e2-449e-aabe-6fd3bd3c8891", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736324, "uuid": "51ef2c4b-4839-4a58-b75f-3b8dacd9fd4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736324, "uuid": "f4913dd7-e520-4b78-b21a-5d4f5ae6fe2b", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb7025c-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724216, "uuid": "2dfb582a-770e-46c6-8ac3-ce47abcb3930", "comment": "Malware payload", "value": "6f476ba4c7e0e11616b8ce5f85993c67", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724216, "uuid": "087800ff-2edf-41b9-b219-b23af429f462", "comment": "Malware payload", "value": "5164ed75c639e404338c105868ad6c5453c53788496d02c4bb29994e119d3abb", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724216, "uuid": "4dad1d72-8f3a-49f1-8712-49cb9d18852a", "comment": "Malware payload", "value": "48c3bfd16553ea88e7b45824f7ebbf203195aa74", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724216, "uuid": "27a4d454-09e8-450d-8e43-adbf02d8b24f", "comment": "Malware payload", "value": "fdb659816db6c7707ea20ee3f671fabd70282da26d3045b99358dc1b7db9c93d9afb73ac9711381f08c40e44193c47eb", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724216, "uuid": "6a6cce90-065e-4b0f-8eec-6b345e3b815b", "value": "T17A636ADB76A904C5E225813CCC96863AE6B3F4911B60E3CB1759831F0F737D2ACBA651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724216, "uuid": "3c5dfa78-53d9-43d2-9881-e22cb7f4e512", "value": "7322998ef71db4b0ad4676a6b87ab8a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724216, "uuid": "c08010fb-6f3b-471a-aa55-6d3fe31a83c2", "value": "768:YUnzmlPYA1/HJZV+Uw/hGp9rjQ/m75UQdALLISxdNXI0ngI3tbi+HZnypOjxH5YA:vzm5Ycz42ZRNtAIcdK6bimnypOjxZ7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724216, "uuid": "721f0f18-3ee5-42ae-9542-577468a56b79", "value": 73008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724216, "uuid": "7920d3a1-b04d-48e2-8dd8-e886d0980987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724216, "uuid": "1eca1f4f-65c8-4491-8684-aa97c42eaa31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24caf6b-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734904, "uuid": "932bf0e2-6f08-4e37-8456-cd032689c5d5", "comment": "Malware payload (Mirai)", "value": "64b47472527bfcace2c0914e75fc61da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734904, "uuid": "98c5f4d1-a32e-4f6e-843e-1bfd10ddc251", "comment": "Malware payload (Mirai)", "value": "5229fa4b9d263a727be618d2929baa56f742d5dd480688e1455085cf586b2309", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734904, "uuid": "c0c58a8f-3cd8-4e43-9db4-9e893bbb87f0", "comment": "Malware payload (Mirai)", "value": "847625fed7177dd513f60bf7c18e12c160d31dbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734904, "uuid": "e73eb874-1c72-426b-8382-7a1e533b630f", "comment": "Malware payload (Mirai)", "value": "468942fc76d5112b54daad52d6ff9a7efe1999c9dc365b9d039bd7e9745e38781600b145e1de44361abd9e004f2b8e56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734904, "uuid": "45094538-f250-4ce9-8106-634d106eb3f6", "value": "T176C56B55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734904, "uuid": "4ce38783-c822-4b5b-bbcd-2a5f32d69e07", "value": "49152:Nv9QtAxX0vJNLHL/HnIQmdw+DI8wI8LeelyZWvPla:B9HxXMNLHrHIQm5XwI/ZWla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734904, "uuid": "da3cd022-bc6e-4304-81ab-455e4b2f761d", "value": 2498452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734904, "uuid": "d7b68296-f435-4f5d-b2f4-ce0a740ad57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734904, "uuid": "37479ab8-6c23-450c-94c9-ea7da33d2c52", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cbb2d2-45c8-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1777686219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686219, "uuid": "99c1d391-968d-4515-b3b9-18f7a275ebb7", "comment": "Malware payload (PythonStealer)", "value": "7256e5b6e353f8c736e066e8c0d1afa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686219, "uuid": "f22d3e2f-6c08-47d3-9f5d-6f4e90422172", "comment": "Malware payload (PythonStealer)", "value": "5538e6dbe740fad934fcf61ce73f9813e8728f2f4b02e133ea827678d4af8b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686219, "uuid": "dc0487b2-d4bd-4c4e-aef5-4d5efe8b2277", "comment": "Malware payload (PythonStealer)", "value": "607a86334300e20b21da1a262619dea7e30f469f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777686219, "uuid": "59c82aed-de2e-4031-ac34-12409a113602", "comment": "Malware payload (PythonStealer)", "value": "f044b6185f1694d5df026f70c7a660fc95defb05f3a483ce217642e73181baca33ffe00c50040111e68f1b8f78eb98cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686219, "uuid": "c8f6e1e1-68ba-4426-b318-6e310c8722a8", "value": "T10B27332961D99DECD8A3703A59FC1DC2C820B465D72285CF17A9794B4F23AC02E7BB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686219, "uuid": "16ed83f3-712e-464a-b414-8a44fea2c5eb", "value": "ce121d54c18544c7a777693886ce492d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686219, "uuid": "8d1ae557-6ca8-44ea-9165-8c7c52753e05", "value": "393216:9oYEL0honBMIZ0ZVO6DgJos0etTKpRo2xSTy5uztGDJHJcncvZbxxGK:zG0hgybVO6yrBtaRLx+FtGDJmncPxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777686219, "uuid": "192943ff-4e08-41cd-93fb-73a76ea843c3", "value": 21040128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777686219, "uuid": "b6e32eb6-67ce-4e7b-98df-b871d97bc955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777686219, "uuid": "632ccab3-0e5a-4c24-b98d-69f4408c9928", "value": "Exela.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51349d52-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719279, "uuid": "49d859d0-1266-4420-8498-b0a43a20cfce", "comment": "Malware payload (Mirai)", "value": "2133e409a92bb47a0b2c5d4cc14713ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719279, "uuid": "7931d766-19fb-43fd-b8c6-ba1db4c7d99e", "comment": "Malware payload (Mirai)", "value": "5540268e3e7447e7c3a7df12d86b69f0655692cd7fba270783c965c9571bdb5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719279, "uuid": "343bf06a-685a-484b-8437-5259aa8d8daa", "comment": "Malware payload (Mirai)", "value": "6543236dff603fc71a1a4f16d29cb2cb98d6b40d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719279, "uuid": "9e3bf520-17b0-4f7f-84be-66dfcb4f9fbe", "comment": "Malware payload (Mirai)", "value": "4fe525e829d67e903c1e4525095d3d826def34c829564298ce157b34baceb9096256ab9a13aa89c776ff4a94e862f8ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719279, "uuid": "0f5e7eaa-ac01-4fbb-bc8e-47b836ca00d2", "value": "T1DC442313D9158895E1658CE322773285AC4783BF89E732D3EE5A49A1FF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719279, "uuid": "c794cb42-29d2-4a76-bcec-99cd1dc875b1", "value": "1536:OAwvWjmXUBB76MkwLSB6jHejTstmGbLcZNHWoeR47:OAw+jmXHcuBc+joCGo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719279, "uuid": "9a1bd9ed-b8e5-425f-b65e-304805d5f23e", "value": 275352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719279, "uuid": "0c682f55-d257-45b0-b08f-c2d9c8451bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719279, "uuid": "1c505328-ce97-451e-b8d8-4e4a96ae3261", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4892d06-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743900, "uuid": "be96042d-978f-4460-8bc9-e67b744137bc", "comment": "Malware payload (Mirai)", "value": "4ea17db8755e0f6b21db460fd2b1e899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743900, "uuid": "0991dc52-5922-469b-a5ac-84c9d260a15a", "comment": "Malware payload (Mirai)", "value": "5570cb713f9369f4c8e32901d4d4fc7b480b869922ea70d81d61a072b570aa40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743900, "uuid": "8fc878b0-2154-4ec5-8705-36e477cd9e1f", "comment": "Malware payload (Mirai)", "value": "10c2e0a4e860babfc99f68a8fbf5221c00595cdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743900, "uuid": "3daf6237-d3d0-44c6-a1cb-4d325d5bed93", "comment": "Malware payload (Mirai)", "value": "10ce50028434e7479493612d144f87f27dbc1f95f79a409d8bd3bf78f1715e529ef1dbff31b4e552789b41eb23cc3e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743900, "uuid": "a65aab19-8105-42ef-bbae-6fdcef32c946", "value": "T11CB2D059A70607A6DE4AC1B8AAA507A01EB02737F981EC0E345CDAB38D064D57CA3DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743900, "uuid": "914dbe8b-f73d-4242-b1a9-a6f6b8764879", "value": "384:eMsYJK4qVF9gx9PfixXMT5SF93pFUWNnX4Yt1VPPl8LCsUJgGlzDpH7uNj1JMwE:g79g/P2q5S9ZPoYfVXFJgGlzDpbuR1Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743900, "uuid": "1ceaa4eb-40f1-4016-82f1-aefe23bf4892", "value": 25468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743900, "uuid": "237796b2-024f-44b9-8705-c00363cb75f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743900, "uuid": "3424e73b-fde3-40e7-9cf8-341c41404ef7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4fd71b-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743298, "uuid": "ad2d0f5f-785f-4806-865e-ffce0cc797b2", "comment": "Malware payload (ConnectWise)", "value": "399959668b8c175ab532ad0fa94b3f02", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743298, "uuid": "8c2617ef-7dbd-4555-b090-0491412616c3", "comment": "Malware payload (ConnectWise)", "value": "55936a79cb89fabf842640cc0bc305ab7f99bb49e116a8973e254083c12cca7e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743298, "uuid": "d38a9e2b-ac15-496d-9954-62635c400e1e", "comment": "Malware payload (ConnectWise)", "value": "12a2e1727019b2da726c389b20dfd11bf0867207", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743298, "uuid": "39f583cb-6abb-4fdb-81fd-cbb79dbfd3f4", "comment": "Malware payload (ConnectWise)", "value": "30eae3c055a40cf364cb2f1799049491cccfcb57b7fc6583ed8c7a57147070d04312c4fb286fdefda9efe027af4a95f2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743298, "uuid": "87bd4e59-b37e-4b11-9729-a0d38e7063d9", "value": "T1C946F141B3D695B5D0BF1638D87A42A66634BC108312C7FF57A4BD396D32BC08E7236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743298, "uuid": "1b3c4386-7974-47b3-9235-3d48db1a532f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743298, "uuid": "bc5d7959-8dfd-41ee-90e2-ccc713820639", "value": "49152:jfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8ifm:3qs6efP3rn/TYGVxz3GBwRVkGuyXOM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743298, "uuid": "20986bd1-2072-4b6b-bdd7-ff0c326d3863", "value": 5661200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743298, "uuid": "bbd5d6d9-3b44-4abf-a4ec-13cd12631be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743298, "uuid": "59b32d99-ceb2-4a0e-9a50-3e7e8f11391b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e66ca4-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725295, "uuid": "429497d9-6799-4465-bdcb-d4dccf1e10a4", "comment": "Malware payload", "value": "4545087c41e8d77fd8808694b2e66998", "object_relation": "md5", "Tag": [ { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725295, "uuid": "fb6c502a-656b-4d38-9712-7b26becf6bd7", "comment": "Malware payload", "value": "55fbfa43358cbc4f9dd6cf9c5b7aa863be875767b72957be7d21425a0ccadc9e", "object_relation": "sha256", "Tag": [ { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725295, "uuid": "713a2834-85ea-41b4-939d-4e502d734c2f", "comment": "Malware payload", "value": "e85abdd0492144b094e29b89dd7a1db42d0352c9", "object_relation": "sha1", "Tag": [ { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725295, "uuid": "a154a10e-d878-470c-a7b9-72a55d8b92af", "comment": "Malware payload", "value": "134dbf2f1df20e53561197ed568aa91b3b66c46fb7e8302c06517ff8a82aaf86dbe496e1bdad7e3a63b15b57eae36bcc", "object_relation": "sha3-384", "Tag": [ { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725295, "uuid": "2ee52ad9-3184-4b5b-a25f-d261f41a3a2f", "value": "T15996335555B88C52546BE871DFF4839CFDC88872613C2CE30E2525632E2AF9C3B9B49B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725295, "uuid": "4c4d8e8c-d694-4f54-9fec-773af5592d05", "value": "196608:ySVrHOnqOByg03xs+9BlGAC5YBw0hiNw+VuJ5+rk+3woG8np5SFQWBHLZJNg/a:zHOqOkgLDksNfVu6AefSFQW9ZJaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725295, "uuid": "b049faf1-4987-419c-8399-972d489cfd27", "value": 8993878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725295, "uuid": "7a474acf-13a9-4fe5-b764-07ca88de5176", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725295, "uuid": "68ce4fe4-4aa5-4929-a2a4-b5cb6b1b377a", "value": "beta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff308218-45bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777682634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682634, "uuid": "0766f50c-dae9-40e8-82db-ae4dd8a8c357", "comment": "Malware payload (Mirai)", "value": "742940185108741eb3fbf57873ef7579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682634, "uuid": "1555d276-8ab4-483c-a464-e173ee926645", "comment": "Malware payload (Mirai)", "value": "562570d198f86253ffbdd48fac8a7f6e85192c3f73fbda604f1843ba9d8102d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682634, "uuid": "0c2dd324-6f32-4976-b8b0-06ad31c6b307", "comment": "Malware payload (Mirai)", "value": "5378942f151823b7f58c73712b2261753ac1cb7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682634, "uuid": "c9d5cfc9-cb2c-489c-b280-2bcbf6150b8b", "comment": "Malware payload (Mirai)", "value": "b71feb0ad85c96acc15630042e4c509dfef50b99139365a00c9970bfd39f86e2d01b856a22dd40ec8c01ed00a5312b12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682634, "uuid": "0c914b0f-c68c-4459-a7b7-74cf236d6705", "value": "T127A43B65BC419B51D6D02ABEFF6E828933132BB8F3DE7112DD055B3167CB84A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682634, "uuid": "589c6568-c1b0-4538-9278-3013a0d258e5", "value": "12288:zCY6/fFJM8KBPzHZJoGikGSAGxSQD03Ko35LKO4+27Ev/mIiYoeWaRV6kEv0Msli:0sZOKa5DI6+Iufr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682634, "uuid": "0976130e-e2a8-49de-97aa-7fd132b589c6", "value": 457824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682634, "uuid": "56d64983-3a2b-444e-9844-b526b73ecffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682634, "uuid": "91aed61c-0114-458e-9997-50c340e796ef", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4ab609-465a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749171, "uuid": "debc0bcc-75cf-4ae9-92f8-3b0f0fbe0093", "comment": "Malware payload (ConnectWise)", "value": "d701e75f5f948649d7390c0963a21aa4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749171, "uuid": "cb9a72f0-47bc-4ecd-b9a3-a53de5bb94ec", "comment": "Malware payload (ConnectWise)", "value": "56c9037430cd158db25e69ea4c12f5acc30fd6398bcd9f5380d3b0b8605b1716", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749171, "uuid": "5fcd7419-faef-44a8-aa6c-4b93976acf50", "comment": "Malware payload (ConnectWise)", "value": "c6cc6b63d2962535080bbd76578b93887ae87de0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749171, "uuid": "1fcc7b3d-ba04-4c1a-9b44-1981bde23ab2", "comment": "Malware payload (ConnectWise)", "value": "3e77a9f3f6292b98652163733a36a247cfb9f4569620bfde7c03a3d7cfb15a25aa031f6b49388cebc9bc3fb229d73698", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749171, "uuid": "16d9f984-08f8-469a-9618-5c3cac0c3354", "value": "T15846E021B3D995B6D17F0678D87A82A99A74BC044711C7EF5394BE3D2D32FC04A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749171, "uuid": "8b315231-411c-4961-a50f-9aa8f6f21d0d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749171, "uuid": "cbeadd5d-b86a-4a61-9efa-64773065f919", "value": "49152:eEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:LEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749171, "uuid": "1bcbd92f-6220-496c-b8d4-92839cbcf1ca", "value": 5837936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749171, "uuid": "cb347afa-08ef-41dd-a106-f2cbcb976c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749171, "uuid": "c7a3e154-8ba2-4eed-973c-62e938c476ce", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2629e80b-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741541, "uuid": "3cdb3d96-db55-4e1c-bf64-ecd954b6cc01", "comment": "Malware payload (ConnectWise)", "value": "5775bc00423352952288055479e5fc56", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741541, "uuid": "47565f3b-f88a-4469-8ff5-948fa76fcb53", "comment": "Malware payload (ConnectWise)", "value": "56fc7be8dac393dc82e91b0ed2e492aa30b9812d8dd0b2c1d42d58c855db2952", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741541, "uuid": "2962b6b5-2309-418e-9d59-d67c458f638a", "comment": "Malware payload (ConnectWise)", "value": "ecb807efd8e99ee2c28e0ea1f1c6949536fa94f3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741541, "uuid": "34ef397d-dc3e-4869-900d-c45b42e6bde7", "comment": "Malware payload (ConnectWise)", "value": "e4447c8492bf2f2580ba97a1e6d423d7675e3c61c3a4de6c3ef0136505c7d104540e2934baef4b4037e009e32c2028dc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741541, "uuid": "10962879-e56c-4d15-bd68-42b18f4b66cb", "value": "T1C146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741541, "uuid": "57af27fd-2e41-461e-ba05-c0b161ab4cde", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741541, "uuid": "29444637-192e-4bdb-a6c3-c2690a2f0f7e", "value": "49152:TfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:nqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741541, "uuid": "fad5b1c7-4f32-40ee-bd76-224b3a765354", "value": 5648952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741541, "uuid": "4565b480-85b0-4cdc-b00b-8d87f8e09a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741541, "uuid": "eb43215f-0ce1-4cf7-818c-6659065f4097", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0595c2b-4650-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744752, "uuid": "4e870085-4645-4a91-92ec-e34bfeb56c08", "comment": "Malware payload (Mirai)", "value": "8904e48efed1bfc103e44b1b22601c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744752, "uuid": "bc8da348-b858-460d-a5fb-caf476b0e91c", "comment": "Malware payload (Mirai)", "value": "574b1dd5281d28d5588e3c02cd71438c644b274710d732082d372e4090fedbd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744752, "uuid": "168009ee-7b54-4919-b2bc-b43604a6ecfc", "comment": "Malware payload (Mirai)", "value": "2e64269ab158939b72cbe2d18bf549b45efd038d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744752, "uuid": "80d71dde-428d-40c5-be80-8737bbaf105b", "comment": "Malware payload (Mirai)", "value": "d080fffabf115a12bcb4071b667af16f6add5cce76d1f56fbaf9566cd463b4c489867d231ce78229b27c0c8fa2b6b4ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744752, "uuid": "5f4a32f9-322a-430d-aa54-50604e4c9b03", "value": "T1ECB56B43E683C0F1EA1206F11117F3779A399A154136C9A3EF98AD29AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744752, "uuid": "05516c1f-b765-4bdc-bf5f-2504a1d81693", "value": "49152:2L+gMY+pSTJvy/zU66Riyuws0Q4CA9uHmjHkpXkVa2rh:+MYTJmSCGQpXmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744752, "uuid": "5632d765-22a4-426c-8437-41674d922647", "value": 2395004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744752, "uuid": "9f3821f6-aa3e-44d6-bd0f-89f113e14401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744752, "uuid": "3368812a-cede-4b39-8a5e-e75020fd9d84", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895f122-4627-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777727022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727022, "uuid": "d60970c4-aeb7-4f14-ad0e-f744e92f8ed3", "comment": "Malware payload", "value": "96563b0d36db0c11a78b40ffe0204626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727022, "uuid": "b15aef49-0cb0-422b-a911-f3edf4ae4d31", "comment": "Malware payload", "value": "5767e5706aa5498aa15dadf7f22bea33ef078cee6ac078a67a17d7272e79cc23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727022, "uuid": "3c51586d-a4fd-4e8b-b0e3-8e9ee31c5f66", "comment": "Malware payload", "value": "155c9487cc24d5c57442f06d15e2da756d023481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727022, "uuid": "6701701a-2484-46a8-9f92-b59174074387", "comment": "Malware payload", "value": "512afa22473007666aea330839cd940480e0c3e59faf2bac521b3c33a936ac7dbdbe95d6c554eff5313c3ba3799e153d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727022, "uuid": "8a9a71fe-c0cc-4181-ad34-ce94d383382f", "value": "T11E22976FA7401B2ECCD9263571CFCBC561A0A245D545874BA77CA8441FB73447A3A3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727022, "uuid": "5a8a2b17-c67a-4ead-b75f-dd491903be95", "value": "192:6mOSEB/v1iIfaSAqT4pynEfj1VHgymt8d0OipD5ohSG:6Vv8Ifa5qToySzAZDSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777727022, "uuid": "2d83d66f-9332-404f-a01c-ca205f1be2f0", "value": 9931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777727022, "uuid": "a4661375-e073-4f0f-9f99-de50cde48943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727022, "uuid": "0436f78c-2875-4780-83ca-6a32bb9b2a1b", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c96c2-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766364, "uuid": "fae209b3-1461-4c7c-9967-5056c1d3d37d", "comment": "Malware payload (Mirai)", "value": "a80d19f17cc82526a962e388a1c49022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766364, "uuid": "f3af9f39-98e7-4c40-85a9-7c2502c4f88a", "comment": "Malware payload (Mirai)", "value": "57c8babc94e4f0800939aad23d4382fc978d910fa884ec1447ef129e53be8006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766364, "uuid": "b6475d10-065d-45dc-afef-2108a6f2b060", "comment": "Malware payload (Mirai)", "value": "8592e9a424233807d8635d15ab65c62525cfc014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766364, "uuid": "73712ad5-735d-4369-a4dd-d54de8a8d50b", "comment": "Malware payload (Mirai)", "value": "b8d6a36197a2cb92b64ae9a58bcf468e7642fd25dcc4ef06fea040ed7b2d1f9a90a215f368f9307ce6cf3162dc21dbd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766364, "uuid": "dccea974-c878-4f8a-a36e-c33c463b49f6", "value": "T1C3D55C41EC509A13C1D15BBAFA7F828933332BB4E3DB70164D189B706F96B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766364, "uuid": "e5388c91-3c23-4c19-b500-b0f7572d45d4", "value": "49152:fVYn9qqqz3BMdjYFl0nBg8w1pIvPlapR79GyqKLr7F5xPj32R03:fVYw/MSsnBjkpIlapN9GyqKLr7FvPT2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766364, "uuid": "a3a6a5e0-e234-4b0f-a1f5-7649ce7dcc72", "value": 3004161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766364, "uuid": "faf30530-d0e9-48ef-bc55-ed7e71e4f231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766364, "uuid": "86932775-8bce-43b4-9357-8d8a283449fb", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af3981a-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743294, "uuid": "dd2e4649-b088-45f0-baaf-da09507b766a", "comment": "Malware payload (ConnectWise)", "value": "7b9e724f70b36d44b0a7117632809a67", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743294, "uuid": "3370119e-4115-4dfa-9475-b05638323c3e", "comment": "Malware payload (ConnectWise)", "value": "57fe1f9106dcac4c4c70ded087609ad6976e58be68bb75bc630d90206aef01b9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743294, "uuid": "96f21ce4-a78e-48cf-8eb2-0948e66e4035", "comment": "Malware payload (ConnectWise)", "value": "462ddd007b285b118c0ae7a62ca20cdec3a659e9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743294, "uuid": "09dd7832-2e08-4cfb-925a-6d5b065d5023", "comment": "Malware payload (ConnectWise)", "value": "0ffca6a79f27f894d9e5ec7995c8beaa6b8bf9488eff158f926a15256ed692dae1b1f15fe328e785ecafa7529eba5574", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743294, "uuid": "7bfe1271-d714-4b97-8123-84b397323a2b", "value": "T12B646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743294, "uuid": "6ca5dcb8-7536-4832-8e5b-13ff5ea03a8a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743294, "uuid": "40cdbdef-28be-4d4f-a920-9c32cc3be672", "value": "6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9N:Y1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743294, "uuid": "074cc2f7-51a5-4022-afa6-e113ac5c4a06", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743294, "uuid": "3d180108-b256-4c8a-9c47-4b6f754ca95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743294, "uuid": "425e2944-41ce-40e7-a9c4-1fb1952df8b3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afceff2a-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777706123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706123, "uuid": "a689847b-1f77-454f-b5d9-1dcabb9923fd", "comment": "Malware payload (RemcosRAT)", "value": "1b6bee0cefa141019c666ee7acf5d652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706123, "uuid": "28f195cb-aecc-4a0e-ac2d-28c919bdb2d6", "comment": "Malware payload (RemcosRAT)", "value": "58092efb6f83febb9f7ede91ba2a36f7ac1aea0c01766c63fa6aee006c676b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706123, "uuid": "c23a89f3-2ba4-4a4b-845b-6be70dbb1471", "comment": "Malware payload (RemcosRAT)", "value": "4676e81f0514f42146693a4d65f7ce4f04fb17ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706123, "uuid": "741064a7-e3ea-42ea-8ec8-f51bce262370", "comment": "Malware payload (RemcosRAT)", "value": "ae3ae26d462cbf7acbcc6bdc056369ef5e82f9fa992c097627d272c4994ca0ac9a35396548fa381e45259f14845777a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706123, "uuid": "e6cf6452-39a3-47a2-871d-a4014f5ff200", "value": "T1A6B4AE41B6D2C1B2E57254300D26E775DEBCBD102836997BA3DA0D67FD701809B3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706123, "uuid": "b2a77bf4-2616-4572-a43a-309894650e38", "value": "f2bd299c4d4ba1889e635309b6b6ba3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706123, "uuid": "d9bf2fba-dafa-4187-bfb9-1bbe4bc0e7cf", "value": "12288:O4grxMr7mFd7Gu7hvqq0jpcJisvFGtWLsPZo1:O4Mzv7b7Vf1isvFGtWOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706123, "uuid": "8e2fae40-d4fe-47ee-a131-32c9ff3e8817", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706123, "uuid": "07964223-df26-4d7c-8452-08efe4942ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706123, "uuid": "83120f52-896d-4cd1-b995-f2bf763bbf4f", "value": "58092efb6f83febb9f7ede91ba2a36f7ac1aea0c01766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080aa6af-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740631, "uuid": "aa2bc679-33c5-42b6-af66-ffbd58b1e1e3", "comment": "Malware payload", "value": "0eee2f58e295129000e0ffbdf7ebf299", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740631, "uuid": "e9b0a2e1-8203-4a48-8fa5-4a75644a4401", "comment": "Malware payload", "value": "582a4bf0759f88a4c8a45143e7df2acb9ebe8bfe647fd7f754699f9db9d3f354", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740631, "uuid": "3ba594db-5cc0-4db4-b11f-2be22527b689", "comment": "Malware payload", "value": "bb6fbe8e77031762481e7ce2a6ed7d371f80389a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740631, "uuid": "8115551c-4e3c-4cf3-adaf-802c35f16c23", "comment": "Malware payload", "value": "fe26fd55a6fde7d1f72803af0b3f1df221cccc32321fd14c8858bc730af37c22d3e13b9c18db0be3cce6a51a53592042", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740631, "uuid": "e569cf55-be9e-4d8f-8639-13bc9f2755fc", "value": "T111646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740631, "uuid": "8ed33ead-e9c5-433b-b60a-8d82dbf0a218", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740631, "uuid": "fd03e709-713a-4a63-9eff-a653d4d31b29", "value": "6144:gmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9S:r1iw7gryNkSV1hy1Z1u2JLI9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740631, "uuid": "f4161c5f-e13c-485e-86a6-2e4473838ce2", "value": 314016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740631, "uuid": "06701a87-7fe7-46a4-bc14-15b9c6116195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740631, "uuid": "8d98cbef-7c78-4741-8727-a416a813191a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ac4f84-4633-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777732406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732406, "uuid": "6c305f42-851f-453b-8b84-6b09c9882017", "comment": "Malware payload (AsyncRAT)", "value": "66f9aac660e2ef1a392f53ce84bc8ea8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732406, "uuid": "afb65845-197a-4673-91d1-74e84769d4f2", "comment": "Malware payload (AsyncRAT)", "value": "58371bfc36ec5f0d5b04249a66534ec2820f8708a671dfb9c4e575ca93d338f3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732406, "uuid": "21fd7624-7b97-47d6-98b7-4364689eea8f", "comment": "Malware payload (AsyncRAT)", "value": "4c69fc7f81876ea2c47d6620cbfde7c9de0e3c7e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732406, "uuid": "e04599fb-50da-4ab3-a91e-7cc1f60032c7", "comment": "Malware payload (AsyncRAT)", "value": "449f535c7340a92869f2db81869d18936641c96b57d044b04995de975a1175616b36255db57ca901d63fa0dbac092327", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732406, "uuid": "97be41ec-e584-4531-9138-d35470285f29", "value": "T190752313862850CC6963F2B0A5DF26151AE07F1B7DA1FCE3DC4D37B189969E3E81988C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732406, "uuid": "bc06b9d7-3007-40de-af15-d08a56efdad7", "value": "24576:wPX38VKPp58EcFLcPX38VKPp58EcFLLPX38VKPp58EcFLDPX38VKPp58EcFLA:yHpSGHpSLHpSjHpSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732406, "uuid": "8e7a7751-9183-45d7-be69-89331d9bddde", "value": 1691456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732406, "uuid": "c74ead97-27d5-4a18-a8ed-8136ca69f0d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732406, "uuid": "47c14f77-1548-4e3f-b605-653ae9f8cc52", "value": "smart bold company.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193ac6bd-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777697710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697710, "uuid": "b308e943-34d2-44be-a52b-89d07fb4c015", "comment": "Malware payload", "value": "a641a6184845dfbbb5f0fff2e3a059f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697710, "uuid": "f3a33a90-6f12-454b-a398-893f2e78abd6", "comment": "Malware payload", "value": "5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697710, "uuid": "bf13dce1-0625-42a4-9de3-34aa25a4df6f", "comment": "Malware payload", "value": "01d66a8288c5c7078c0f8b75aae610a40ac5585a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697710, "uuid": "f7fb810b-63f1-4cb4-881f-16483b9c1882", "comment": "Malware payload", "value": "b2c8b22ac2d68d880b697859dcb35f40bc1ccd1c8856302ab03abe834cb90bfb14e50b0ee44c3f51a77aa88be98b8f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697710, "uuid": "7dd92cd7-23ac-45cd-827e-056ab9b4ee2c", "value": "T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697710, "uuid": "6cbf1e5c-e621-48a7-a44c-7cf62f16ca50", "value": "2eb5a607c2df19bc8a1aa0339248bf22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697710, "uuid": "6ea0eead-2230-4367-856d-b0c72be69cee", "value": "3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697710, "uuid": "f4a695dd-35f2-4821-a7bd-6adde93a614b", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697710, "uuid": "782b9cee-620f-4cd1-8464-2af74826a158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697710, "uuid": "ff3fa704-9d8a-41aa-9ed5-886784edebd7", "value": "SvcHostAnalyzer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fd961c-465b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749597, "uuid": "09c5eea5-549e-4e80-9309-168ec79e20f6", "comment": "Malware payload (ConnectWise)", "value": "128bae592a55249481b6958e530a2c4d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749597, "uuid": "cef1ffe6-8fd5-4fc7-8cc2-a984dbad0914", "comment": "Malware payload (ConnectWise)", "value": "594660254306fdc6ad857acd43e4301a44ac4fd1d01ab9690d8087127510600f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749597, "uuid": "d866b3a0-cb63-4260-98ff-df686f146b4e", "comment": "Malware payload (ConnectWise)", "value": "5f35fa5e673160b737093255a6de2655abf1c1ad", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749597, "uuid": "f5e2525a-bc9e-42dc-bc52-87bc82464e26", "comment": "Malware payload (ConnectWise)", "value": "311715f14b4728afcc608f951fcbea0b4b214df429589923cd15b72362780bff42cef5bae659dcaf590efc95622fa3dc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749597, "uuid": "f1bfff37-f80a-4c66-a3ba-4c6ba1f61a2c", "value": "T11B646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749597, "uuid": "d24e001e-cbc6-463b-9d3f-bc739b7792c6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749597, "uuid": "e74ed6cd-8886-47ab-9b2b-e7ec6b99610c", "value": "6144:VmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi94Pi:g1iw7gryNkSV1hy1Z1u2JLa94Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749597, "uuid": "7e055d05-ca47-4e07-a925-87c955ef17f0", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749597, "uuid": "c8607e1d-f77a-4eda-8dd2-5d2393c90eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749597, "uuid": "b94f12e5-3fe6-4f11-894f-8fc0a9e43dbf", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58b5f73-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736305, "uuid": "dd6bb3f5-83b2-47bd-a126-dcccf2686738", "comment": "Malware payload (Mirai)", "value": "8d670012223324f3040e98500ac9a044", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736305, "uuid": "6d522a55-3526-407c-9b28-9fbf6f62e517", "comment": "Malware payload (Mirai)", "value": "59789120077ae85862a4ff4c017c06c1bd33d30561f551bf84f7efd8d40ba755", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736305, "uuid": "1ba179b8-cfe7-4616-a909-eff2f0038fc1", "comment": "Malware payload (Mirai)", "value": "ca38d058c00f44777593a441570ffa0bcd2991c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736305, "uuid": "f6b1f518-67ee-4b4d-8f70-7b916848c316", "comment": "Malware payload (Mirai)", "value": "e6d8c619e3f6250b7c74bbd747f17c42d4bc3b8bc974a773202a34fbb7d64f5c581128f8db03b3bff9b44c46b7b14b25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736305, "uuid": "bd318497-2b02-489e-87ad-18a3aeb18b85", "value": "T17C93180377080F47D06328F426BB5BF187AABD6118F5B284751AFEC99271EF26142F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736305, "uuid": "df301f35-55e2-4892-8c7f-1fec91824afa", "value": "1536:eLsW0DCsRh/6YICSw7gSKWF/xzLntTwDq2AIlqT4thnrLmvdhrx:eWvRYY7m+ln6lqT4rONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736305, "uuid": "44833542-8390-4cc7-a4b9-3dfb15f08daf", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736305, "uuid": "a16af08b-b837-465d-9247-a54eafc519e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736305, "uuid": "6eecccff-ad3e-4267-b78f-e733765fb8a8", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2808913d-4649-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777741544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741544, "uuid": "538d7d42-5bde-41dd-abe3-e2fb28c7ec33", "comment": "Malware payload", "value": "1be4e3a94b664da4a470182bbc972ed2", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741544, "uuid": "55fd9966-975d-48ef-a86e-a0923124755f", "comment": "Malware payload", "value": "5a5fcb68bc9955698ede325d9b13cad4d7c3cd78b328373994910ccc99fc0777", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741544, "uuid": "60325f23-1332-4a4f-a0fa-f5961afb7bc0", "comment": "Malware payload", "value": "a8f515c21827fad3284bf764c969fdfaa152d8dd", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741544, "uuid": "b4cd38e6-77e9-4dca-a83b-7847c615002c", "comment": "Malware payload", "value": "41d8257868b7399c521371279012f21875191f6dd22c5abda976539336019d5956c53d1a7b3c604c234602a7ae39cfff", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741544, "uuid": "fdd32614-3bf3-4861-886b-d47729ff91cd", "value": "T14946E111B3D995B9D47F0638D87B4269AAB4BC048712C7EF5394BD2D2D32BC05E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741544, "uuid": "97ae68d2-44b9-4eb8-8445-3a1284460251", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741544, "uuid": "011875e5-c1dc-4cf0-9b5b-ca7255528b35", "value": "49152:1EEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:6Es6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741544, "uuid": "62b01529-0559-4b5e-aa48-63539c741aa2", "value": 5766264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741544, "uuid": "65f35bc8-e5e9-4637-801d-7980d6e58dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741544, "uuid": "4b0ca2b7-1761-46ab-b8d8-d06dba1e74bf", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6e6c08-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725365, "uuid": "a962970d-7e74-49f7-8cdb-2c61afdfeb20", "comment": "Malware payload", "value": "6677de1f3c197bdf8540844bec8b1bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725365, "uuid": "a49f18bd-ee48-4360-97dc-20ec98123c3e", "comment": "Malware payload", "value": "5c2e5475171347d3d8f8d19c7a9660ee8f5604fa68d7553db66e5015fda41bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725365, "uuid": "038cb96c-c459-448c-adae-f4d5d1aa4d6e", "comment": "Malware payload", "value": "36fdbf8a839db3cb509797eb344716b34eff616b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725365, "uuid": "6e5a009f-6635-4e91-a8d0-ede1ba8be86a", "comment": "Malware payload", "value": "2a38e70afc1026cca0ea1335241e6bba45b06dfb5e5775aeb8aad18226c3f0bd09d17965f4c3a5b67939b35567911c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725365, "uuid": "cc22bf44-3dba-4e93-88fe-2521214f0d84", "value": "T16D046D1427DC4BAAF2FE9B79E4F422554371B812B93EDB5E6D8420EE1C22350D7217A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725365, "uuid": "1e307164-880a-40b5-a5b2-e7cbc305ab6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725365, "uuid": "c5c0d5a3-559b-4998-b7bd-aa061d215463", "value": "3072:nJOKneYjG0mN3fL6/YWP0BuWK2i5Pu2bHL4cc06DUecPDCX/4KeI/KQ73Wm+sUqC:n35G0MfwYWGfKN5pbHYdpp10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725365, "uuid": "4fc5c255-589e-4134-8dfd-41c136bc38a7", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725365, "uuid": "713f6264-b23d-4ce5-b829-83ebe90fb26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725365, "uuid": "aba80c95-274b-475e-9b01-4eec13440959", "value": "ShieldGuardVPNService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecfb83a-45ba-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777680245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680245, "uuid": "5267987a-ebc0-4b16-8952-a7bc4eb80278", "comment": "Malware payload (Mirai)", "value": "98ddee04086f9db756e811e2147a4ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680245, "uuid": "226b874c-6f45-4ec0-84b7-f571f02ca5dc", "comment": "Malware payload (Mirai)", "value": "5c6f41708ab73210ed0f0dac1814307db35266e1517568e4ea9ea94c32976c3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680245, "uuid": "02fbe55f-33f3-4386-88b8-d2f7591ad07c", "comment": "Malware payload (Mirai)", "value": "7d80ce0930e6d66a43926fbb07c071a688cc3c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680245, "uuid": "87690605-0766-4f91-b304-a3e5e440af0a", "comment": "Malware payload (Mirai)", "value": "9bc3007f0961f32fb7e5a5a7ed779e2dd47eb03495ec00869699931bd230523cb17581fb98925d421c4878c4db3efd9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680245, "uuid": "ce66f114-913a-43bb-b805-ac2fde53ee36", "value": "T19714B609AFA10EFBDCABCD3706E91B0539CCA54B22A43B353674D528F55B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680245, "uuid": "5e296433-4d54-4048-b503-8b48a62158cb", "value": "3072:wbCAndZQTf/BDoLRCCLL07dThRD25/QLwqWA:wbCAnsxDoLzLL0B9RyuLwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777680245, "uuid": "a226ac09-03f1-41d4-b393-0e8b2771249b", "value": 198704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777680245, "uuid": "fdbd7925-4c23-48ac-88c4-ba565a1ca096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680245, "uuid": "dac4f88f-56a1-4701-9d0f-3b0e36ad89c6", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727aba9d-4654-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746393, "uuid": "e75146ef-ed17-40c5-ad9f-0af12dc844f0", "comment": "Malware payload (Mirai)", "value": "aae53785dd72276d149108a10ba8dfd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746393, "uuid": "87e90165-a841-4b06-91c4-c86624efb8af", "comment": "Malware payload (Mirai)", "value": "5c7991bd454f1e920ec6225dd9b68491520b80cdbf67aba6403784510641699e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746393, "uuid": "93d22f8b-d054-4a05-9283-3baf07b6981a", "comment": "Malware payload (Mirai)", "value": "e4f13ae793dc964360687b8f663850f11d52046a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746393, "uuid": "e2495c04-e688-4ea2-a35c-5f2437319128", "comment": "Malware payload (Mirai)", "value": "63fbbe25bc095034f12d086d4f824f289c8e918c555d36721807cea9571ce68fd3120df31f98104887b2ee90eba6328e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746393, "uuid": "0ff56f78-c159-4ebd-ba0d-ea3674d80d9a", "value": "T16B241990BA59EC32C05E1D36A7FBDB593B4369D18EA29100C460EBCCFB871C0AB94577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746393, "uuid": "0e0395e3-08eb-4563-9c6b-5e75d66a324c", "value": "3072:T/bj8OMtX3nr31aWldeN0XpeeigJ08jthWlFsqQjjMjy7nG26V/C:Xj8j53j9deCXCgJ0nlFsPQjE6V/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746393, "uuid": "621368d4-53e6-40a4-91b2-340c3f1b31ce", "value": 213064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746393, "uuid": "3f718e3a-706e-4c35-a7e1-67f51c6be9ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746393, "uuid": "425a8f23-11ea-4446-9103-bbf1054669f4", "value": "bin.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dbb00b-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743314, "uuid": "a2978eda-d559-4040-b063-f6b48ec88458", "comment": "Malware payload (ConnectWise)", "value": "46ace39b9066c27a3e73bf9f2b1952d9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743314, "uuid": "9166d7eb-4202-4017-ab69-ab97b0e2d72c", "comment": "Malware payload (ConnectWise)", "value": "5eec6006a8b0929e8d892a1b6e91a7436fbc5d2e969b5fa06cf4dbcbb6fa0bcd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743314, "uuid": "e1f0a584-52e3-4679-a3b3-2f741cd12f48", "comment": "Malware payload (ConnectWise)", "value": "5ebd7ec262b9c678d761f0413d6cf7040afbb5c9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743314, "uuid": "66073731-0d47-47a2-8801-e28d5b00d591", "comment": "Malware payload (ConnectWise)", "value": "7cacebdbee174bc3f49e9a67bdea0365b2d673159142da18b554e17fbef1c34c3fde62a5a8ebcd4343e5cbfc24f876f9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743314, "uuid": "5714ef9c-a8d8-4b80-b8fc-32f390ed7fe8", "value": "T178646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743314, "uuid": "b2c3bd2e-44cf-4d63-a883-ef3c2c8a97f2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743314, "uuid": "8d7cf94f-febc-4920-8fd7-dd32a455e0a7", "value": "6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9N:Y1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743314, "uuid": "dbc95ccd-0140-49c0-a534-776b83fdb079", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743314, "uuid": "ef5d1ac9-aed7-41b3-9976-6de2b61ffd81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743314, "uuid": "eebb69e6-0fd4-4181-8cab-48a33f9a5a8d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817af58d-4681-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777765746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765746, "uuid": "ba860335-c3bc-435e-b088-bedc4fc1913f", "comment": "Malware payload (Mirai)", "value": "e21369bbf70da09f2036fde7312331d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765746, "uuid": "679ca44f-bd2d-4f1c-95f7-93a0b06c6ee2", "comment": "Malware payload (Mirai)", "value": "5f97d53a2d87fd799d6f07c56bafed800d00c68f78690d40c60d53642aa75ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765746, "uuid": "700ccd21-3f55-4e47-933c-ce11167a705c", "comment": "Malware payload (Mirai)", "value": "797e3134482e70beb1141aad22060edaa3017435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765746, "uuid": "2663cd24-54a5-4e92-96a1-5cca8348260f", "comment": "Malware payload (Mirai)", "value": "6c459fd6bf37e19538645a193e553755a79756cdb5223fb2160d7fb734375a09260a7a908112978422d11fd78c55d0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765746, "uuid": "fcfcbdac-1196-46d3-b898-a15f5cff3031", "value": "T153D35C0673180E17D5A349B02A3F1BE083FED5D021F4BA89691F9B6A8676D3B1485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765746, "uuid": "9993e6e3-eacb-4a9d-a120-82654dfa8986", "value": "3072:CV0zui1ZhMHJ6A+qrxfbOUm3+Q2Mc9FkGn:LP1YO8dbOUmuQ2Mc3kGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777765746, "uuid": "1873e5cd-8333-47ee-8459-3aebdfb2b892", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777765746, "uuid": "52932dfc-5cfa-4c56-b5be-a45a9fcab9a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765746, "uuid": "c975ddb9-4132-4aee-9a26-44a67d6b84cf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76023531-461e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723206, "uuid": "56e75dae-696b-448c-abb9-53dd1e65b554", "comment": "Malware payload", "value": "417d19a73ce10feb9787c2e191c766da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723206, "uuid": "22fbf6c6-f8c4-45b0-94ee-3dcd1fc2cb8b", "comment": "Malware payload", "value": "5f9c0b7ca1c268f30797bf38d699ce0b157206ac5fb7fa31f21f818ef4de4321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723206, "uuid": "1a3afb7d-70a7-47d0-9264-b0f4b4464678", "comment": "Malware payload", "value": "ee7da4f43dd27112fbb7dff90f41b99f33324de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723206, "uuid": "e80c8f34-3c85-4f57-99f7-7b08a1bf08fd", "comment": "Malware payload", "value": "4f9fa91434e98147dc8d137e7cc581272fd59d856b31834ae2edea1a18ec2cdb8c8c682d3bc8fe49806d07b312678f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723206, "uuid": "d7f369ef-496e-4e0f-838b-45a4b635a04b", "value": "T145C4A30CFE91E805DD1A3E73CEEA14008F7121C2AE2595473559AFFD9B6A37258A327C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723206, "uuid": "af8071ef-d8c9-4998-bef0-8414ff6fa133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723206, "uuid": "9b20034e-546b-4b4b-952e-c452dd8ebbc3", "value": "6144:WAE+/30QWxh3eay2huqORe26BNZo8e6VlWT8b98wifVDxnJxHLQbasYRxshwz1CL:hzPQqI0ezTJPVle8CxnJ/c+7dqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723206, "uuid": "8cce062a-9a90-40e1-8b8c-1056bc3ae6db", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723206, "uuid": "6c8dd145-1a5a-4c94-a36d-bac1b917d335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723206, "uuid": "4584a320-86cc-4715-8a54-c645371318cb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531fc654-45c1-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777683205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683205, "uuid": "d7e01dbb-d968-4e93-a087-6f5963d8eb2d", "comment": "Malware payload (SheetRAT)", "value": "cddfd823238993f497829c09eb4c9630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683205, "uuid": "ca2a2258-ecc6-4ff8-b673-7c2eeebf0026", "comment": "Malware payload (SheetRAT)", "value": "5f9d7cc872f8b37ce6aef29ba366c7b4d4110c1db0c553f036af08d214689113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683205, "uuid": "95459db4-5f34-4ea6-aa66-f2070c8a6a4f", "comment": "Malware payload (SheetRAT)", "value": "ddd85e724dd4bade2fcd1f571a48b4cefec8610f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683205, "uuid": "2b59bfd0-4508-4a37-8b1a-1d7d3bc2a67f", "comment": "Malware payload (SheetRAT)", "value": "73d4c2fbd03878e00efe69334a03301a2688f2a6ad3e9e3fa137f45613e5137451ad551da4f24be9a772ec29f1cb943c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683205, "uuid": "46f6eb98-570e-4a0e-a060-2e06bf2cf24b", "value": "T1ACC4A10CFE91E805DE1E3CB7CFE910004B7161C1AE119A463159AFFE8B663B259E667C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683205, "uuid": "5fa3f3b3-c9b8-4e74-b9ab-20e078a59524", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683205, "uuid": "567ea712-696f-4a9d-96af-667d7c013fec", "value": "6144:gliCRNmZT54PkAp6RUwl6CWFUUee6VlWT8b9MpwZ89nADqXYrhPbGMvO965uBqO0:eiCTz6JvPVle8BsZIdF6uEp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777683205, "uuid": "3c68304f-70d9-40a3-aa87-abf4ed90b2a5", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777683205, "uuid": "d46a1d58-9ddb-4018-8d4c-0207a2290033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683205, "uuid": "e180b926-90c4-418c-9d5e-57c9e8e53c98", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2039bd15-45df-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777696004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696004, "uuid": "14cd0be6-7e0b-4fa2-8b8e-c18fd502e3cf", "comment": "Malware payload (RustyStealer)", "value": "814d37f89ce49383a2022b9dcca637aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696004, "uuid": "320ee4a0-3974-4f1e-ab55-57b72086db5d", "comment": "Malware payload (RustyStealer)", "value": "605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696004, "uuid": "36edaeed-5d3c-4e6b-8eb1-a24f6640c8de", "comment": "Malware payload (RustyStealer)", "value": "eb44914a6a8e2b603d4c73ca7855da52cb8fc93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696004, "uuid": "8b5c907e-2312-47a4-bbe5-6c7c901c3506", "comment": "Malware payload (RustyStealer)", "value": "f470ad57ec8ef36954f7dd90c8ad6c39bb56e820ed415a0155ea0efe18c782ef70eb1aa4fc5e9476b7e43f5b0b7d2d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696004, "uuid": "2f66b41c-64ac-4043-904d-d3bc9f6444ce", "value": "T1CC957D3AB71482F2E64B81346A05A78383BB7C7A371170FAA17E12D41E5597A137E7F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696004, "uuid": "29d6a4c0-2604-444e-a4ef-705bdc2c8e7e", "value": "75012e94a9f8d4eefd3222a35dbe61c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696004, "uuid": "1af7cd81-64d2-468e-992b-b730d4cc3f10", "value": "24576:jqimp6QNXqsD2xTYvmrC8/InJgS8nJgtKlR7dxEpk:jqimv9qS2dY+rC/snJ6src", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696004, "uuid": "010bca8b-0803-4577-b707-fd3aade2970e", "value": 2054656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696004, "uuid": "aa2dfb47-caf5-4158-ae73-8dd3a61991af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696004, "uuid": "7036472f-c662-4c30-9c1f-dbb4074020ee", "value": "virtnetwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c38ddda-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743323, "uuid": "d778a5d0-d469-494f-8601-c127526f1176", "comment": "Malware payload (ConnectWise)", "value": "53019ad6fe22c8d0349590f703c25636", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743323, "uuid": "9a6aa8c2-337c-4c1a-b10d-030a100ff820", "comment": "Malware payload (ConnectWise)", "value": "60a4fd10d1cca7357c9538276cf3dfbaf402a7a4cf0a6a819a5730c169546f1b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743323, "uuid": "54275c53-6533-482f-929c-f395cfe7f896", "comment": "Malware payload (ConnectWise)", "value": "3c032bf28ccf416894b4ffb30234cd67e3226261", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743323, "uuid": "edede3c1-5fb8-4953-bcf5-6e6518f638b9", "comment": "Malware payload (ConnectWise)", "value": "a4205ae4e7af809d079355ef576d4ad445ffdcb6d0f1ddd309e87a65294ee8835b8c989d86d762794870f1d916202d78", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743323, "uuid": "caa8599e-e374-4569-b815-12fbba9dc9cb", "value": "T18A646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743323, "uuid": "ff6192ec-bffc-4aeb-b42a-195dbaaa7073", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743323, "uuid": "7f19de8d-eb37-423e-a350-3d2db3371351", "value": "6144:tmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9tk:I1iw7gryNkSV1hy1Z1u2JLI9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743323, "uuid": "eafa2e2c-83d8-4da3-bb8f-48e38a3a683e", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743323, "uuid": "143b9952-931f-4093-b478-b591b3f1eadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743323, "uuid": "0267e0a2-3524-4838-a17b-43fbbb98dae3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe56d78-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719277, "uuid": "03d33719-922a-4abc-9f3a-1e1c9ca53e66", "comment": "Malware payload (Mirai)", "value": "f785f2fec0d0c579d9e7ceba1853df60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719277, "uuid": "3fb92f7f-63ab-4339-bdf5-bdadd0301ce6", "comment": "Malware payload (Mirai)", "value": "60e5b2c61f04cd82a54c949d84b1bbd79dc4c8ad5e6a794b4dcba45c4d73c53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719277, "uuid": "10115776-cf67-4859-addd-f0b628df8e6a", "comment": "Malware payload (Mirai)", "value": "1640db8dd3acd37f6312246f1b664b9694c4bc88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719277, "uuid": "373c38ac-acdc-447a-81e6-cc4b24bbf390", "comment": "Malware payload (Mirai)", "value": "547832ae9f0eb057d01958aa267dfc2ace14b70b34b890592c0148919d3d0a65723e679ab676d40f34b0901285cf39b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719277, "uuid": "47b79070-21f1-4e19-a2af-908764353dc7", "value": "T18E94A6179D228A68F1248CB213773241A94B53FB48E661D3EA6E8960BF3091F517FFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719277, "uuid": "cdbd1762-3960-4e86-8b27-903b52bf491d", "value": "3072:xqlZWql4+u9R1ZddqD13tmGpnUbjo5WfapZPGkUFFK+joCe6QUIE:MZWP+u9R1Z3IijeDpskUjHjo96QUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719277, "uuid": "052167a0-396c-45e7-a670-d343d841938d", "value": 419652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719277, "uuid": "07c297fd-cc9d-4f95-a8a2-f76cb6450e37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719277, "uuid": "8374ba1b-6e23-4081-9d70-e288c9d5260a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86098639-4620-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777724092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724092, "uuid": "a95710f9-0c6b-4267-a81d-45ac10d2947f", "comment": "Malware payload (Efimer)", "value": "47c8e5117e3770f8e9739b27c7787ed9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724092, "uuid": "a8a6c1d6-8ffe-43a6-a6db-4606a194d675", "comment": "Malware payload (Efimer)", "value": "623d1886f9b6e9f229fe83f42118ab96f1caf33c90d196977bdfd4a73aaa1582", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724092, "uuid": "28a5aee8-da8c-41e5-af6d-5968aa1e8ecb", "comment": "Malware payload (Efimer)", "value": "55b55e41f05fd4233231d4a573e925f0be1546bd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724092, "uuid": "4ce518a0-212f-48dc-8fa9-7ec61f327a06", "comment": "Malware payload (Efimer)", "value": "15040d991c1c4f54a59075210baac52ea173f056459d3284fccbf5994b245147cfb0407309f3d1ec9a6a853dadca32ed", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724092, "uuid": "866f8f89-a7f6-46de-94a2-982e3f7f6855", "value": "T1C1D6331CBAD161EED553E0B8FAE122B8B470B8704B364E6F1768D372AC479F45A1D04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724092, "uuid": "90c36828-6ba2-45ca-82b3-fdd80981f538", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724092, "uuid": "82725225-e7ac-4bce-8992-44df26514128", "value": "393216:Jq7Knfbd7YdzZLMWqa7XMCHWUjX8cuI3/PGTAI:JQKfhkdNjqa7XMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724092, "uuid": "ecffb213-1a2a-4b3c-90b2-7e8e456b5073", "value": 12623194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724092, "uuid": "8e94cb31-9f64-472e-99c7-6aa13e318fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724092, "uuid": "f5df1e9a-a5e1-40f5-bde6-4fdd69daa026", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cace64-4651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745001, "uuid": "7b229170-f9ec-4bff-af43-357ca97b5612", "comment": "Malware payload", "value": "048e20828646cedd51d9b459d299e2ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745001, "uuid": "4b369788-6d36-4abf-896d-dc9310dd09f8", "comment": "Malware payload", "value": "634a5e5b8a15afea7472edf823fbb3ff6c2a68fcdf9aa664e31d949e68439936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745001, "uuid": "2213e536-058f-44ed-bb85-213f9eff8d33", "comment": "Malware payload", "value": "d83064b89fab0d6cf6930b29629d96e0320c91a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745001, "uuid": "926c9bd6-c322-4f60-b9a1-0cdca3034578", "comment": "Malware payload", "value": "5d0c031a67a8968987a3a48456c6bd9acf21d92cfbcd299bebc94a3adaf8454f9e4cf0a22b0a15526070eeda33d6bd30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745001, "uuid": "e58c90df-a3fd-4a8c-8ba9-e20861928562", "value": "T1C0A2E15856C4DA6FC14713BB76FE9C86A0F11C041F82E542366CD9EAAEA104C93F9D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745001, "uuid": "ac38c065-6c04-4b29-b43f-12d2c7dcfc83", "value": "384:Mwq7RdzxfmPvAVA4Sw6Y4hnrmYt9OwWv0gR5D0wJLv1Rjn:z29lVApYav7OXvhR9/Jjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745001, "uuid": "2c9a3303-7a67-4532-9e67-b7bbabf8139c", "value": 21828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745001, "uuid": "1f273e26-a80e-46d9-aea3-c38cf408d5f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745001, "uuid": "23e3adcc-b6d8-4bea-9b80-30ae22450a98", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb653ae0-45ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701848, "uuid": "ff5e7e7f-2688-4a76-a729-a649e79b962f", "comment": "Malware payload (Mirai)", "value": "928cc39b9af05659d1c3a5c6571ffa5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701848, "uuid": "7e22df8b-fccb-4cf7-adbf-af5587c6f1f1", "comment": "Malware payload (Mirai)", "value": "6360609325c6649b48678d7c8bc32cabb09b8800cd3e39309e7c6c32d69a3a7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701848, "uuid": "637ec187-a8ae-4b03-8338-369a2cc0e659", "comment": "Malware payload (Mirai)", "value": "309a0c51f4154f67cd07dae36fec700c7370094c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701848, "uuid": "152e0c3c-cfac-410b-804a-77e83cd0ba33", "comment": "Malware payload (Mirai)", "value": "891d807cda846ca4701f9e60dd89e6affd98dec95fd594501813d3439015d0d42d08e9d62d6812bf9297a59363148367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701848, "uuid": "2b1486b8-2c68-4c9d-89f5-cf662a844d7b", "value": "T1B95423B7EE2956F0DF3252903B18B164D15BCAB7EA9784C781BAC7902BF223C4550F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701848, "uuid": "4e5fca46-97bb-45e4-9a12-63935b19f5f2", "value": "6144:3zrSVStucEdmezDwQRv4XailxwYY9mNH+TWC1rU9/lIwXG/pHqfnk:3zNQMawQtCwYY9eeSC1rU9awW/Efk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701848, "uuid": "c249f22c-ebc3-4769-8dd1-171129460950", "value": 293016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701848, "uuid": "1ebe0e6b-843d-4619-bf53-7860cc829a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701848, "uuid": "b15c865d-de50-4fc2-85e7-f2917442ca4e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f441131-461e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723222, "uuid": "f236c787-2bb5-44b5-8c14-ab9149c40c12", "comment": "Malware payload", "value": "c830829d35198185ada8692b2112b961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723222, "uuid": "a841d037-b5c8-454c-a38b-6435dd10b4f1", "comment": "Malware payload", "value": "64703556b4d642fb8d82553187353be73ba962ab01a9e4ea4f63c33d5c85f3e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723222, "uuid": "bb8653d6-49b9-42a1-9685-2303e2c54afa", "comment": "Malware payload", "value": "f5ce6280c7fa9a8abd2de572e7488444a510e540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723222, "uuid": "5a13ea93-a9dc-49bc-8dbf-d33a21638ebf", "comment": "Malware payload", "value": "e468414d83fed2c636507c7eacf557516ff9ad11a6370b416ecfb216366a619a14e9f13e006168c9442e9e3637b4c6c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723222, "uuid": "f29d1b70-0098-49e8-a7a2-36fd2e179e7e", "value": "T19717BE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723222, "uuid": "f34fe5d0-139a-4bdb-858d-2f21779a187b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ/:cqYUQuVDt0TZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723222, "uuid": "c46a2b1c-8a51-4f6a-a30c-13fa07d5f8e7", "value": 20152320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723222, "uuid": "c6907f97-18ee-4e15-939f-ad6b220caa40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723222, "uuid": "acb6b25c-99dd-4963-81b7-dae709022824", "value": "64703556b4d642fb8d82553187353be73ba962ab01a9e4ea4f63c33d5c85f3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf4987d-465a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749172, "uuid": "a4da6fe2-10c5-4143-bd71-909f773855a5", "comment": "Malware payload (ConnectWise)", "value": "c315025efed5bacc8283c1d8c5cae61a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749172, "uuid": "8e5226eb-7b1f-4720-81e2-11fd8a93c871", "comment": "Malware payload (ConnectWise)", "value": "6473c7a6a1fd540135205b152e76b128b1621f1b76282dfa783401da17383156", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749172, "uuid": "b4fa586f-e5fb-4cce-9d61-507f05bda9ee", "comment": "Malware payload (ConnectWise)", "value": "8a2f3f629e6047bcefca1b1faf834629ae5530a0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749172, "uuid": "91132e79-0d75-4419-8458-aba987e5cef9", "comment": "Malware payload (ConnectWise)", "value": "0dc448801b8819d3b7f4c187d09d30385c87496e1c9c78cfa07d6b7ee49a25706cea6c6431dd0d38c99a70d8b164956b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749172, "uuid": "98b1f6be-eab4-4a3e-836d-c870aee33598", "value": "T12C836C43B5D18875E9720E3118B1D9B4593FBE110E648EAF3398826E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749172, "uuid": "e78027cb-4d7e-4fda-8dfd-0a9753e9ca61", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749172, "uuid": "db55f9d0-b7aa-485a-97cc-0508c2ac5b51", "value": "1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT7rJpr:4enkyfPAwiMq0RqRfbaWZJYYTB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749172, "uuid": "84387e86-f1d1-4fae-b517-19691d8a6d6c", "value": 83168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749172, "uuid": "d0756f3b-a4a3-4245-82a1-b814a6536a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749172, "uuid": "983a2342-08e3-43a7-b903-75641543e637", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b00ca4-45e1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777696852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696852, "uuid": "57057b56-bfeb-4d76-bf00-69854f454c12", "comment": "Malware payload (AsyncRAT)", "value": "d7c7cb74a58d55cd82e204b931592e2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696852, "uuid": "612b58ad-9c01-4351-ad30-cb19882c5612", "comment": "Malware payload (AsyncRAT)", "value": "65ffd2b2dcc4c1908ca6640f59526dde3048255c255ed37829e52af110540111", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696852, "uuid": "db088bd9-697c-4c78-9e01-7862b747bd99", "comment": "Malware payload (AsyncRAT)", "value": "c4bd9589d26ae764a20f14faf3c7758636ffe4bb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696852, "uuid": "36958881-015f-49fe-b5ad-26d8442d14b5", "comment": "Malware payload (AsyncRAT)", "value": "c87af938d897aa312f9e546ef01451111bee33ba3e8d146c991cde86b51086f1e56ffac359b130f9b922eb7e61361b40", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696852, "uuid": "0a894818-f9fe-47ad-ab2b-e0437a6c7627", "value": "T164D31A0FDBB70097C9DD20F994628024DB3B9400CBBACE9736BE644EA9AD44FB5D09D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696852, "uuid": "970eac20-43ea-4b05-8560-a59bab91e95f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696852, "uuid": "7412f6a4-cfcb-44de-b2c3-45bfda012836", "value": "3072:LV0/GKlcPbWwCnYN9ckbA+hsjumomt0RV9UtVUxuOnf:LifcavC9PbCjWB9uVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696852, "uuid": "8259c6e5-803e-422b-87fc-f6aaf0675c78", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696852, "uuid": "b5bec1e3-4d0c-4a58-90c5-c001daa9cee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696852, "uuid": "0f5ff245-4767-48de-98e6-d1636f1508e2", "value": "GhostClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22b53f0-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736300, "uuid": "d021b5da-b055-4095-be5f-957a8153b659", "comment": "Malware payload (Mirai)", "value": "8db560cd2ea4ee9733e5d4231c68a3d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736300, "uuid": "8c1951d1-8a07-40ab-b64c-507be7ef66ec", "comment": "Malware payload (Mirai)", "value": "662b2bfea7b4cd7139eb0bf2c4781627de604d5c3ec0d674d2530b63e8ae3798", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736300, "uuid": "830354cc-d8d7-4459-bf0a-4010a5a3da41", "comment": "Malware payload (Mirai)", "value": "18a49714b23572347b824b32be2a6bd7cd260401", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736300, "uuid": "ea3c4d31-8901-4efa-83e2-0d3e7cc1217f", "comment": "Malware payload (Mirai)", "value": "ea8a41a745d1b9c4b74913482dd59405a03fa6ad2f2eb044d22da07b4baede7cb4fc4f70c1756f9cfcc46d58d1ae6183", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736300, "uuid": "8b9d8268-b5bf-4022-a796-37f719d52d2f", "value": "T103A30887F801DE7FF80BD6BA449309197520FB660E530B76A367BD93AE311D41962F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736300, "uuid": "52e2e65c-ce23-4e8f-9191-748e8dccbf1b", "value": "1536:PyX7fqhPBqgd3ikls5bx068Fx4HZG0u4NUtZYrrctxaS4pNmPte:PyLCTtd3iklybx0n4HuB+fS4p8te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736300, "uuid": "f64d30a8-2749-445b-9e73-259e9a55e96a", "value": 99688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736300, "uuid": "a68107ac-cdee-40c7-853e-77eab948f02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736300, "uuid": "e60ffee2-a543-4174-8b54-348773f371ee", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7bcf3e-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736295, "uuid": "41c5a18a-be01-4402-9404-475ce108cbd0", "comment": "Malware payload (Mirai)", "value": "67396519dccc45aa9a90126133619dd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736295, "uuid": "28664a7f-a8a1-47b9-a76c-f8e377bd25c7", "comment": "Malware payload (Mirai)", "value": "667eaa7342acf5aa891c6a547a375ee926c1eebd1e6840549ed140fb4f30874d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736295, "uuid": "f228fed9-ed41-45b1-bd9d-f82ee349406a", "comment": "Malware payload (Mirai)", "value": "7eb7da140e288695dea1ad5c2d1cdd34da6a26f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736295, "uuid": "721c20a7-d82d-4a6c-80fa-3a86342abbfa", "comment": "Malware payload (Mirai)", "value": "2180faa7dfd69e6de4151ecced4a7ce65781303c466f87d58c3f7581886f68b28652b0b30b1ffecbc6aa8486de7769a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736295, "uuid": "02659f4a-d053-459c-af65-b6368cf8f0ce", "value": "T1E5932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736295, "uuid": "3c68f26f-3d32-4dab-8c5e-ff84b38e8c02", "value": "1536:NJaUfdQD/bb2sDBI3eQYmUi3100x7u/o1rOgLMRJrI:NJNYn2gBIL6kp4g4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736295, "uuid": "e635cfa8-842d-4a3e-8e53-9ff892548dd9", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736295, "uuid": "be3379ff-7c76-4438-9e68-78e3b4c1236d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736295, "uuid": "0f1df426-ba14-4001-bcbd-011e8e76ecc5", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa7da20-4623-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725254, "uuid": "f022496b-5297-40ab-a60e-35931a00974b", "comment": "Malware payload", "value": "e783eee5b971b184b537b5b7e3659876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OOO Severnyj Proekt", "colour": "#2722E7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725254, "uuid": "a492f912-d89f-409c-8331-4009ae65dcbe", "comment": "Malware payload", "value": "66963a9ddd424d96ba78b6158343529a4a95b2b33f19bdf55518f6000a6d5751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OOO Severnyj Proekt", "colour": "#2722E7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725254, "uuid": "29651cfe-40fa-4ca7-ad2c-20060e6b36a4", "comment": "Malware payload", "value": "54b9687ffe19268fd2898960f1996e8468e87e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OOO Severnyj Proekt", "colour": "#2722E7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725254, "uuid": "d5e5410d-a2e7-47ee-98e5-37adab6a374f", "comment": "Malware payload", "value": "63e33041a3cdd91b403b9a6cd5c368e671b3d610b43af005db015a64d1778145cf9f8b9e0bff87ab754b3a7a2c41dec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OOO Severnyj Proekt", "colour": "#2722E7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VPNShieldGuard", "colour": "#2CAB87", "exportable": true, "hide_tag": false }, { "name": "ZyraVPN", "colour": "#49AD65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725254, "uuid": "4425f02f-184f-4f84-97d1-2bf949bda48f", "value": "T104734B4223A8515BE3EF0F3E6873100B4671A261F8EAE7CD99CD015D7DA5384BA60F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725254, "uuid": "da0c2d22-862d-459a-b734-4765b20b5ba2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725254, "uuid": "1fba354d-a334-4daf-8896-12907bedcbe4", "value": "1536:ozVPB7lOhYSrK7pJ5yxHDrJTfgGpfF4iqw8:oJ57lOqSufIxHDFTfgGpNhqw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725254, "uuid": "f7737095-0c4d-4a18-b9ef-943ae18ae43d", "value": 74264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725254, "uuid": "fe39fba2-ffff-488c-9f3a-a5ab727d558a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725254, "uuid": "cedf97c8-7444-499a-b8ac-abe101a9ce2a", "value": "ZyraPrivateVPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3d4b5c-465b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749339, "uuid": "b989849e-2bfe-4d1a-9a90-104e8017fcd0", "comment": "Malware payload (ConnectWise)", "value": "438ffffe8e222aa067dd143f16565467", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749339, "uuid": "34994852-043c-41ac-ae3f-998be25d6d31", "comment": "Malware payload (ConnectWise)", "value": "66b0870ee93e93f2a3456b320e9a17b9ac18f2685f784c9d247d57870a0a334c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749339, "uuid": "c9906d62-a182-49ec-9973-d6f062c387cb", "comment": "Malware payload (ConnectWise)", "value": "ff0ae57c6d7fd1ab6ded54a33737c3720a97e431", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749339, "uuid": "66973b87-d9a6-43cd-8286-e4ff0825af01", "comment": "Malware payload (ConnectWise)", "value": "6d64dc6a7ee9b35322a31062e69ab87b6e4092f021487a90785a5efcda04eaca0a88c9e0cc12a438f332f2f76963d8da", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749339, "uuid": "2be15426-866c-4906-99fb-51649fad1b33", "value": "T154937B03B5D19C71E9721E351471C9625A3FBA211E348EBB239802AE5F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749339, "uuid": "a63e390f-c5dc-4a71-8001-1f9c9ab01cfb", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749339, "uuid": "13c3fc6c-424c-4023-a15a-af48e213bbac", "value": "1536:nXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWg:3E3x5KBDYiKWm/iSw0fRMvygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749339, "uuid": "f24206d3-a573-4c6c-bd0e-109c7c9c9daf", "value": 90256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749339, "uuid": "77ae93f3-4f08-44e0-8332-8865345b1167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749339, "uuid": "f861b7bc-2d99-4a35-93ee-7ba4818688e0", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc8b9c-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744016, "uuid": "411b6b77-68ce-48c7-a732-681a37251a20", "comment": "Malware payload (Mirai)", "value": "bb011c144503a772b69cc86d55813335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744016, "uuid": "5c7eb9f9-7bd9-48b0-b772-be5378fa85c5", "comment": "Malware payload (Mirai)", "value": "66cacf7f4a486f8dd1239ef4f2391b2c93ddfb8ef8aa01304f117efc36837a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744016, "uuid": "6eac2578-6c41-4a34-a0bc-51b0abb0fcd2", "comment": "Malware payload (Mirai)", "value": "c9e06ed1d9306f2d94ee65339dc75b10aae92c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744016, "uuid": "315c489e-4cb8-4034-ba7b-64f5721d2418", "comment": "Malware payload (Mirai)", "value": "a20865c187f6563ac94b30d1a0403a133ac73a090f08de8f95a8d4d386d8d433ce30261b9b300ddea44f18dbc47d4719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744016, "uuid": "63b4f383-32c6-40c8-acfe-ad6a07aa9cf1", "value": "T1CB331A5AF9819B11D5C111BAFE1E128D7313077CE3EE73226E24AB3467C75AB0E3A416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744016, "uuid": "a71dc1b9-d81b-4839-8815-c8ab1b8c392a", "value": "1536:/ynIEdaI1dRY5MFiE1hNGHN+ieMh73PU5hYM:9wasDhNGHsieMh7PU/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744016, "uuid": "c670686b-1fe4-4172-8733-a978c6414352", "value": 54936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744016, "uuid": "fdf1a1db-8f09-4970-8646-b1e7d06abbcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744016, "uuid": "8480bb95-28d5-4309-bfc3-d8798cee94c6", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26628b46-464c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777742830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742830, "uuid": "2f447b4f-e000-4455-aba6-3534b285f5c6", "comment": "Malware payload (Mirai)", "value": "ccb22c9b1708585435ecc0748ec709be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742830, "uuid": "af71571a-e300-4703-aeb3-300193a6c2b4", "comment": "Malware payload (Mirai)", "value": "674d91e1cbf2c262ca0b260cc56cca760cdca7386061ff74996382f0cac7dcad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742830, "uuid": "2d51f8c9-c185-4413-b2d3-e17872184650", "comment": "Malware payload (Mirai)", "value": "4f8e37e349968e85bf1799eb3866d2817a22d8c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777742830, "uuid": "4b89e099-8f36-4792-a44a-efeca6836706", "comment": "Malware payload (Mirai)", "value": "e34620c5766f84425ce0a1a7582bbf20484b2283526c3a50e627f2b72e778958c4c1ef9c92e3a20e8db31ae3d8a18411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742830, "uuid": "6b27d812-450d-4976-8070-7fccc8aecdba", "value": "T116341987FD00CF7EFC07E2B244670915B130BF6658620677F126B9B6EE290D6192BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742830, "uuid": "bda72074-dd09-490c-991b-6400a11a0b9e", "value": "3072:RdO9F5iW+5ghGscSQqYstOrFyhMi7teb5POl9FCVET/vTVKjbiOL4je7lp9ad:RdO9F5JGatKyhL7tebNOcCT/vYLoC9ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777742830, "uuid": "4e8a66d1-fcde-4988-8add-ee0309931b2f", "value": 232216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777742830, "uuid": "04281fb9-1c58-4325-9954-7cef161328e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777742830, "uuid": "e5cea7ed-bb9e-4a3d-81d8-f53450ec49b1", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39c2ee4-45d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777692842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692842, "uuid": "aba16841-4a6c-4af6-a761-7495fd72eaec", "comment": "Malware payload", "value": "5b5b7fef127aeba3f7d79509676911cc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692842, "uuid": "ca80c945-5e75-46db-ba7f-28d242a8f11e", "comment": "Malware payload", "value": "67efa9f54f05057bf29bc79ad890b05814ff3a5023406234baab3fdddae1b56b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692842, "uuid": "613f90a0-54ea-4058-8603-9effc2744f49", "comment": "Malware payload", "value": "6ca3b62030c181aee47d07c8e314166d0e16a118", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692842, "uuid": "4f7c0b33-3bd6-4b33-bdb5-6397684fcefb", "comment": "Malware payload", "value": "0a2a887459ba9165102ef12c3a866dece2f8da2f36b1fba05861160011cc5b064ff262c3ff70e255f6a87cfa3fc8c55f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692842, "uuid": "8df2587c-e7e3-47e9-aa49-ee12d4d8784f", "value": "T169947C9263A504EAE477C13CC8679A07DB7178110360DBEB07A896762F237E25E3DF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692842, "uuid": "fb257297-ea85-4dcb-a122-2a10013a6bdd", "value": "a7b778199509e85e81c53fe53cb0f3ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692842, "uuid": "a308cf27-96b8-4e7e-be14-de7c87c1916c", "value": "6144:LROqlcNrOxZS5COYtLb8E5Zb0xR2mAMOz6JSxJoQsitUUWfvFw:Fn+r8ZSrYtLb8E5ZJmAMO3XPqvFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777692842, "uuid": "57868bf6-8c80-4689-97cb-7c4c4ed1c754", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777692842, "uuid": "85bfe6ab-31ae-4489-9595-f7bd346fb2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692842, "uuid": "85bf3b3f-0ad7-444a-b032-ff445880974b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7746a2f1-45e4-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777698298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698298, "uuid": "f02f6421-eed4-4345-9eaf-49329056a997", "comment": "Malware payload (BlankGrabber)", "value": "8ee0c5ceddbd87b84afccaf0bcdcbfda", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698298, "uuid": "0cf7354e-305a-45c8-b8a2-c6d84edab20f", "comment": "Malware payload (BlankGrabber)", "value": "68a19f4c55f70998f4b330d06fe22022970853db226d9eb9d2be2f9a53605f4e", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698298, "uuid": "b3740934-ebac-4c8c-b632-75d8afc98398", "comment": "Malware payload (BlankGrabber)", "value": "7415ffa65084acabf336f03b1413482ac936ee86", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698298, "uuid": "95b3b309-465e-4ca3-8920-30db9f754fe5", "comment": "Malware payload (BlankGrabber)", "value": "83ea25c987ccb7d998abee660e030db9fe2bdc2b7ce755245c7f4e998c12172339cf9e66d23383c0074a2e9368a3e6a4", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698298, "uuid": "7e4bf02f-dd68-41b1-8ead-83e2479723e1", "value": "T10BC63362A9E401F2F8E7687CC5C3DE395B73BD912B50C2CB421C67292EA34F1457A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698298, "uuid": "e930e4e5-2078-40f4-8645-034592db0fe8", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698298, "uuid": "7c8c942d-92fe-4dc2-9d1f-75b67ec5d51a", "value": "196608:k0X0uws1wfI9jUCZ6rlaZLH7qRGrmIYQcoJ4TBL8lTGwcTbMyinRQEpD:khIHM0drrYQZJ4TBnb8PpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777698298, "uuid": "169eb36b-48ef-467c-9657-79c89b5b2688", "value": 11477955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777698298, "uuid": "4d7912e2-9f26-431a-a7a1-de6cbe58ec0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698298, "uuid": "de6729e4-3711-4fef-82b7-80b35be2ade0", "value": "Built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cd0c2f-461d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722936, "uuid": "9424cb2a-a5ae-4f94-b4e8-fcd5906c89da", "comment": "Malware payload", "value": "09dfc59a64889eb3f2656a6baa261e14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722936, "uuid": "a43f551d-432c-482b-a94c-56649f76c0ca", "comment": "Malware payload", "value": "6a63b828e08d3de36d9b3996b706bee865ee4fe1c44483b9d0e12b5b6411540b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722936, "uuid": "3e4b7c31-8bc2-4bda-89cd-77c715e5cbd4", "comment": "Malware payload", "value": "83a123b5960f487c1fa201158652abd8c2c03ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722936, "uuid": "6f3602d1-77e3-4f93-90c6-9615e9c5c5d9", "comment": "Malware payload", "value": "52ede7ef0d4b9e2318329e76ddbe502038a6cda86b962a42c8cb54169c784a8d98f1304ced4e514dd86a43df92250aa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722936, "uuid": "307dfa0f-23bd-4730-9604-b2edb8534dfb", "value": "T16FE1AFBF81B49247E48BC13CAD13C1AE2BF734253B82A785B4D0D9C565219FBE022672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722936, "uuid": "83054269-01e1-4e96-8a39-6eb892326388", "value": "192:GKa2rD800SU1uAfWccse/FqcJxBH/KFHSrJ:5VTGQjcfiFqcJxBSFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722936, "uuid": "d81c292f-9aa2-4f24-aeed-75c6c4aed09e", "value": 6936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722936, "uuid": "12888fe5-7e6f-4d91-8d0c-1d56dbc370ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722936, "uuid": "73a2f8dc-124d-4989-a879-d953ce6a5513", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f387b0a9-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736302, "uuid": "87acf808-10e7-467a-af2e-cecec943b298", "comment": "Malware payload (Mirai)", "value": "30529dbcfdbb6d7d8f4c1b48b5b83b14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736302, "uuid": "4da5bb25-f131-481c-8bab-bc23355c0387", "comment": "Malware payload (Mirai)", "value": "6a7d0c50dfa8efb79a43e25a94c58f52205c9ca90d8df05d5a19e4069af8da9f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736302, "uuid": "61b0444c-ea3c-48f1-94b1-d4d23c7d2c64", "comment": "Malware payload (Mirai)", "value": "5f81b4ac97eaf32ab3255fac7215c78b0e9ed41f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736302, "uuid": "79e0cd4a-62c4-48a6-9599-73472de60a53", "comment": "Malware payload (Mirai)", "value": "171d5dc247719cbc98c9540388f7cfc5984e58c63e3cab326d8d5e269142608da763ea7b2547610f5e60c998772887bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736302, "uuid": "e8b20e4f-264f-43fe-917e-b0648fc5fb6a", "value": "T1A783190377094F03C16329F026BB1BF097EABDA119B5B184752EBEC59271EF22181F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736302, "uuid": "ca8b3d64-ff13-4bc1-9c7b-ba3fdc052d99", "value": "1536:tL79gT+wtHfOoGtQZ1duycy4ze2iKjqgCamJax32aMAEaLsp6ER:tqfWoGC7uVWim/a/hER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736302, "uuid": "e9c95ec7-2431-4148-8a03-cf166a706728", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736302, "uuid": "704ec79c-f5d9-46ab-b838-481b33a75170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736302, "uuid": "90af7731-580f-440e-bed5-e1c352ab4fb4", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1eeb19-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723970, "uuid": "9028eeae-688a-4094-b8e2-500f2e67f4b9", "comment": "Malware payload", "value": "2d58ab853baadea1db51b55bdb1de99f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723970, "uuid": "f464bb50-d992-44e3-aa9c-73e0e7dbd41e", "comment": "Malware payload", "value": "6ce428f299321778ca1ef550ac20b11e4908120669b285123c1769d7ab06c750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723970, "uuid": "550ba7dd-b8fa-4996-9e85-f75029785c27", "comment": "Malware payload", "value": "c8df4919a1a509ea03d391f181f09c0720882370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723970, "uuid": "cdb6fd06-1eb6-4310-9b17-49cf90b9e20f", "comment": "Malware payload", "value": "5b867be0e5773df5efa66bddb69f3c18a2c0be1ece530b8fa0d7418970b691dc7a14ba5d42b32ff5c112189d7d1eb35c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723970, "uuid": "10d7ed1f-8959-4968-a675-80b4d0c506eb", "value": "T19522A613DA02CE32D4D017789E836F7D3315C800E606EF17E198C5B66EABBCE9416B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723970, "uuid": "6b70d27d-e2bb-4fb3-bb77-ef96dda0b13b", "value": "192:fZhbm8Zxliz3QGPoV8WAGzr860UpdLqgFO3eo8H:fZhwL/PoV89KyjeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723970, "uuid": "9efb39ae-33d9-41d8-9665-380bf37fc3e3", "value": 10020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723970, "uuid": "b57a0581-e3a5-449a-af62-8567e79427b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723970, "uuid": "3284c2b4-5e13-438c-a779-d521cc620a42", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b3c464-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomRAT)", "timestamp": 1777706138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706138, "uuid": "84dc4e44-ad02-4442-98a8-d6d01d8f8925", "comment": "Malware payload (VenomRAT)", "value": "198805306d17118fa6bd5f8444007622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706138, "uuid": "07ddd5a1-9ef2-4963-bc95-0aae27a4a794", "comment": "Malware payload (VenomRAT)", "value": "6d25076b0cf8d493bd252bcfdee87c9ec9e23ddb814cfc671e3e80d31e2bf6f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706138, "uuid": "bc9cc30b-e0b5-4e58-88af-bb8b6fcff6a3", "comment": "Malware payload (VenomRAT)", "value": "6789610dd85bbac6f0a3cb907abcfd9b50a3554a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706138, "uuid": "663927ef-ef16-42fb-9460-d784bb0b1243", "comment": "Malware payload (VenomRAT)", "value": "74eb06747a59d5b6b33a08cf653e97ebcf57f09a2b95b42c4598693f67060ed6019c738ee108e4c9b68111ab712d95c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706138, "uuid": "6231afc4-1b9c-4450-870b-16961fbd993e", "value": "T1CB657B16B6F801F9E0B7C238C9939506EB72BC664770E75F139056475F237A0AE3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706138, "uuid": "59579a52-ebcf-4636-b05c-3575dd70ed30", "value": "df32d3df09d23b38aec4581fe99b70ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706138, "uuid": "e6924d1e-4711-4b63-86e1-c42f651c55fb", "value": "24576:6U41mYEttAKuQ0OhrxbM/tCDseCgA+2lOxhg8kcNx:6UNYOAKuQ0O91M/tCDcgA+2lOx+8ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706138, "uuid": "c5f891f6-7690-446b-bed5-1760ede52a65", "value": 1510400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706138, "uuid": "9a98d325-9c32-408f-8f5e-4acf81092bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706138, "uuid": "47b93a92-8f66-4762-a117-71ddcd03b6bb", "value": "198805306d17118fa6bd5f8444007622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b39db7-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777704714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704714, "uuid": "85fa254d-f83b-40a2-abcd-030e1eb6388a", "comment": "Malware payload", "value": "adabf014a8cfaa31b88dd31dfda143fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704714, "uuid": "72a245c9-dd45-4eed-b904-eabbab5db797", "comment": "Malware payload", "value": "6d522546ee9ab7ebc25c7dd1192e6747ba6c16415ef08a2e4b60a62af705c494", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704714, "uuid": "a69dd259-d3ab-4f1a-b4af-a5ef2bb53167", "comment": "Malware payload", "value": "cf9302bd0e8fe522132f7f857cf79b010759247a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704714, "uuid": "62efb159-b2f7-4855-a0d6-841a52e9b6d7", "comment": "Malware payload", "value": "90a38746b98abd18aeab01ae17c03012881633356f69a366922d6bb583862c3ed8afa20b435caae679f49f797a1c7f0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704714, "uuid": "a3995321-f127-49ea-854f-2f0c5e84c367", "value": "T194E09ADDB0B928A8FC00BE4378D18F946141F29B6E9B4F49584C1E61ED86AB4303AB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704714, "uuid": "69266482-4e98-4d09-8fd7-6960ae1153dc", "value": "6:NdXr9UCuyU4IUZXr9Uh0yU1BFIUAK+Xr9U4LyU4IIU4hPXr9UeGLyUeGIIUeGhkn:hDIyHFIjVnIdedIIeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704714, "uuid": "591d5a87-f567-4c51-86f1-74f93263a6fb", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704714, "uuid": "a6d653fb-c1bb-45da-9614-6b331cc28de4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704714, "uuid": "25e9b7cb-5bb4-4bac-b021-dfee47c1716b", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cc4195-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704954, "uuid": "4bdbf229-701d-47a9-8cb4-c42e0c24eabb", "comment": "Malware payload (Gafgyt)", "value": "dd7f4d480156d336f9830d97bdad77f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704954, "uuid": "0367881c-549c-4892-8848-fa241ecc1435", "comment": "Malware payload (Gafgyt)", "value": "6df4ffb6b7f7743f5056161143be3f9e0c97384ad995addd21bc63f506ae60df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704954, "uuid": "c0e1edf8-24fa-416f-a602-efb946a455d5", "comment": "Malware payload (Gafgyt)", "value": "22cc95d9e30a446550dfca167fc7c6bf57bc12d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704954, "uuid": "ef21930c-becc-4e12-b050-8cae8d93929a", "comment": "Malware payload (Gafgyt)", "value": "3288afb94d7f7aab84b007ec905180d0e7418f5f3ff0d40b52703d91e68dd8c3fe5cc357fc879e6995ee16bee04e868e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704954, "uuid": "2179f61a-1abc-4320-a86b-71ee9466c11b", "value": "T19DA32A26BD018F43C2C315F3BB9F47887B2667F9D2EF3243E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704954, "uuid": "5ad7ea2d-5669-4779-b088-c71527d243c8", "value": "1536:HGuY5rLw339swiBmlX+dqFRBBYZF3C2or/OQrW+sbGI4q6yPx85hlpSVq:HGxqH9REof/YZLoRc/4rAy5hlpSVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704954, "uuid": "9964064c-dad7-4831-b35f-609a39c351b6", "value": 104276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704954, "uuid": "2c398fa8-de7e-4cab-b4b8-29f658b19ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704954, "uuid": "e3780d4d-9a8c-4d26-a682-9c37f07d9e0d", "value": "ar5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eead998-4621-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1777724376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724376, "uuid": "1beffa1a-fc90-4df2-ae77-e4362d2584df", "comment": "Malware payload (DarkComet)", "value": "147c78019832b14a9f4db8335f678677", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724376, "uuid": "768bc7e8-2e6e-4954-80a9-f5810821c662", "comment": "Malware payload (DarkComet)", "value": "6e0ffb1fe4a65f13608436c52a94dc39cf4d052d4911af47427ccdd86e2eb140", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724376, "uuid": "b54f2c18-e4c1-4f0c-a0f8-d8dc1fe323d6", "comment": "Malware payload (DarkComet)", "value": "97151d20e74a9312d197fc3276817fbe8a57a5ab", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724376, "uuid": "bbe6b361-75bf-461e-9141-e922130e1f20", "comment": "Malware payload (DarkComet)", "value": "86e5192b833f5f95da0661a3d3bffeed9740783490842b8363e30e0bba9bdfff4342b0eab99018f37a1c4e07cc43d6ad", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724376, "uuid": "0260c9b8-4abe-415f-b426-9a7a6f333b90", "value": "T1CBF46C31B5808833D92239F89C5A92E5942A7E202E25764B3AF53F4C5E395C3FD162DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724376, "uuid": "2edaedec-d1b0-4502-bad1-95956726f795", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724376, "uuid": "86074cf8-bdf4-4cce-b96e-638090eab11d", "value": "12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hxqMd0QZhw:qZ1xuVVjfFoynPaVBUR8f+kN10EBjD0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724376, "uuid": "8fb224ab-4690-49e9-a764-b7986c6f2237", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724376, "uuid": "cd6f530a-b9cc-4f45-9a3d-366700dd3ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724376, "uuid": "d172a957-1acb-4e7c-8883-edfcea20bca3", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde2e42b-4633-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1777732400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732400, "uuid": "cac58490-d030-4211-9521-d7a3b47120c1", "comment": "Malware payload (XFilesStealer)", "value": "4c6fe3d0c28a3499d6b20352817e644c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732400, "uuid": "f6d0df42-0b4c-4c57-b19d-33ab06c263d6", "comment": "Malware payload (XFilesStealer)", "value": "6ea1d7de6c05964ca1fdc5976e50b9d728361930946a10b0c920da3c971a666f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732400, "uuid": "8533d689-5d4b-4d7a-9751-25abddde3637", "comment": "Malware payload (XFilesStealer)", "value": "f16556eecfc6c84a8e3552394d904c030db175dd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732400, "uuid": "baba5e18-0bf5-4a89-852d-f3aec3d40760", "comment": "Malware payload (XFilesStealer)", "value": "973640ec7ec7c69b616134c886b8f5da89aeaff2559c83c9a1eb5db8f57aca5cd760c243e08444cdc028a0585e604de4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732400, "uuid": "685437c3-4e29-4c9a-a0d9-f8bb607fb622", "value": "T1EF17339BDE027F76F263DA3F47E1172D55A12D535453C0DBA3223A2C0A36B816BF9089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732400, "uuid": "23ecacf8-86e9-4b4e-a0c5-4e02d83e37e1", "value": "393216:cyMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pGhN:DCj8XUW27YWFlbaAHbhLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732400, "uuid": "615c8fc8-c868-41ca-b293-776665a894ef", "value": 18878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732400, "uuid": "431ab2eb-a06f-4f85-b457-e57f6b4e53d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732400, "uuid": "165a1389-dae6-4d0c-be6e-18137aea0700", "value": "rsvp_access_pass.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff5c70d-45df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777696138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696138, "uuid": "f3a87223-f219-4363-afb3-c46fe1734eb8", "comment": "Malware payload", "value": "864bfaf43ac26ce7ef88cecc39387edc", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696138, "uuid": "814946a2-aaf9-4198-85a6-c0be6151159f", "comment": "Malware payload", "value": "6f6798c94cfa0648a05a25e87626fa4c4bd5f83a518f150e396a601bf4a5afd5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696138, "uuid": "965dc72d-b5b4-4ed3-90d9-4b73754129fc", "comment": "Malware payload", "value": "a3f743743116181ebd8ce4eb2418e49628cec683", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696138, "uuid": "e79f6142-13d3-48ae-b0e4-7b6cc487bb72", "comment": "Malware payload", "value": "3650c2b1d27fd847b57ef2e6bb1819af154a90373d7a3e9480b7c6f61fadc8552b47501e5b769a4e3b62a6ab689bda42", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696138, "uuid": "21e563be-7b59-48aa-98a2-5a5d1102114a", "value": "T132E4AD1798189793D11D83B8BE070CA96F4A5B4CA8C539EE306F5DCB3B947760C6E42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696138, "uuid": "89952ab1-5cf7-4a7f-af88-de9787379e39", "value": "12288:W7gX3umqfXLksVyOj3hvAZ0akbPDfhPuD1nMoX4:W4+mq4sV1ADKP1Pu1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696138, "uuid": "b96146eb-78de-4279-8147-2441aa3e2cb6", "value": 683173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696138, "uuid": "4b7153b1-03e8-448e-bfcd-b50610ec47af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696138, "uuid": "b949dceb-be11-4fc5-b039-b64683abcb49", "value": "SecuriteInfo.com.Trojan.GenericKD.80035771.10389.14384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed8d08d-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694633, "uuid": "397abdd1-61e6-4b8d-b0ed-1609469dd4b6", "comment": "Malware payload (Mirai)", "value": "416c1a47c5626502d098cd5856aeac61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694633, "uuid": "f85c9f9e-987f-4351-a9c4-d3ee6518d632", "comment": "Malware payload (Mirai)", "value": "6fc315468e225f8702dd1f124b1ce795d4eadfa547248a7b118e28c9af189733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694633, "uuid": "475aab70-fb21-4ae9-aa54-d8add0293064", "comment": "Malware payload (Mirai)", "value": "2aec9bb225ed1d41a2a5a4369de138f0a2c027a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694633, "uuid": "8188b924-575d-41c7-b26a-7dfc409adfdb", "comment": "Malware payload (Mirai)", "value": "7996a5bed8e6868660d8429baa726312fae78b1ff00811172d22b54181d4a4dceb5e19e226fe54cc833b282fafe81bec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694633, "uuid": "a1b0d2c7-b6ac-49cb-a854-7721d1ca1266", "value": "T178833B97B801DE6EF40BE6FA84E30D157530BB6A4E930B76E256FCE399311D41912F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694633, "uuid": "7201ca64-35a3-4893-b8e5-8da6185dbad5", "value": "1536:zKsLQhxk/04deLq/g/hkM2632989Kee7oGhRikXK7/at2MDeX:zKsLQhide21r632kKthok6iqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694633, "uuid": "5e948d38-4c07-48a3-8291-262360092ca9", "value": 86224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694633, "uuid": "45ebe386-f739-415f-bbba-586cb49086b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694633, "uuid": "952a916c-50de-4280-a7be-883d1c419dbe", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7caf5167-4651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745122, "uuid": "30640bc1-42f4-4544-8b76-8e77090d32a7", "comment": "Malware payload", "value": "e30fcb81447b85490037e0095b3d131b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745122, "uuid": "cb312dc4-baa9-4f8c-b531-cc2574f8e579", "comment": "Malware payload", "value": "712121d29b06d5583856e5de4d6f5f164e0c0b21372fc0d1815354fe3ad979d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745122, "uuid": "0ff1ef8b-35ce-4424-b8d7-2c05310d9e96", "comment": "Malware payload", "value": "b6581e3a422353ab82f20dac65f9bb2beb2cee21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745122, "uuid": "1825fb56-b213-4739-9c13-8a835d690e5f", "comment": "Malware payload", "value": "7babebd2d386d0ece3ed56f7a773c300307f6e41625cd62d7a3df4d079abff6ce35e01ceb21b4afb3c027bc2713f4038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745122, "uuid": "f29644ef-21ce-462d-8bb7-bcbc96f75106", "value": "T125B2E1B602AA2972C9680A7194E9CFC5FB9743F8D0FC356177116E7857C870B68EC5C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745122, "uuid": "1a75b858-67d8-402f-9604-50e9e05e0c5e", "value": "384:jk9v/szUvc5L+WY3N3MTSPuT6fAAElbPv+3OszdCULyStZG5NhymdGUop5hVa:YvUqc5Li93Mumfjlbu3xIMGjs3Uoz7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745122, "uuid": "2a2f4275-6158-4a80-b614-dfd1187a92b1", "value": 24552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745122, "uuid": "a52b52c0-1ec3-42c7-bf66-7a383e27b0da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745122, "uuid": "4409be3d-f1c9-44c8-8101-916a508fef39", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed04cbb-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736294, "uuid": "757f39f0-d962-4f7f-9907-4df4481ff1e6", "comment": "Malware payload (Mirai)", "value": "3454c9c9d69c60c14ee3d3d0244e1135", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736294, "uuid": "95a6b675-ea0b-41b5-9255-07a17c8e6682", "comment": "Malware payload (Mirai)", "value": "7221afe7676f43d7fea393f23347e75aacd98b70700ca9eb15e0d2099fcfd8ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736294, "uuid": "0613afa3-ece0-4328-ac2a-8f5b4c70d5d7", "comment": "Malware payload (Mirai)", "value": "7532d4beb8d907fa421b24ead7abe39f61f10fea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736294, "uuid": "c21a2cd6-d370-4e2b-9caf-69ad2c39b7b2", "comment": "Malware payload (Mirai)", "value": "3b9ff257fc8cf105c09aaa1cd1d4a916eb0f126a79cecf9130b4fd75b32f54c1ea6d11365f4b0bacfc11a5402130969e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736294, "uuid": "e0da1176-6bbd-44c2-8281-f49de37cf9d0", "value": "T14093F842BD429F13C1C621FAFBAF059D3B166B79D6EB3202D921BF9023868D70D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736294, "uuid": "843cfa3f-01ef-4160-996b-81f01c80a3f9", "value": "1536:wV4F+8wMvh/zTjmCon3rqMGbRCiWeFvkQ+vSLDgUMwdxMUF8x9a:wVSUujmCon3rqlNZdkbvSL7Ml9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736294, "uuid": "19a58386-4fc3-4130-8733-e12218b5ba3a", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736294, "uuid": "7a2df142-ea5a-4836-940f-bc27d106c4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736294, "uuid": "4320b440-1d52-416e-ac80-ab917cf55faf", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d466da2e-461d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722935, "uuid": "6fba04ed-4abf-49d7-8bfc-2fddd39adfaf", "comment": "Malware payload", "value": "bc10da338365571a9dfc2f0e3569a3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722935, "uuid": "e2c838b2-53af-4024-82cc-cb6eae7b0c2a", "comment": "Malware payload", "value": "7409652192e4bc045e68e64b44cd0564d11f9772de39a4144fa6b0442080e70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722935, "uuid": "2c024fc8-19cb-402b-9acd-d7ae60e1c436", "comment": "Malware payload", "value": "1f2c68debe241b1a32f3fbdac9b51f12be0030ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722935, "uuid": "6a13d2a4-d23d-4ab1-ba39-badd55b469dd", "comment": "Malware payload", "value": "291f5f3eff7e4823b080184c4ddeac49a51edd3fed8624524b2d13dced3ca3560822bcaee55b0460834fb1d2feeba267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722935, "uuid": "eac0c639-3d70-4977-a7d2-223f9c033bfc", "value": "T1A067335B2CCF09D6D98114B82727ABC723F3979E8DC68C747AC87105B0A1FFE212A556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722935, "uuid": "260dee1a-884d-4bd4-ba01-26e3ee8f54b9", "value": "bef1765298b9a91965863255b4278f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722935, "uuid": "cf68368e-cb03-4694-a891-8b26db19212f", "value": "393216:d9mthRT6eOCAMxbusxCOFnD+zvfB5cxUdZzyZmEtjGgcoMvajdcBa4zqwFmNbBj0:dCr6eOgyinDEZzAZ9PM2NCqR7w8gofc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722935, "uuid": "5e26ab2b-ce40-4e2d-aa07-50bb7a17f671", "value": 31299072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722935, "uuid": "8672ba6f-b2d7-4fce-9794-ec34d8ee5b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722935, "uuid": "08bc7ec6-e760-41c6-b595-1ba39967e374", "value": "astralfree0.38.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea6fec2-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736320, "uuid": "d8d2464d-badd-4855-a5d6-bf1990b9c5c4", "comment": "Malware payload", "value": "024ce9562d998dc9c85062a27f31bb17", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736320, "uuid": "630855b3-9c3b-43b3-b05b-a989026d982a", "comment": "Malware payload", "value": "741349ec799269808135040f975c274c257ec30355adfc765b2d343442358d29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736320, "uuid": "641fcb2f-2070-45dd-ad9a-76dee8836d64", "comment": "Malware payload", "value": "b42d8b4eb0dba24effe30795a82643b7a9dcd528", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736320, "uuid": "9e990382-75e7-48ff-a0ad-2bb2ea6d7a76", "comment": "Malware payload", "value": "ad412ca825920cac62963597171390c55b9bd3ce562a4570e566523e70771ae9f64f25fd505b21c345f17ce681a0566d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736320, "uuid": "8776c611-8be9-46dd-9b0d-95d0d48b9e4a", "value": "T11A864B137A28E70FC62821300CB2CA94276A1C9682D7915BB745F309F9F61BD5DAECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736320, "uuid": "2df03a77-9d8d-4e3a-8e3e-fac9d4211ad4", "value": "49152:6Nu7vyafxvoTeM3bZN8lMCtlb5KoOVvtUzAbGHHR/9rgHo2+LE4lvzmrljwia5pl:VtQ4tcjwiQ0TJVCBknUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736320, "uuid": "50e15669-1dcc-42a5-b1d5-27a19b7737ba", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736320, "uuid": "f4e44299-d8e7-4590-b516-779aa6326c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736320, "uuid": "827688ea-4771-405b-9626-5c2570ac36e8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e16b591-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743299, "uuid": "bd9103f0-26a4-458d-9539-fb5db77c220e", "comment": "Malware payload (ConnectWise)", "value": "3e31e8759f3676939be3f6c9848e14f2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743299, "uuid": "f70c8938-b01f-49dd-b6ad-6099440fac00", "comment": "Malware payload (ConnectWise)", "value": "748aaa99605255d22a1297b36a3737664af40a5e9c173344dd3028e66e6b81f9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743299, "uuid": "d9c1c2ca-4d6b-4f2b-9d69-e7f26098c7ab", "comment": "Malware payload (ConnectWise)", "value": "51ee0a7fdde0c4d3e15e7c21611e1cbdfe53a438", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743299, "uuid": "0ac8fb46-af79-4355-bff8-9cdcbee194b2", "comment": "Malware payload (ConnectWise)", "value": "1d85e39e9750d88943cb9754dbbd15c43280dba59b7277d7518bbbc7c6d55f483d10d6a4f9272b85d494c7b38077901a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743299, "uuid": "be29d039-7b32-4788-97d5-83b7591d9957", "value": "T1C1646C11B9C48432C673383107B8E2B28DBDB8301D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743299, "uuid": "bddf4992-ed7a-409d-a283-e488525e5768", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743299, "uuid": "1c489511-fa02-40be-ae36-814a212ab269", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti983:A1iw7gryNkSV1hy1Z1u2JLI9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743299, "uuid": "2c3bbb2a-0d22-4e23-91e1-a4242b80d83c", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743299, "uuid": "7eb565dd-c798-4f66-beb3-901068916418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743299, "uuid": "12452f23-aed0-4970-b431-c4d7044e7ce5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f2818e-467e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777764619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764619, "uuid": "49d27b6b-4c2e-4153-bbbf-2cdbc1e75ac0", "comment": "Malware payload (Mirai)", "value": "3daac46ef8db89dfc1d3ed73c1795745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764619, "uuid": "6e22d158-6918-46fe-9e02-36bc9246861e", "comment": "Malware payload (Mirai)", "value": "7542442388c45ad593e400b4325355de0a2e7e7c86a8ff7bb7f624a0ec1be9a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764619, "uuid": "903ee9b6-0ead-495e-801b-0821582a0eee", "comment": "Malware payload (Mirai)", "value": "2b594f97f88e007c4224833aeee024c1f3359457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764619, "uuid": "7d1fc8b5-f0de-4611-8293-bfc27facfa51", "comment": "Malware payload (Mirai)", "value": "efc4c970a81e4057f4f134ad2f658183399cc696ecf89fbd5495ac5eeca521ac600d2071634cf579dae6c2400a2b9860", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764619, "uuid": "de3ebe04-8ddc-4c6a-9ce1-b4d0305ae092", "value": "T150D33841B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764619, "uuid": "eee8859a-0c59-4616-85db-5a07487cbfd5", "value": "3072:snFif7apx6XS+kUgpjWXlsCMobmaY0qhzCQSs:sn8ZS+dQWXlsC17YbOQSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777764619, "uuid": "f31e2ec4-4ef5-4a6f-8b70-d894564585c9", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777764619, "uuid": "a141bc46-6048-4d9f-b85b-0be7e6d672f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764619, "uuid": "d8f9e73b-21c8-44a6-b7e7-62fe8a96b8f1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab4e1f3-45bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777680936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680936, "uuid": "929dde55-543d-44cd-b39f-f3c558ea6a74", "comment": "Malware payload", "value": "a9270718ee710487a6b319b05f59438f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680936, "uuid": "9bfbc065-18af-416d-86f4-4ed8a474a99b", "comment": "Malware payload", "value": "75fb0befa04df727eba0d58863592ec246bf163d4ccf5928aa3b5a4940212a27", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680936, "uuid": "339c0b9f-d1f7-41eb-bd90-ace98f66ea30", "comment": "Malware payload", "value": "113df2464ee013a139283c8e6e2fe1b0e57c716f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680936, "uuid": "54c8eb02-f77a-4052-9ca4-36f4b8c2b8d8", "comment": "Malware payload", "value": "cee0e94b9931914551a663876016aff52414b93043a28740e46a1283e7bfe74f51a3fca64e4c1f8deb772ac5568b6654", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680936, "uuid": "d7e9bc60-a189-45e5-9775-83be21cdbece", "value": "T1D7F0274024C7C9B24CD5268A07882DD67527945AC12F4F002AE000EE64198DCD4CBFAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680936, "uuid": "71e036ff-aae5-4cbc-88dd-20c1a19cd9aa", "value": "12:QUp+CF16g64CTFMj2LIQLvpMKiW+CVGrMLvmuC+1g3V8kr1V:QUpNF16g632CkepMKiW+CVGYTViF8kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777680936, "uuid": "51b9df61-36a8-47c1-964d-265b37fcf615", "value": 464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777680936, "uuid": "108d70f9-f4be-4438-b162-0fe0eba07dfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680936, "uuid": "7b681197-c715-4fde-a8c9-5c14c24b05ce", "value": "main.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22db2c4-465b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749587, "uuid": "25cfab37-397a-4b80-b2a1-a0e2b4c03fdc", "comment": "Malware payload (ConnectWise)", "value": "746e01025ee4ce245ba9292c8e558027", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749587, "uuid": "32803f2d-061d-4ae6-a9a1-f482919c62f5", "comment": "Malware payload (ConnectWise)", "value": "75fdefa16aaf580ffe53570d85000e96ec9b455a64fef2c752e1ba90300a4a19", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749587, "uuid": "12663333-de74-4e89-9ca4-6a89d5091ffb", "comment": "Malware payload (ConnectWise)", "value": "ff3535161cacc4a018ae9bdefd3b6d15f7acf01e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749587, "uuid": "0efcd08d-0831-4f50-a2fd-f2c145a6161b", "comment": "Malware payload (ConnectWise)", "value": "e42e6d05d0c1b26fa020228c967ba6ad4eb45d58a470967653df42747733451b9ea98bc3a8c857e4b994f98b41727f9a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749587, "uuid": "6212611f-9d43-4242-bebf-a749ffb0d1e3", "value": "T199646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749587, "uuid": "e1dee444-6c53-42e5-8953-23f49dde8557", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749587, "uuid": "4d417c7e-0915-44a3-b607-2846583d80f8", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji98:R1iw7gryNkSV1hy1Z1u2JLu98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749587, "uuid": "9b4eae96-dc53-46f9-8a26-e57ada157d0e", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749587, "uuid": "b8e1a6bb-563e-42c1-ae74-e789eefacf42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749587, "uuid": "8d4eaffe-452b-46a4-9bf0-735df99b7433", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd996d7-4617-11f1-a769-42010a9c0008", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1777720320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720320, "uuid": "867a0dc0-8cb6-41c1-9b12-200986df3e2c", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "cbf127bb4c9f70c49b770a3d01b3d20a", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720320, "uuid": "2f30746f-a870-4b4c-bc3b-9f0ea03210cf", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "75fe62b309d21c3c606af85633be05ef836cb7b1e7e45b292c9138108016ee25", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720320, "uuid": "307d987a-3769-4f7e-adc8-9f7e2cfa8a29", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "ee974b88dd14be0ee1168c2f33028ab4535e00fe", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720320, "uuid": "cf6fd21c-7214-4aa1-95d1-d135c7f581bf", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "95c88a11a7db720d80d4d1a2a449a2759d3d7233a95ead1404cb6fd4f24464bc2172efb7bfa70599e7f90d9c26c14966", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720320, "uuid": "74e1d7d9-7aaa-4fdd-82cd-9b39b32f0eb9", "value": "T1049402216741537BC1F292F3266BE1EBD364753523A084423BDC0ABA374585CEB39BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720320, "uuid": "4f2c0d30-438b-4c4a-b21c-c201ec7873f5", "value": "e71fa9204774e88bd8375bad3a74bd2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720320, "uuid": "11fd6c8d-f7a0-4961-b62c-569e7db60138", "value": "12288:thWtUzDjx02bGDuThEMedy3/hfdLbk5jKXIt3T:naUtFGshEMMYdk5jKXIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777720320, "uuid": "827724e0-374e-4349-a395-584b42732e83", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777720320, "uuid": "e258114a-f3b4-4675-bb6b-eda2f67a3870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720320, "uuid": "d88bca17-ee70-47c9-a187-929bbd602f77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cde8a51-45fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777708883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708883, "uuid": "40089838-d866-48a4-b569-bf7ec2d510b2", "comment": "Malware payload", "value": "13ee63417fa72e294e41cbff714401e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708883, "uuid": "e69b86b1-72eb-44e7-8dcd-ee8fd8735c8d", "comment": "Malware payload", "value": "76c36fc6d8513ea1eb435462e1bdcdd563711a649ec022f4be196d4e5a757a79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708883, "uuid": "00c75c61-0f8d-446a-9a6b-dfa26a3aa0a4", "comment": "Malware payload", "value": "0290c6cc5bd3a4180b8620c4b2ea7a0030c7fbe6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708883, "uuid": "3112f97b-9dcd-4465-9ebb-afccc00f6a01", "comment": "Malware payload", "value": "5cbe3fef69a1eb68fa29ad4d29976b1be8afbd5a9e84d1f70a445a6ec6507402f0e06388cb6d46fd65b8985adc1b435e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708883, "uuid": "321a45f3-a034-446d-a57a-155d54eecf8a", "value": "T16B057D6273859A67DEA94B710BE3C334E7E4641212F3454AE322233C4F711BA5D5EEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708883, "uuid": "75623917-6f76-4633-ba90-46ff78a95dde", "value": "12288:oiY96n9oemv9TDmJyz8GwjTkumyVRMlEXLMlIK4g5xCuclefaaCqaWSJhaS5:1YgifFmJk8WNMzLMJC6CuSJhaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777708883, "uuid": "d7e5c44f-f6fa-4751-a7dc-c8fa6cbce718", "value": 804856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777708883, "uuid": "15b74b0f-bda4-47a7-be34-c2b92f25ecda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708883, "uuid": "96c08bf6-c017-45a1-b0cf-96222f0fe9c0", "value": "mipssystemANR64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc77bb59-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736639, "uuid": "f67a742a-6556-4bdf-b597-ebfa36830320", "comment": "Malware payload (Mirai)", "value": "ac4a3ec41f75e39eac8c3298db613727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736639, "uuid": "8f42bf2a-0442-486a-ba06-0591549eb714", "comment": "Malware payload (Mirai)", "value": "7755520fc3fc74c815f972a54f9e7c7ccae95c8c4cd4c1f5043a903af222e711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736639, "uuid": "0c2eb052-062b-4689-b705-cecfa8cd3928", "comment": "Malware payload (Mirai)", "value": "f1668b50ecc3cbf6b03b24de29523fbd1964fd90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736639, "uuid": "61d1a5c4-fe5b-444a-9cf7-9d1f7609639a", "comment": "Malware payload (Mirai)", "value": "32d14da25388c50ecf4a07d4e63be0e4971f335089c83fc08683cafe3689e96724999638b641eafd11b26e3837bd4200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736639, "uuid": "91a3192a-1141-4e99-bad7-064357f82e9a", "value": "T10843D652B8815A6BC1E423BBEA6E518D3371B3F8D1DE3616CC111B24778952F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736639, "uuid": "29ea9be3-4bf2-46fa-8cfb-eef41c714561", "value": "1536:Jk48ZOlDxbcYfiQ125+XDW+rd8ev0ClG9WkQx4d42+:x8ZKut4DW+iev0OG9/Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736639, "uuid": "6b4217f8-65f4-45b6-8534-835cc0232cf2", "value": 55612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736639, "uuid": "6751bea2-e758-4ee9-bc31-03cf887252ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736639, "uuid": "4e41a0e3-c5f7-4ae3-b5b2-b70c90e9af43", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d98fbc1-4651-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745123, "uuid": "af058fbb-e778-445a-b16c-f53c9907af62", "comment": "Malware payload (Mirai)", "value": "14b821abbc92150eb97a9f692dfcdb08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745123, "uuid": "13be2f9e-d939-4b4f-a6f1-fd656f3cd196", "comment": "Malware payload (Mirai)", "value": "776bd43ac6124cff6985d70193cc38c8874cf9d7fd32bdb4b1e1fe9d5bfffddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745123, "uuid": "50fad4d3-7135-4bfa-9726-f96aa12e6940", "comment": "Malware payload (Mirai)", "value": "f2b6e9048b9b9f0e14eef17301cfda2c9f2677ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745123, "uuid": "89df3a3a-faad-4e66-94dc-e6c5c8ee09b1", "comment": "Malware payload (Mirai)", "value": "e54e8cd63e8479f032eb1e628406129284d3ee729773727e3b64e485a427ff1136cd884174d6fa3d1a26eb393e9540ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745123, "uuid": "9ef3cba8-6057-4ef6-89a7-b4bfeaf8cce2", "value": "T13BB55B41FC51AA56C6E067BAFB7EC28833272BB9C3EE30174D04573477AA95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745123, "uuid": "abeb20b9-a5c0-4630-b129-cace67032795", "value": "24576:cd0sviBeTKxPF8BTqpZoiLPjqoQUfFJDiblnmCAmRtdus5tsjwAHZPoVp4vPlev:cdKPWqvo2/JIftAs4qVp4vPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745123, "uuid": "0aa7e61a-c143-471d-8b55-ef6a0a14d942", "value": 2470780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745123, "uuid": "acd9b2b6-eb95-4b6d-8b3d-9540375bd18f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745123, "uuid": "2eebf35a-f34d-468e-b36b-31ad0b50b302", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593c8f63-4627-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777727024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727024, "uuid": "bc018569-faf5-4028-9b2a-6fbc00e54358", "comment": "Malware payload", "value": "7c7d2ad945f19f3abf45131d3dcf905e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727024, "uuid": "a288808f-f772-43fe-b9fe-8e18be901e36", "comment": "Malware payload", "value": "782e997acb05b5790ea86e57bda96368250bb93739aa056e8441fb6b2b3d92b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727024, "uuid": "d657f4ec-b074-48db-accc-23eb84cb3f83", "comment": "Malware payload", "value": "381ec405b8fe489ae942a4c68036e45776e84d09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777727024, "uuid": "b1b16fc0-f0f0-41c3-a43c-ea63b0e2c5b9", "comment": "Malware payload", "value": "c93042a06b82a56a27919cf8c67f7c43b177ab3d8ffe217699b2fb07a89e2c0915f8ae3efd7d17aeef94241a3e1ec8b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727024, "uuid": "81b8c542-0e53-4a2e-9d53-f71589d466b1", "value": "T124029E01DBD2DA03F860E23D1699AF91F6564CFC611D7E04E17CE9AA05099B829A0EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727024, "uuid": "bee00f8c-8e38-4378-94df-a062db03de08", "value": "192:5SNJPsihVDpZFzFez0WiUoht1YN3CBCW9NQv6TDafo:+J0U009UdCK6TDaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777727024, "uuid": "ce34b63d-83fd-4d47-9c1a-2787307794b7", "value": 8268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777727024, "uuid": "ddcf8676-42ab-4d49-ab6c-ad6b5b881cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777727024, "uuid": "ea7c178a-a922-4cef-ac13-da06071b8392", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57301879-461c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777722296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722296, "uuid": "89b0c7e8-38a9-4b22-bfa1-82ed29ebedc3", "comment": "Malware payload (Stealc)", "value": "4006989ca09bc4d0021fd723a96d4577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722296, "uuid": "e1e84c5f-3d81-4692-aea7-e80dc48cc8b9", "comment": "Malware payload (Stealc)", "value": "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722296, "uuid": "a44c1aae-7883-44a2-b68d-2697ed5dd5f3", "comment": "Malware payload (Stealc)", "value": "0022f9fdb324273e5fb2fb32b6c0757e1c6a6624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722296, "uuid": "c9504833-7259-4560-a957-e7539fb9b094", "comment": "Malware payload (Stealc)", "value": "7f6555522ed1a31b7bd0112d7296fee36dba97f669c83c17b43550419f51811000612daa2c30c131be9d05c826207ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722296, "uuid": "61e2fe68-fb63-47d8-a12c-69e4ef195df2", "value": "T10536391373254FACF0CA81B6B128EE2486F1F709B52B6A7769F01E153E43560DD5BA38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722296, "uuid": "28020271-d289-4411-8544-ea6c7ca3f4bd", "value": "4029dc5ee830151a426fff64189bae0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722296, "uuid": "e6a27397-6dc4-4aa3-8538-05b7db2f34c3", "value": "49152:9eQRVsxa2kMOnYUvPbGP/+926/AAqsRXXY:jJ2vwKPv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722296, "uuid": "2f9df863-7074-4c32-b8b9-2a419bb57cdc", "value": 4991488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722296, "uuid": "77f0fec1-9326-4961-9dc5-6b255ec8d044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722296, "uuid": "9729d211-6cb7-444f-8f18-43fba9d02096", "value": "y79nkyr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5532ebef-4622-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724869, "uuid": "8913405e-6c2f-4889-b3ac-cb16371eda88", "comment": "Malware payload", "value": "3b5609b324c63c7d55a1e468efa1d923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724869, "uuid": "b64943d8-9fee-4a3a-ae33-500dc9c37048", "comment": "Malware payload", "value": "785965d70e79c6bb110f469a0cf28b19968c4a73389075d35c49051bb2b0d783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724869, "uuid": "784a2278-1bf7-453e-96de-334bf9b46df1", "comment": "Malware payload", "value": "81e59ffc4ab203bccb9a7a7fb50421a4d7b465ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724869, "uuid": "7c3cfb98-b1f4-431b-9610-b6442233bf97", "comment": "Malware payload", "value": "107a35e047354c40b0c535b456a6584ce548ce70bd1b12ce3465c259372f66be186e10d5fc435703ba4229daa1afb6c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724869, "uuid": "6b43f50a-96d0-4122-99a9-4b88f0a38907", "value": "T18AF19EA27641C641D1195633156086E27BE60BF5BC3A812F313A2DB9511F1E7EF0E45C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724869, "uuid": "3dadcc0a-f4b5-43d3-9f83-9f00eeb62053", "value": "192:FYGa73P0Ti8yzTuphXK7CpAcpW191Po8s6urSkdm6O:FYG+3P0T5gupha7CprpW195oX6uOkdjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724869, "uuid": "99890e45-e99b-4d59-a3be-1880b046f9ee", "value": 8160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724869, "uuid": "d1fe8775-cef7-4ef0-a475-2d826c68ce15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724869, "uuid": "d665d948-d1d3-4b8e-97de-b390440266ff", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7156cd99-45df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777696140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696140, "uuid": "7c6091c6-a244-4948-b673-ea5dc240dc0a", "comment": "Malware payload", "value": "d5bc07f3ecbcfe6ed7f80288db3ebd31", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696140, "uuid": "65f82e5d-eb3f-4e56-b3d3-b3227ce608d1", "comment": "Malware payload", "value": "7984fa3fc843f93851d7ce4b8c7a159a1b1c4637f0fb49ad739e024a3b1437e3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696140, "uuid": "161d8241-9fac-4dab-80b6-1af9fb1198d1", "comment": "Malware payload", "value": "24a6067abf209e3297c4685acc43141460bec858", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696140, "uuid": "4825cf37-1b5d-41d1-ba6c-9761ce319a32", "comment": "Malware payload", "value": "9086ccbfee0dd484a82e4c786fa5087cbafb9196455d0dbfa68274b243ec8ccc5da420f85627800147a7dfd9744f3cc7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696140, "uuid": "2dd8d25c-1cbe-41f7-ace8-4fe4e05213b5", "value": "T1DBE4AD1798189793D11D83B8BE070CA96F4A5B4CA8C539EE306F5DCB3B947760C6E42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696140, "uuid": "c3e65964-02ab-413d-87cb-6e13b02e4653", "value": "12288:W7gX3umqfXLksVyOj3hvAZ0akbPDfhPuD1nMoXz:W4+mq4sV1ADKP1Pu1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696140, "uuid": "60587f93-ecd3-454e-ba2d-1d77d7896637", "value": 683173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696140, "uuid": "b2b7864d-c513-4712-ad16-bb00ae4da579", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696140, "uuid": "6b7df46d-1ecd-4722-97d7-a337a08bc93f", "value": "SecuriteInfo.com.Trojan.GenericKD.80036875.10753.740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd34d780-4643-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777739271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739271, "uuid": "e5c3f2b5-126d-479d-932b-4efeae4e2b91", "comment": "Malware payload (ConnectWise)", "value": "9cdf75ac4fa0aaee3d03af908c51e1ad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739271, "uuid": "921bf871-b4c1-4d8e-9dbc-b2a48df45460", "comment": "Malware payload (ConnectWise)", "value": "7993f61cd1798afe0ee4a980acc905f9ef3d641b9d1331bae053dfe584a4e68d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739271, "uuid": "87f4e7d4-fd32-4251-bdf8-f7a87ed28038", "comment": "Malware payload (ConnectWise)", "value": "a71e72ee9d7ee4f0d011b4295028c074d465ef8e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739271, "uuid": "99d22fb1-cfd7-4fcd-825b-de2a53a23a8e", "comment": "Malware payload (ConnectWise)", "value": "abce0cea47da6aa2bbfc749a0d6617b93646b9dd385ad756467e5920a0b488a3393f85e0861c40a2349fdc6e9f4cfcc4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739271, "uuid": "a186109e-1cc2-43f2-9344-42e780ab78da", "value": "T1A146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739271, "uuid": "866ef048-f39a-4048-ba21-456e7324420f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739271, "uuid": "bf8b85db-b063-4dd0-a9eb-9b53c0a43f89", "value": "49152:wfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:Eqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777739271, "uuid": "1f5a4326-c7c0-4571-a04a-b5a51ecdcc5e", "value": 5648296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777739271, "uuid": "1cabf151-c661-42eb-80a4-7b6e43508563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739271, "uuid": "620c430a-9e56-4cab-965c-c90a2253172e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f788763c-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704955, "uuid": "5a4721e6-c28a-49c3-8c79-39d81ab14fc3", "comment": "Malware payload (Gafgyt)", "value": "435c8b384d5c446797d4cb2039c1dcd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704955, "uuid": "fd020ef3-bb29-4ca8-88ee-8ccbde473bcf", "comment": "Malware payload (Gafgyt)", "value": "799a367efd7185a42a711b9b03eb01ee96c127fd8db731319e7e4299c05b6391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704955, "uuid": "12f50158-1611-4b01-b246-2f96596905ea", "comment": "Malware payload (Gafgyt)", "value": "7eaf11a4d920421b2733216c49d2da3b389ec9d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704955, "uuid": "bbf62c56-d0af-4ecd-b832-5fe52a9d7233", "comment": "Malware payload (Gafgyt)", "value": "d29e527c7e4153915c1ad8e8a65560249dfc3a79be7095b88d188595447cd928a40a96878f458d52451ccd6fedcfdfdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704955, "uuid": "3da44c62-9d8f-4bd0-b961-ed6ea28c9116", "value": "T150930A9BFA02CEB3C45310F112AA9F219D71F9FB4823D682E3646DB4DE150C25A15FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704955, "uuid": "fa6689bb-7d8b-4294-86bc-f76ac0a5c668", "value": "1536:1f6vL3eKZZGe01Zck6vWkw5iQryBgzUJ0rc6WMWu/J33/ZdEg0:1f6vpYe01JXoLBMUJ0rc6WMtJ3vZdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704955, "uuid": "2630e035-4d98-4b53-8c9c-f09f45a83ada", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704955, "uuid": "d2802578-ae06-4e8c-aa62-c81daeaa050b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704955, "uuid": "c5e88b7b-93a1-4ab8-92a5-1170495c2b09", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c73427-465c-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749813, "uuid": "cc2319e6-92c0-4629-88e6-01005f1a1e89", "comment": "Malware payload (ConnectWise)", "value": "e161cacaca90dd38c7166284629cce21", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749813, "uuid": "684f2215-f0c1-48da-abbe-01ebea8782d7", "comment": "Malware payload (ConnectWise)", "value": "79c8fb66c7fe1f74a1c8b8f931a5b8c1fbba56ec1619c68dc7a27b8d3bff8924", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749813, "uuid": "839a13bb-a4da-41ff-bb8f-9126c5648ec0", "comment": "Malware payload (ConnectWise)", "value": "b213d3f734c8102233ecccd432045bc8a4a94618", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749813, "uuid": "ee7b8a07-d9b5-4f93-92f8-54adf8b18799", "comment": "Malware payload (ConnectWise)", "value": "cdd58d1af8018195a99770a0948c3ab098a8f3d5da68d19904ec848e811b81bdd732bd736a61a228b9152ebcafbe1f62", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749813, "uuid": "c921ff04-8937-41b4-a4ad-fcc12b408896", "value": "T1A7646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749813, "uuid": "c6ccb079-3928-4198-815e-28b1023edf7a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749813, "uuid": "e5cc221a-8755-4352-b2c1-cd4ed171f15e", "value": "6144:tmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cP+T/:I1iw7gryNkSV1hy1Z1u2JLa9cP+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749813, "uuid": "2da73ff9-0a3c-4acc-9204-0f6c7a912c02", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749813, "uuid": "1da57a1d-b8c4-4f67-94ac-385a0b85b43d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749813, "uuid": "3bd0b7b4-ae7b-4697-a221-46724ceefe2b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee26f781-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736293, "uuid": "769ebbde-8a0f-46bf-897a-c36f7035c02b", "comment": "Malware payload (Mirai)", "value": "910e9ef45e7547bb75ea3edbd0142498", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736293, "uuid": "73db6186-69bb-444c-987f-43ea2217a2bb", "comment": "Malware payload (Mirai)", "value": "79ee6da78b120dee0450a253ade0600b3ef1b0e29304f216e402fddfebcbcdbb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736293, "uuid": "9baf972d-0939-4cc9-a39a-38cfd6a705ac", "comment": "Malware payload (Mirai)", "value": "b6f4bf0072f35ba956d88060fc0277384cc7f204", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736293, "uuid": "9caba622-8898-4a40-ab52-ac5d13bf3166", "comment": "Malware payload (Mirai)", "value": "5c54acaa0685b835af10a94e97b66237e69c4570198a075a4fdebb2242fe27e0b84a66935f31aecaf68a297a4639e7ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736293, "uuid": "f2574ec8-57fc-4e86-a683-1b8d08d2b6fb", "value": "T13B83E942BD429F13C1C221F6FBAF019837166B79D6EB3242D931BFA023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736293, "uuid": "14412208-8489-4b89-9d0d-9510bbe4e043", "value": "1536:/KDLhQ3BlLywjmConIxqPONv6GKBJw3y2XKPrL2tGwUbO2j0An6TfCTa:/KDqXjmConIxq296GKAXwrL2LA6WTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736293, "uuid": "9c607ab1-5409-4b8d-a30d-269c58ff3ecb", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736293, "uuid": "7eb7947e-6045-4bd6-9872-862ec6024d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736293, "uuid": "da9c6ea6-fd10-42bd-9c7d-788cc64dda25", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf3f275-4657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777747751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747751, "uuid": "4bd42406-8fa5-4f93-bc44-45d6022f2652", "comment": "Malware payload (Mirai)", "value": "64f1a6e50b68fe2609f7102a5f38d9d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747751, "uuid": "a75fe9fa-2d79-4f76-9b10-fc0b81a05250", "comment": "Malware payload (Mirai)", "value": "7a436db126bb838e2f597d72f95cb6bde47b18bcd4e1279eba3feeadee6fd25b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747751, "uuid": "1a1d2baf-440e-4c30-89cc-562390cac450", "comment": "Malware payload (Mirai)", "value": "820cb858b00e39a0fe4358378be1be0765255f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747751, "uuid": "966e885e-ecec-438b-8da1-2f415cec1cc8", "comment": "Malware payload (Mirai)", "value": "07ffe6f457beed6058bca2191f4aa0d5c76effe9c965d840724c48bd04c30cd1ed99da4421e0230ec6d61455ec4bf0e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747751, "uuid": "e465defc-405e-4c3d-9a68-8f3b49bc656e", "value": "T114E52A156F500FFBD86FCC3346E90B12258DA50662D53F3AB478D914FA9BA0E4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747751, "uuid": "274200cd-f901-4370-b056-b698c3fcdeff", "value": "49152:GP9xXLFQhkqKOtoHmirNEopz2DqqViDFWJDcJRK+tRyOp6vPXw:2X53RbW5+tRhp6Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747751, "uuid": "26edfb3d-5008-4c6f-9e7a-302cd472b492", "value": 3141480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747751, "uuid": "0d943943-d386-4463-bfe3-6c8e8d811dd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747751, "uuid": "d4e594f9-2ba7-4651-9c66-db6ecd6e4dd8", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cee749-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743899, "uuid": "483d116f-13f8-4697-a1e2-de70745e1882", "comment": "Malware payload (Mirai)", "value": "e7258696cd4f0305d4a18869eeaebfee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743899, "uuid": "8460059c-4b8d-4caa-ab44-269543446da3", "comment": "Malware payload (Mirai)", "value": "7a9fbc2e02ef010aedae2177ab3b8fe895eb5d18776df41c834ba488e2ef5c99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743899, "uuid": "48f2e501-f1ab-4bd1-a891-8c2a683929b8", "comment": "Malware payload (Mirai)", "value": "114b581c7de8766018ea7f002322332439f0d987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743899, "uuid": "e77c2a16-e231-4b9d-8f57-361fd943920a", "comment": "Malware payload (Mirai)", "value": "baa502238a31cf67d9164a24b7e56958deeb222b5ef43b1197dd1ad680ac259e7df237bb66435f683fe8cca93ba79f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743899, "uuid": "a424034b-b670-40d9-b25c-149968e6bcc3", "value": "T1D2D2E17DA3998952DC35AC37EA7587477D1F2BBC55FFF1A310080A002B9602BAADC881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743899, "uuid": "852a7343-6d30-43c1-bbc2-ed821c04851c", "value": "768:L+tT30UQK6kaBmn9hDINzVTeJFZJc9q3UELC0:LQDJ6kWm9hDINlsrPLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743899, "uuid": "9ac35513-0db8-42a5-8303-979d4f12a94f", "value": 29516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743899, "uuid": "d342339b-4543-4c46-8d04-1caea0eb1141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743899, "uuid": "e600f3ce-ff89-44b0-bc2d-cef5ddce07b9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02698f3-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744027, "uuid": "00731f69-f8e9-4ec2-8734-7ae151764815", "comment": "Malware payload (Mirai)", "value": "b12465539d9fab1b332c31eb19906dd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744027, "uuid": "deb46df9-12e5-4f3e-8ff3-1a5e413c8205", "comment": "Malware payload (Mirai)", "value": "7abf8145878edcc0c0429ae55810c726c36534e35f44a47b23f5bc9727cdf0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744027, "uuid": "ff0f3d68-92d0-4f39-ba91-b713484891e3", "comment": "Malware payload (Mirai)", "value": "b07b61519ab6b5782e6df2515d11d46318374e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744027, "uuid": "cd1a483f-e60e-4e3d-8efa-d875ade0327e", "comment": "Malware payload (Mirai)", "value": "a5a7d0a31789e506f19c8c2424ad63dfb3d2fdd0e6e831d40181b9a09be84ee6a3df83410f7571daad39f67629d4f7e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744027, "uuid": "31fe87e0-aa4a-4a2a-96f5-b4560ece6791", "value": "T1AFE5F85B5A319F6CF7B487354BF34A34E3A962D617E1C980E1ECD1085E6024E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744027, "uuid": "7a08850d-7aa7-485a-8d48-1a3a261268fb", "value": "24576:zpnapDNj2Pg5pmVRYZhw//dbPmKoMZ0YCnUdaBCYd+HhMMUAIPA6vPwyqB+vQu7:Faty8y/5mKPCnUMC4An6vPw5+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744027, "uuid": "b246b7b3-99a7-4acc-82ba-d8ac0228bb30", "value": 3145640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744027, "uuid": "b6f45c16-589c-44a7-bd2d-98079723e988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744027, "uuid": "71fbcff0-9fa1-47bb-941d-18e59be583fb", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d4d5be-465c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777749811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749811, "uuid": "383a44b3-825a-41ac-986a-d5ec03b3210d", "comment": "Malware payload", "value": "5f11c328864793438009c7c5a319175b", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749811, "uuid": "24dc1e21-7c76-422c-bd6b-8698c439493a", "comment": "Malware payload", "value": "7b1dd14bf9189ade7bea7c9e137e50cace9a9ec698e907dea2d24bde8e07b91b", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749811, "uuid": "dd0c46fb-a256-46f0-98e3-53a82000e4bc", "comment": "Malware payload", "value": "c47b4f4bf5d32042a119062815376f28514e40ab", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749811, "uuid": "43fd4f14-b111-4c86-8132-5090773bce2f", "comment": "Malware payload", "value": "ff21ab51d22195675084f47e1afc1b056a6c342e3a0f65f0636339f57ea1732c19bf3bf89542521c8ea188e3c8163b48", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749811, "uuid": "d45b38f0-039f-48ec-a9e4-58db65a09a64", "value": "T10B46F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749811, "uuid": "22888c1e-ef2f-4aac-8915-6dd045402b72", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749811, "uuid": "37bd05da-2caf-4b9f-89ac-eabc108b2eb3", "value": "49152:YfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:/rs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749811, "uuid": "e1fde0f3-e55e-42f6-8102-257a76e39bc9", "value": 5648352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749811, "uuid": "79c3b224-def2-4858-bdf6-7ae55d421da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749811, "uuid": "b5b6566d-2097-41de-b77e-0b1cf46f4679", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ea3849-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745735, "uuid": "0ffaff45-44d0-4432-94eb-105e94ff0284", "comment": "Malware payload (Mirai)", "value": "14320684f756bfc561d3e43c44eb7005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745735, "uuid": "490629a4-d2d7-4134-99a2-c080b26cf5e5", "comment": "Malware payload (Mirai)", "value": "7bc614d701255c0ceb0c3f457619d454f9a119e517b6c4504b5cd04f08833773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745735, "uuid": "874cdd72-d5a4-4152-833a-e14d081c904a", "comment": "Malware payload (Mirai)", "value": "398cf6445f3b94dbc1eb41d25c0d22fba2f47c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745735, "uuid": "e683fe61-f6e9-43ef-bd64-9fcce695417e", "comment": "Malware payload (Mirai)", "value": "979c68d25c945f43664a68b956e44a0e930fae23ee2f8b2839d8260ca4b0d269db90b3953d2fcbd9b5e8224fdc1d9b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745735, "uuid": "1a54c2bf-15d6-4ed1-897f-ecf32d89eb1f", "value": "T113D56C41EC509A13C1E15BBAFA7F828933332BB4D3DB70164D189B706F96B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745735, "uuid": "d54fc835-c29c-4b55-86e1-3fcf5e75414b", "value": "49152:VHYuPFIpzBzAKNUGlOFTJE1JIvPlaTZ+LyqKLr725CPj3KR03:VHYQ0AzB9gJIlaTQLyqKLr72sPTKR03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745735, "uuid": "d9fc4b7a-bdab-4442-8f85-9216b2f4d065", "value": 3000732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745735, "uuid": "665932a2-c772-48c8-a115-e3e6b2eacc7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745735, "uuid": "c8f604a7-99bf-43d0-9978-7a93b5bc5c1b", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c414c659-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736222, "uuid": "1b5441a7-5fe1-46f3-b259-b91abfd57b65", "comment": "Malware payload (Mirai)", "value": "cdfacee5c4c0554a349dc96b44248e3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736222, "uuid": "ad4ce51c-7636-47cb-a379-2fc20866853e", "comment": "Malware payload (Mirai)", "value": "7c139b7c266adde3ab9ce8f4c9f8369a0a94f6c82d3503cdfeb2367a5a9fea0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736222, "uuid": "43b61fcf-4898-4514-9f62-cdce6c6c16b6", "comment": "Malware payload (Mirai)", "value": "b290e0a6b7661cc808a6cb06e0349d93b701438f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736222, "uuid": "9cd1416b-544f-4c43-88bf-6c0ceb900a68", "comment": "Malware payload (Mirai)", "value": "b20f1f293d3fbac3ea487a374a9fb6d6a6b5546ded79bd1910698ade2cee42e28e2b6d4ac76552e33a631bed7f5fb87b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736222, "uuid": "4bf39b42-4c50-4ad5-a9de-e7c3f3bb23da", "value": "T18A14C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736222, "uuid": "954d41c0-56b0-44ee-98c6-1a9e2565f2bd", "value": "6144:4j6eQCbeoufx48df2dp06GtCqjYW8nY1j20WI:9ely48dfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736222, "uuid": "825343a3-027a-40c2-90e0-1bf4c1908f6c", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736222, "uuid": "c5fabdd6-f0e1-4824-b7ac-029af5b65fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736222, "uuid": "01f4a683-8d09-4d3c-b4f6-73e4c923b4d2", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35096233-45dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694751, "uuid": "d4ec1fd3-d619-4066-a0c4-60e12f18bcdb", "comment": "Malware payload (Mirai)", "value": "fda920f8f5ccb3bf123082f847c80509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694751, "uuid": "42c2b89c-8f46-4805-9862-48ca59bc2cf1", "comment": "Malware payload (Mirai)", "value": "7cd49f0036fb7155780d547c8bac237f4cc06613f78c6da182c634f00aeadb40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694751, "uuid": "3cf132e8-73b6-473b-b3b8-3d2cab5c074e", "comment": "Malware payload (Mirai)", "value": "411bfc94bd9f8e798d51c9796fd0a6370e6360d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694751, "uuid": "f2a7fce5-55e0-4628-bad7-ddb226b65f1a", "comment": "Malware payload (Mirai)", "value": "2752b30a60e32c6dda358385b4af02031859248499d6ea6c580b94db391c74efb1232f8c0fbad138f6c70afdb01a58af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694751, "uuid": "42b3410f-e479-4095-b8ef-d5b6e38067d5", "value": "T199931C47B9918A12C5C112BAFAAE418D33137FB8D3EE7212DD20AF9077865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694751, "uuid": "a48fa7de-82f4-40ec-9cf3-a13cbae79e34", "value": "1536:yInu+NosRWnbwsof9jVICjS/Obpa06QH9GMZiu5Wk05EYi7r:nNjRWtoXCObpa0z5Wk0q57r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694751, "uuid": "b1102c6e-9ad9-443b-b565-c51c471b55f3", "value": 91120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694751, "uuid": "554ebddc-e4c5-480c-ac5e-4e40fbb39aa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694751, "uuid": "c5743031-0865-4d9b-a174-aaddefbe7b2d", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3343e5-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736640, "uuid": "56e5e3d4-729e-4cf4-8d50-b69d44e89037", "comment": "Malware payload (Mirai)", "value": "e877d077b696de1773f3eb4dd4837648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736640, "uuid": "ef4252de-5886-4262-af8c-7171cdf7bb9a", "comment": "Malware payload (Mirai)", "value": "7ddbd84d464d3924ed0fb31c638ac95d3a83c367f0d428830d4cacfe36c2e1ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736640, "uuid": "c1741038-73d1-44d7-a7e6-4be22df04f77", "comment": "Malware payload (Mirai)", "value": "8c25473c4f7c2d92cb35a2637f54bf4d0d5acb98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736640, "uuid": "cbc0c8c0-09b5-4154-ad61-9d3844129145", "comment": "Malware payload (Mirai)", "value": "8b6f02ea1df98c1c122e23baeab132570fe50264e8174bc5ad69a290585ca1582d12f0b07abd46f3a3ab4460802b9316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736640, "uuid": "96a58e22-b626-4a37-adc8-38d4a00d7de6", "value": "T13B534D96B401ED3CFC5BE6BA80161A19FA213B3015A30F2BA797FC939C721B6DD16D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736640, "uuid": "9a853afd-699f-4b29-b367-174bee9c7a83", "value": "768:reT+6JhUvtNaEVGJb2x9+FizRN1ul8yXLyCYlqXxZv2XWFil:rInQvtNFGJbejlNUl8yXxGqPvyZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736640, "uuid": "06870bf4-4559-431d-bb8c-97ea892cbd21", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736640, "uuid": "4736cd1f-a3e9-4e8a-bb49-8327b7896a6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736640, "uuid": "daa3e30b-2aa8-40d9-981c-af4eca259e93", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db296182-4672-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777759454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759454, "uuid": "37c69bb1-324c-4581-9c0e-addb0fa47b07", "comment": "Malware payload (Mirai)", "value": "73f1fbee807c30d9c6be3a5e45486457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759454, "uuid": "5e9c80b5-e7c2-4fcc-8c3d-17ec0439bd9a", "comment": "Malware payload (Mirai)", "value": "7e46358dbc1db4cbd6d674fdb0b518885f7198414575374ef2436897d751f9ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759454, "uuid": "216b4554-8880-41b4-b9c8-f47d124f2b70", "comment": "Malware payload (Mirai)", "value": "64694310111bfa8a100df70ae48a805a35c4ad9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759454, "uuid": "4b7ec714-1d3d-462d-9003-8d0dff497510", "comment": "Malware payload (Mirai)", "value": "430e49ffe9bec95318bd8b1495814e9e3ab15ac3221298ee2929b4a9befbc0e10905f3db35899108317696fc653f7c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759454, "uuid": "efca3472-2077-42af-a63c-befa50ec7544", "value": "T13FB55B41FC51AA56C6E0A6BAF77E828C33272BB9C3EE30175D04473477AA95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759454, "uuid": "3d3f72ec-c9d6-4e08-8fea-3f04aeede073", "value": "24576:iyD69MabA7jUfUMEaTOLkO1/LxJ0VuD/M0cHEkRGr9PiNE072A3yKoVJ4vPlevjx:iy1UcaCLfquIarBiB0VJ4vPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777759454, "uuid": "8bf5007b-0bf1-4474-a521-9c93f5b7cc26", "value": 2474524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777759454, "uuid": "356dd6ca-6e69-4aaa-a830-76df22e14ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759454, "uuid": "334f1d27-6dd7-427f-a570-d59831e8b9cd", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1838e6b-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736298, "uuid": "98f8ab68-ce1f-4644-a426-efef74f35fb9", "comment": "Malware payload (Mirai)", "value": "5905f799adfc3a7f46601fa36d5483cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736298, "uuid": "2830fcb1-2530-4d3a-a414-7c530da68d5a", "comment": "Malware payload (Mirai)", "value": "7ff1509b01fd88eb09fc5425c2630041d1fed0a2ac6ada059651573ead3482b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736298, "uuid": "4a284a79-43e2-4a5b-8653-9f3f51fd93ef", "comment": "Malware payload (Mirai)", "value": "92a7af22e2296def1a3470428d47fc27c1ff1b23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736298, "uuid": "389044fe-124b-49eb-ba77-28dbe6ef6d0e", "comment": "Malware payload (Mirai)", "value": "e3a7b0700ef4c0f70473b50a4146c881c644318d85cec7a1dc278266f2f963f3b0e1e7177f3afcb718a25a58fc9cd5e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736298, "uuid": "9cb7f5f1-b307-45e5-8179-1dcac4d4680d", "value": "T13173F842BA87CAF3D41704F041F7B63F8E31FD3A493285A9EB65BDA2DA635C16112358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736298, "uuid": "f962b993-f4c3-448b-9ed3-2e51c2e8abdd", "value": "1536:cfGl11IuDxOIX9GtkxBP4nIj93DrfFPrCWD8ZM6iwJvbiZaGiE3uM+jA:YGl16uDx1XPBP4nIjdlPXQZM6iwjiZXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736298, "uuid": "c180cadd-6f08-4a33-a4aa-24cf93294a90", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736298, "uuid": "21d66534-5ad8-4f7c-a97a-ef5f487b0e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736298, "uuid": "23f28221-fa47-4e6d-994a-da1dd0970e19", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10889d76-45e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777696407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696407, "uuid": "643344c9-4315-47a5-8431-ba045f38bbb0", "comment": "Malware payload", "value": "f798cef601692145e1877536d9f4f092", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RecruitRAT", "colour": "#DD4F7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696407, "uuid": "efbfe156-f6c5-4567-995a-f31307bee609", "comment": "Malware payload", "value": "81021ea65f7f0dade4472d2be3489492f6421c110c02bc4a9d7b2f5a002eee78", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RecruitRAT", "colour": "#DD4F7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696407, "uuid": "0255df56-04ae-41a0-8355-b3ef1f8b9c76", "comment": "Malware payload", "value": "84ec98d45776b07376807a854f9379b3b12fb379", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RecruitRAT", "colour": "#DD4F7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696407, "uuid": "e96bc547-11e8-450b-92a0-4d4d24e28bce", "comment": "Malware payload", "value": "0c35a08dc201cf66033565deea9797f47cbd82e6dd191351e40d5d48905cf1e1d447520fe5d8c115cfd5279067c74deb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "RecruitRAT", "colour": "#DD4F7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696407, "uuid": "72fb9766-c67e-4df5-a13d-b24ad0bb9777", "value": "T14A17339BFF8FF017E8A7A4728513C09A6955000D8781F49F25A8A0DDA8D3C85176FEF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696407, "uuid": "7ad3e371-3f1b-4d17-9e3b-1dcbe5fea985", "value": "393216:PF99uzsdwJxUHPigtlr5RYFl3N3/uydL6jA9by9P1bJGEZEl:PP0HJkPignr5etjL6jRP1bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696407, "uuid": "9ebc5738-f7ff-46fd-8c57-c410401b42dc", "value": 18901849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696407, "uuid": "dd3d206d-71eb-48d8-a4e9-478c342d59a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696407, "uuid": "e0bee7f1-27d6-404b-882d-6da0676548c9", "value": "\u6d77\u89d2\u89c6\u9891\u3010\u5df2\u89e3\u9501VIP\u3011.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb41b022-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694627, "uuid": "4c56b039-7455-4e4f-a1d3-2bb7fe17b4c9", "comment": "Malware payload (Mirai)", "value": "bfe679af3898b0da51e726c75a18a60d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694627, "uuid": "28b6f6c7-3f05-4e10-be98-a617f63856ce", "comment": "Malware payload (Mirai)", "value": "813d96042143c65e5feb7fdaddf17a3afa65fd8f24976d0bf1b124a542d999d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694627, "uuid": "bb1799c1-4aa1-4d51-be79-7898d1ecb8be", "comment": "Malware payload (Mirai)", "value": "1094b5b4a304a5caf68bc45ced0bbc2004b17933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694627, "uuid": "f8d1a9b2-aa82-4ffd-a47c-07b99b7a6526", "comment": "Malware payload (Mirai)", "value": "b5dfc10b7856770346f6b568bd1654bba21fe6aa628de3c264242456123a4ffda25999edc7aa1de66a1a3560754cd277", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694627, "uuid": "105efb3e-cd6c-4dda-997f-d374b8d6f13c", "value": "T1E673F842BD819F03C5C222F6FBAF45893B157B68D6EB3242E825BF5033868DB1D67251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694627, "uuid": "c8e43098-3203-4c2e-9a5d-515db0de4120", "value": "1536:lOQb10mDg/EeNgTrSMW/BusGgfwnMjcbAPfgvaYOLPe:lHb10mDVO5QtMjcbW6a9Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694627, "uuid": "3cfddcc2-e924-43d5-b8a1-e3642aaa0937", "value": 79056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694627, "uuid": "e61e2c8a-f570-4078-b4e0-b0307c081eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694627, "uuid": "ecd0da9c-4aa6-4c6a-8d17-61196bc00971", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae4025f-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734918, "uuid": "cb270d8a-3aaf-452e-a591-da40127f9e1c", "comment": "Malware payload (Mirai)", "value": "4ee12a891d0b729152ac693b3c34c1c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734918, "uuid": "7a2a657f-9239-419a-b64f-923426a4873e", "comment": "Malware payload (Mirai)", "value": "82d636e50e258bde575ca502541600c1ddbc4091338f328aa86f1a50aaf329fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734918, "uuid": "7f598704-c35d-4264-b7db-623905b35c75", "comment": "Malware payload (Mirai)", "value": "40fefb3a77c895213608e88b7bd632f009fc003c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734918, "uuid": "dbc02518-b93a-4515-8c46-6ef8d78ded24", "comment": "Malware payload (Mirai)", "value": "33fd5c70c33e6a31d4c4beaf080eacfd723ff220c4452eb2d4a114d75bef24713c98162db4bac3da294ab4d2ab5dc2b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734918, "uuid": "96295515-4489-4561-b3b7-b801703c8982", "value": "T1EFC56D027B1E09C7F1A71DB0263F17E9C7AE8AD631F9F146254EA9CA1375E3002467DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734918, "uuid": "f49d24c9-cf5b-4087-bced-c4ae5e238680", "value": "49152:dIuEkXQKrV7ivIKKWuMhTZp53cPrBt+EW5FGucHr4BJaJjwGvPJkQ5:dIuEkgKV70IKKWuMhTZn3SBUEW5FGuc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734918, "uuid": "eb4c5168-e71e-469f-8a34-d7506eb6606a", "value": 2728812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734918, "uuid": "78b58e03-b6d1-46cd-a8c6-08ab72fcae8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734918, "uuid": "c0bcf790-f7ef-4c31-a6aa-ba4592a05809", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd76c4e-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704962, "uuid": "82a5bbc8-8419-4f08-8785-1da9278dd9c2", "comment": "Malware payload (Gafgyt)", "value": "1d887c6cdbdabe6a289e51736331294e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704962, "uuid": "ff51089a-f120-4964-b110-c511914154c7", "comment": "Malware payload (Gafgyt)", "value": "833fc2bf0c25e042800a50a90376a1e7a6e727acb1aa3d9a105dff4274e15f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704962, "uuid": "427d0d4e-0a45-4394-b45f-75808193d7d9", "comment": "Malware payload (Gafgyt)", "value": "339dec8e095a921e8439708d1931bd52d667fbda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704962, "uuid": "c5c393ea-c267-4522-a248-c9c471606d72", "comment": "Malware payload (Gafgyt)", "value": "2124dba3b582b556e61a92975b9c71dceae4f2799647dcd06f110f239f40dca57c396ae9cae1aa7d9ed54ee3ab0a840b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704962, "uuid": "1bfa7ff7-bbaa-4ccb-bc42-3f9e5d719437", "value": "T197B30A97F801DEBBF80BA676009708157530BBF60E921672B2667897EE771D13823F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704962, "uuid": "7c7a418c-cfec-4f0c-a8e0-2470aa80c7df", "value": "3072:EO88gRqZFkynRgykgdF3OvhCR/J3lZVtD:EO3sq4ynqykgdBMsJ3dtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704962, "uuid": "0d835854-4405-479b-b41f-26a820b8c478", "value": 114600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704962, "uuid": "a7d73ffe-f1bb-4dfa-b9c5-b0c1f11a2791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704962, "uuid": "782bc881-f80d-462a-97fd-a9796835c186", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd9610e-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743782, "uuid": "e76f23cc-2e09-4265-a881-5fd39def2d7d", "comment": "Malware payload (Mirai)", "value": "c1d59c3585ff4fef68feb011a362b568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743782, "uuid": "8b5d3d21-3f71-4567-a353-baeecd89a2a3", "comment": "Malware payload (Mirai)", "value": "838557ba46599f903752e324dfa8071e9bea0782e720f575b53a843f666e2b29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743782, "uuid": "0c6c4a66-3fb6-4aac-9bc2-11d45d335b0d", "comment": "Malware payload (Mirai)", "value": "f3ceb422654c7674673423d11f59fc6bed8812be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743782, "uuid": "d4ab19b3-dd8e-472d-94df-9bd38c602c9a", "comment": "Malware payload (Mirai)", "value": "48ac58a38e013528b54c9a392692cd1b114dbd2f10d7315d05372f6f7a137b9a97c92e7ea538900ca1830de01f0c9be2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743782, "uuid": "22ddd960-6cd4-4d8d-9ab5-92c270a2f71c", "value": "T1BDB55B41FC51AA56C6E0A6BAFB7EC28833272BB9C3EE30175D044734779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743782, "uuid": "016a7641-2db4-4854-8e95-f80b2ca49052", "value": "24576:d2COibBKtGie6dhPlUHSIVDakYqMf/tG9umDOQ6MFJ2FgN0JBp6jLXmCK5olp4vU:d2feeUDVuk0SumDwgKJTUlp4vPleeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743782, "uuid": "6975fad3-73f9-4101-a86d-b75fa8c2e546", "value": 2474876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743782, "uuid": "00914811-3ecc-4344-9cda-a0040c12c0b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743782, "uuid": "54bf4c3f-a12f-498a-b51a-e19d1b2f7c6b", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dcfe8b-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777746805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746805, "uuid": "6f5b560c-8960-4295-9df2-64911987eb73", "comment": "Malware payload (Gafgyt)", "value": "d74a748e303d82fcd7b311a597375455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746805, "uuid": "71a5eb5d-f3ef-4534-9ca2-c023ef0cb79f", "comment": "Malware payload (Gafgyt)", "value": "84de113f126e4d984b9380f8ec56b8e733d4f9e4415b5de2962fa9b48a3677d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746805, "uuid": "69c24eac-c790-408a-b914-49a39e88c0c9", "comment": "Malware payload (Gafgyt)", "value": "b8105fb634caa4e20551cbd6e76b8905bf21467f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746805, "uuid": "49d37c07-dfdf-4fc8-9e10-3c52db40b2c3", "comment": "Malware payload (Gafgyt)", "value": "37bb22b4947d9968ab7504fa733933ed6eb4a30cc8f42e14a2bb865fbc688b35f2aca202824666d0e27f2f064a0b3ad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746805, "uuid": "e6b88ae4-7e92-49c1-b1e5-dd19a6504d2a", "value": "T162B2E0B853B5BE3CD54FA5389623A9CF50663C12CE77B6250811EADC22210CDC4B590E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746805, "uuid": "456fe67a-b4b1-413a-a9f5-f8d686998dc1", "value": "384:LYEJTTdhBpo5a2Mlype9H1T8KZiH49FKTlFYACm5Yk1UM8CootrLKLzYFnkr8jF8:EEJTxLpRapSVpZR9ilCACmyYUazL3FnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746805, "uuid": "35d0d9e7-a704-4f40-881f-f2a1a32fc0b9", "value": 24100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746805, "uuid": "e6589fca-0da1-41df-9c0b-6127560b6626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746805, "uuid": "7fd6060f-bfd6-4c68-950a-fa4493578b28", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c2c862-4650-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744515, "uuid": "7cfaea6e-0e6d-4126-9479-b8c936abd940", "comment": "Malware payload (Mirai)", "value": "63fbceee72ecd6eb1b6d214207d0d193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744515, "uuid": "3edd8e35-8ede-45c6-8f61-0656fce2ee8a", "comment": "Malware payload (Mirai)", "value": "84e7992ca8a16ed14fbd523abd823a3f84a6dceb1ec31bd5d59e7e5eb3c08113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744515, "uuid": "7fe3c326-fc96-4198-a904-81ab95302c76", "comment": "Malware payload (Mirai)", "value": "d43b234a9c5db0516b5dc1a47d0f5be391af922a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744515, "uuid": "8420406c-25e7-4300-a31d-69a5ea6d1d9c", "comment": "Malware payload (Mirai)", "value": "c868d820d40fc333b30e11827396a400c13a86c3c1f440ae6be667bbb9bc16674bbad18e4a4c00ff4ea7bacedfd3adb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744515, "uuid": "e7a606cc-e2e2-47b4-a6e6-1ac0061efd9f", "value": "T1DCC55C027B1E09C7F1A71DB0263F17E9C7AE8AD631F8F186154EA9CA1375E3012467DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744515, "uuid": "51f25407-5137-424c-9d51-38cede0e1c0f", "value": "49152:RYOeQJV2wp0cylb6hTZQ1UQTBFPVW5lGuoHrsXMa+H/bvPfNHLj:RYO5JVnp0c+b6hTZqnBtVW5lGuoHrsc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744515, "uuid": "b5c7ad96-b3fd-41f3-8d1a-6c5b15ea171a", "value": 2712524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744515, "uuid": "253e3b39-1c31-43e5-b1ff-e159e4fe4358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744515, "uuid": "a5a2e2cc-1bf1-4719-bd83-9660db5c1a36", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913cb9e4-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777746874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746874, "uuid": "9335bc1d-94be-4b90-8524-7b94183d8ff7", "comment": "Malware payload (Gafgyt)", "value": "e591b7a0c99b3b631923877e6adde561", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746874, "uuid": "618f6473-4b6a-46c6-bf09-18ee9d579789", "comment": "Malware payload (Gafgyt)", "value": "862a31d71db1102557d56ad1bf42aff1830f993a79743f198fe1216a3548cf57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746874, "uuid": "35a1d63c-cdf0-482f-b46e-f36eb6a82862", "comment": "Malware payload (Gafgyt)", "value": "17423809a76358882be1cb18e940a98da3732f47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746874, "uuid": "bd3e3cf5-0360-45ec-8fd3-fec44f680b20", "comment": "Malware payload (Gafgyt)", "value": "b1ddb1840bf66853d6a70fea83acdf4d0089ee7780494d989c117bced5891d5f591fbbea411794c51aef2ad6ef5f2a73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746874, "uuid": "c5a0fc73-8c27-4d43-9d5e-5b49d8f84378", "value": "T159138D1771C0C0BCC8DBC1794B6AA23AD733F87A1265B11B57D8F926AE9EE611F1C610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746874, "uuid": "dcf1f50d-785d-4896-94b1-5f8fa63c22aa", "value": "768:NFb7TpkaRlbS1uljO//r1pN7WQPH0+hvm/431kTNuaYmjILXKx:7lbAuGZbCN+hvo5JYmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746874, "uuid": "f869ea06-5c44-498c-9685-2752663b7a69", "value": 42800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746874, "uuid": "f3542e06-9e39-4b48-ae1a-de548d9b2018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746874, "uuid": "30a4dae5-615a-4b56-8077-7d7d0ad37be2", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a797e892-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766239, "uuid": "77b4cf97-362d-4108-a269-96ff1c65aaf6", "comment": "Malware payload (Mirai)", "value": "1f5551de25f87bc1c1c8eb69271197f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766239, "uuid": "8b9c129d-07a7-4ef0-a42e-deb9ec9649b1", "comment": "Malware payload (Mirai)", "value": "86ea1dd537b09e781a147524a5fe12366340d3a283d4da6b6448d363b10bde7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766239, "uuid": "d9a2ffb5-0073-4e5d-afe4-6e3c0b3f75a8", "comment": "Malware payload (Mirai)", "value": "af064755b6e0d4f0648e1da827cbbe2596d1bc1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766239, "uuid": "01ad2731-09cb-459c-94e0-52eae7d4327f", "comment": "Malware payload (Mirai)", "value": "a784d03a0854487af9bb8af385c38db8264e6b85a6b85f196e15a199a1a051b1231424c53c98184c6a3fd3b2154dd542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766239, "uuid": "aa978041-aa84-4354-b2d3-7b98d27ad81a", "value": "T1A0E34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766239, "uuid": "fb8f4047-baba-4242-b3a7-29ae9f22db1f", "value": "3072:luWypdcGShA/eVWPq6ND6ZJ243nxl9XzrTmd4H:gCGShAWKDPAxl9Tmd4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766239, "uuid": "8f867282-23c5-415d-a2f9-7baa85756fcc", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766239, "uuid": "8be34763-7d57-4d7d-8e5f-887d7606e057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766239, "uuid": "7675f7ab-d544-44fc-9828-edc9bb0fe22b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9aba45-4644-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777739597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739597, "uuid": "2fc4d8b8-cd53-47d7-9588-16703862eb09", "comment": "Malware payload", "value": "96915ab36f7da787a54e01e5a1694641", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739597, "uuid": "ef3fb0f2-add8-4bca-88d9-04545ab53dd8", "comment": "Malware payload", "value": "87d63892f6061d2e4405723afef5b7d80615ea9fbe22cb2ccc129ee7e6381f23", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739597, "uuid": "4decaf0f-dfae-48f4-a454-5d4dcac008e6", "comment": "Malware payload", "value": "f4048e841a9c4a9d46c965149619382b4ed5b725", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739597, "uuid": "ab3a7d0e-082c-4562-9fcf-852a71fa3bb1", "comment": "Malware payload", "value": "49867a18a565e32c86a2320f454d4db78dffd8739d9c7dfbfcff3f661c87e6ed3519b2344b4e4d95d8bcd08e174fa331", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739597, "uuid": "284c90fa-f055-4f9b-916f-ecd9db635fd5", "value": "T1E4D30ECB895DC8EC461B742D214F7E46CB4B521B051CE5A1FAEEBE813F61FA43096AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739597, "uuid": "f4a7286c-8be6-41d4-9d2b-47c4e4657d32", "value": "3072:yg5bPBD0WXdW07Pt4wgb0NLkavDYyYArLfK3vO8ctFpBTTwXNCVLUQai35eXRfQq:VkPJsGF5eiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777739597, "uuid": "09d7216a-7e10-4bce-9b8f-02aae50ab4a7", "value": 138914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777739597, "uuid": "68aa9717-1b27-4c88-af12-11dba46b6551", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739597, "uuid": "1724b655-eaa4-4e43-a16d-54ee48cfe5fd", "value": "Production_Core_Audio_250.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0f3f47-45fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777708882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708882, "uuid": "82eadca3-7890-4125-b20f-ac563cfdb029", "comment": "Malware payload", "value": "c54603c067b873c8c2e6d9a5c2360232", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708882, "uuid": "720504ce-edf6-4f32-973d-d4645492c72b", "comment": "Malware payload", "value": "8a211f8f95a8f44e9492859e88cccc69bcf2da5699776812a4ecd114f2208b2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708882, "uuid": "bf62770e-38e4-4696-973c-6ecf56aeaf6e", "comment": "Malware payload", "value": "2f13b82f74aab00d612c2c2d4bcc21df2a08005c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708882, "uuid": "141100de-5298-4f68-9aee-241113f837a6", "comment": "Malware payload", "value": "cf015af0f4a2e8b6bb48db37c1b12bee66dc425aa42d006fe6891e296877eff5ee314cd4a2b5e100e40a7f6a3b51c7cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708882, "uuid": "a806665e-1f11-4946-8a96-55eec9e96429", "value": "T162E49E6BBB9E3D43D6D7E33E8B4A9370532B75999313C1923A01032DD5C2E98CFA1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708882, "uuid": "7f32a730-0d20-4574-8b5e-85cded4b29c7", "value": "12288:3T9mOwb0Jp/ijjGUxXtFZVRwOKhJ21g58IKd/qSvO2WeNxENgd:3TbajjFNtsV2DIKkSvO2xNxENg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777708882, "uuid": "5e9270b2-dbad-48ed-8a21-b752c136bb50", "value": 709416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777708882, "uuid": "8c2ded15-1d7d-4d20-b88e-7b757ec633bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708882, "uuid": "7b377fee-60a3-45f8-a12c-b0fdd0a5be10", "value": "arm64systemANR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc58e2f-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736322, "uuid": "79e37769-f663-4a2d-8324-7a4083e39a5d", "comment": "Malware payload", "value": "bc748442fc762413938ad35dce808b45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736322, "uuid": "682f0b8f-c125-4e4b-aef7-9763f4f74b99", "comment": "Malware payload", "value": "8a4556c711784bfc92ffc5a3d80fb233665d2c7feb7b82d54fd0eb2a9bd1b571", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736322, "uuid": "209998f2-a54b-4eef-b9fe-2b1f32644201", "comment": "Malware payload", "value": "5872645166cf4e6373c91bdb0c784365f9ed26fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736322, "uuid": "3786b0aa-4507-4ba4-99f5-a80a6761c256", "comment": "Malware payload", "value": "6566e91657cef133d4b97b0609011320a3db1842952d943f942b7e0cec5bd9e24ef0d555fc3ca48eb226a9ef704662bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736322, "uuid": "29696aca-e616-4931-bdaf-39e5d5e67298", "value": "T167860905ACC53BE6C42C5E7444EACA6522B06D140AF2463A26A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736322, "uuid": "62fc3012-8c0b-45ca-801a-6f7c7785deaf", "value": "49152:PX7W9BJ4KGlHi4Ocyc0CQ58WTBAoWCBIE17Il8ZkFc55Eo:6huLQ5phImDOFsEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736322, "uuid": "cafa41d7-9179-4285-8481-29ae17f3f14c", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736322, "uuid": "0b79083c-26a1-488a-a750-334912ee6a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736322, "uuid": "6abccf1c-a3f4-48fb-bc33-590fd526ec4f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601205e7-45c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777683226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683226, "uuid": "5de39099-8ad7-4450-974a-d360c1605b6d", "comment": "Malware payload (Mirai)", "value": "a2a8a474b707e781d800e1a62cc69917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683226, "uuid": "b872642e-65bd-4115-9386-f1cbedf52785", "comment": "Malware payload (Mirai)", "value": "8aaf4bcdf411ebb640d418a65f20e46f173e52e26c715b6917942cdef1b5ee05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683226, "uuid": "f93350fa-a867-497e-9f7b-e4d3b8a31afb", "comment": "Malware payload (Mirai)", "value": "74d32b3bebba6e1747b5f9d7da262b2eaf0abc09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777683226, "uuid": "f3e95076-35b8-4b1f-96d1-3680ba01e05c", "comment": "Malware payload (Mirai)", "value": "fda6dbc63c1cad87dd534e5937d13bb46b0d8532af43110bb3e627c6ba27cd52eb379e27941374880b76cc4bfb292083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683226, "uuid": "b0f3d6c2-3201-454f-b57b-256ddb3c8e4b", "value": "T155A43B51BC419B26C7D06ABBFFAD828C331317B8D2EE7112DE154B3136DB95A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683226, "uuid": "1cf23a6c-02d1-47c2-8380-c0159c80f20d", "value": "12288:kdRd4tNW3RFOaASG1AiQvifcqEr1NWAfZT6ZIuqjRoQy/pEMJleTp7n0FVRGNlEx:kaREX6FiNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777683226, "uuid": "f4ca79ad-eab4-42af-b473-ad26116a6491", "value": 471156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777683226, "uuid": "d0f50b53-0342-431a-b723-ce7a99a549a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777683226, "uuid": "9a3e5e42-3474-4311-b993-aa580fe71c4f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53a8d98-45f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777703636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703636, "uuid": "7bee4d5d-ab31-4e44-a2f6-6eee9f4db1c6", "comment": "Malware payload", "value": "b8effddc58f8a1aba965935072917c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703636, "uuid": "6e823e66-e43f-4e54-aad4-450e7cd9a5b6", "comment": "Malware payload", "value": "8af9d777e68f89ee7bfd33b0651c7c6e84f496c5030a1673f3c893bfc39688f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703636, "uuid": "5fa956bd-fa62-4f3d-bdf8-e497518a25ec", "comment": "Malware payload", "value": "95ee27709c75012878a496c89cfa2b8adc15957a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777703636, "uuid": "6c3160cd-0375-44dd-99d1-307b826fef3a", "comment": "Malware payload", "value": "f96b5b79be02580f24feb28ac4335372a2b817bf0e28f45c786833cbf9b462392f6cbfa014ff24da099f2486b275a344", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703636, "uuid": "faf852b8-f210-473b-a5f9-7158595e1ab2", "value": "T1BE333A13258089FCC40982B183BFA22BF572F57E4134F68D6BA87E27FD5AD310A594D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703636, "uuid": "5b355f65-a6ad-42ce-bfca-4f637e16ae26", "value": "1536:Yx13k3aR9FNlEqmC/7a0xxMd97cleTBn:YD3uaRjN2qLz9xxC97cleTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777703636, "uuid": "c4db7ff0-fd26-4927-9ae7-f507c18fd6d3", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777703636, "uuid": "f9e645ba-ccc0-4440-ad78-ce86b4eb1c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777703636, "uuid": "38824aae-f809-4c64-a98c-a4644f2e5647", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e26143-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736304, "uuid": "2c6e47f7-3156-42ee-87ed-7a78ab5a24c5", "comment": "Malware payload (Mirai)", "value": "e6d11d6aa61b5f79a18253fb13da9a24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736304, "uuid": "b8139bbe-d41e-46c1-855d-3c75d3ab4153", "comment": "Malware payload (Mirai)", "value": "8b96d1cd639abd25c05a3136302fea01282a877d461f32d981a88f430124abbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736304, "uuid": "a84705bf-41f5-4a91-99e3-22caa8d483cb", "comment": "Malware payload (Mirai)", "value": "24cb9d222cdbecd627ebe035fd5a0865e38392d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736304, "uuid": "9d80dad6-db22-4072-94c6-e3bd26587a4c", "comment": "Malware payload (Mirai)", "value": "56b77a6241c89607413ee7ccc27937e1c6dcd2a3135205d3c8d466f4d417407ba6d6e9a13f2b9a39d7d6190b83ed4651", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736304, "uuid": "0129e0f7-6edc-47cf-b577-516d4bda355e", "value": "T1AA733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736304, "uuid": "5770f523-8879-47f6-83e5-b5e038b65e41", "value": "1536:upwtq/0FORx0SFXaRwtjniiorx0cCnKc2Hf7cuG0kKCuWUbdg2V:upv0QRxJUucruHKcaTG0kKwwC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736304, "uuid": "2704c10c-538c-48b8-98d3-208eed0eed1d", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736304, "uuid": "5d742f38-91b0-4c4e-8922-ae723692c1b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736304, "uuid": "463a00fc-15df-4f7d-9969-ac351a2373a3", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a17f88e-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719267, "uuid": "e455fa23-3163-42de-bc74-9d2003785d5a", "comment": "Malware payload (Mirai)", "value": "b9674d6f03da09a16bf7493bbe6adc36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719267, "uuid": "ba9c2ae1-e6f7-4b9e-a13f-3c1445b8a2ca", "comment": "Malware payload (Mirai)", "value": "8d337e5b6c492777e26e4932b75ec8b6f55cd7c48a880e37d8c2d17e02cc019c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719267, "uuid": "00110388-8075-450d-8432-e0bf45ea90c6", "comment": "Malware payload (Mirai)", "value": "28f434aabeca959335c4af9960c98b554a322bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719267, "uuid": "189396cc-897e-4426-8417-7759ec2e413a", "comment": "Malware payload (Mirai)", "value": "99dc170b3cb065c0749f044ca1a5e49933d35e513c7b8f11d920c33af87e0c82dbfe9a247ddbc8a4852651860ea0d308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719267, "uuid": "19a1eea7-0399-4d7a-a5bc-dbbfac1a824c", "value": "T19E845513D9158991E5644CF3226B3285B94B83BBC5EB32D3ED164EA1BF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719267, "uuid": "900a1216-60fa-4395-bd97-b954d621a7e0", "value": "3072:nZ5VZWIyPqExdLT4XH7lJZzKBua2v/8+joCJ/c6:nZ5VZW1vZT4XblJZcOv/Bjoa/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719267, "uuid": "3e9ae29d-5cce-4fd0-9d05-fbdadcdac9e5", "value": 379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719267, "uuid": "50f3baad-a796-41e1-8211-687690c60a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719267, "uuid": "77bb2b8e-6ac3-40e6-9d93-b05638f0cbb9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b335f483-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734905, "uuid": "5804cb83-3641-4491-8b90-cea7b4b5c1d8", "comment": "Malware payload (Mirai)", "value": "0f2ea6b6a566dd66d1b22c7bcabdaa15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734905, "uuid": "72de53c2-6965-49c7-9601-6a1b95c11807", "comment": "Malware payload (Mirai)", "value": "8dda13ebb39f5d434df5a300de1b5c4eb5ab901c4b3038d7182f775ba479e2cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734905, "uuid": "4785c8f2-b6eb-4a96-82ec-11a3f054d3ba", "comment": "Malware payload (Mirai)", "value": "ff8058db86b3ea73724e94a910974d1024d5eb32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734905, "uuid": "25727e79-a1fa-46ea-bf86-51b34153d4c8", "comment": "Malware payload (Mirai)", "value": "b890a4c5fbfd964448000c1f30580785bdd21b4e5e0eff630233527ad8dc198bcdab32def928bcd72522bade09583d06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734905, "uuid": "8b00c0e5-6083-4814-8e0c-d94ed62d922f", "value": "T18CB56C03E683C4F1DA560BF4125BFB7B893699164121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734905, "uuid": "a9ca5d5d-80b0-4535-94ff-f56fc6721767", "value": "24576:mHYQY3AjzeehAXXDyCAEPRUJ6ADgz+sE8LnSBEf8U0J++SD3gtWCvjyslJfQyYKL:giLPR3ADgmDU0mAvIy3cXDAp8kVwBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734905, "uuid": "427961c9-2c6e-4696-9ba3-632e27f9d459", "value": 2412472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734905, "uuid": "f16f063a-cf65-4cdc-9968-4f662d5db365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734905, "uuid": "f7c484e4-2aa4-48fd-9384-f47cbd5b0b53", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbd4f5a-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736638, "uuid": "6f86e164-3d9b-4408-8324-f8c704e8b97e", "comment": "Malware payload (Mirai)", "value": "6af3805b4f36c709d691e78c7321210f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736638, "uuid": "640e28bd-81b8-4a1e-95b8-02d55a4a7e7a", "comment": "Malware payload (Mirai)", "value": "8dfa5e80f824aac1b8f126aa11d0fb6e62954c3a84ae94204a261895e5b75c2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736638, "uuid": "89d34e56-b665-413c-b0ff-ccdca8ede866", "comment": "Malware payload (Mirai)", "value": "8cb0da54937356b8cc326636dee44bf36175ceb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736638, "uuid": "463226a8-fea1-4ab8-bb45-4317cec010de", "comment": "Malware payload (Mirai)", "value": "7007569cb1e8587426da51d45adebe8ce0cd8e98904232310b960ae9c547681a1a7e9013255919b5b6a740130c7ce913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736638, "uuid": "1ee82e13-af80-4665-ad0e-571ad8444a7f", "value": "T16E535921797A2F17C8E8A07A25B38315B6B5768E32B8C65D3C732F4EFF14650A0075B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736638, "uuid": "ca115dd6-6d81-4570-98e4-244f67ce8810", "value": "1536:k+YY8/acYmgBOwicSYmTWLI1fz/A0LzpepdYm+K:n2DZYmTFxoYpEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736638, "uuid": "d70733fa-273e-4b07-b5b5-9224b55c1bc7", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736638, "uuid": "af30a60f-e51a-4a19-8c1e-a8505499ea8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736638, "uuid": "e386748b-f0c0-4a30-847e-e3697b49c92d", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d7b676-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736297, "uuid": "5c7b4624-9fb8-4534-b077-f2290d65cf50", "comment": "Malware payload (Mirai)", "value": "a3aff41fcea8d3b918a3cb91ff6ffc5a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736297, "uuid": "85c335b6-ca77-48fb-b0f9-b6da3e25fe5a", "comment": "Malware payload (Mirai)", "value": "8e6e35d70f33b4a2500f5586746fc29b4b0d258033dec94e124fdfe14768e948", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736297, "uuid": "f642eeef-14bc-4d89-ba13-19ae3acd2e52", "comment": "Malware payload (Mirai)", "value": "482f14dc6328fb0ed7ef2b6a085cca6693e04114", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736297, "uuid": "525efe68-019c-426a-8f4a-50e531d249dc", "comment": "Malware payload (Mirai)", "value": "3d526fcf5b3e37d50e03226c300c9d0baba323e9ee54ebd8a7746df88a39ee25083ab246241cb16c6f01621fb46aa611", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736297, "uuid": "72f431e3-591d-4ef3-9b29-a2b299c08bb0", "value": "T140B3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736297, "uuid": "d492151c-d100-4b1f-ae94-8e10b859836d", "value": "3072:xqiaFqVnpOFnIfG/7/0qZYFY92nylaJl7xVPrqArkfJJ/0kkiT6f:xqiJCdIe/7/0qZYFiCylaJl7xVGArkf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736297, "uuid": "1c976396-1a67-4c88-92e2-6673adebb666", "value": 112664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736297, "uuid": "6ba16331-5dc8-4709-a7ab-f39fcc94981c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736297, "uuid": "6e034b64-0b96-4d41-bd44-c7ef53ccc659", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09590898-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740633, "uuid": "7332a9bc-77b1-48ee-bc15-0acadb6efb15", "comment": "Malware payload", "value": "6e65dc1d9e303406e617697a2cf97184", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740633, "uuid": "22a87219-bc9e-43a3-9acc-f21c5e234174", "comment": "Malware payload", "value": "8ee8d6c9e357bb768dad609fee83d039dae06a2dd0c37799409e1a58cba3be56", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740633, "uuid": "bef74ab2-0f82-4a16-b692-ed79c58b8ab7", "comment": "Malware payload", "value": "d7b7ba42b0a415f75bb9a5e6e4ed4e2ee0eadf31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740633, "uuid": "04be5de4-78c4-4f00-8cd6-8a20f96d4962", "comment": "Malware payload", "value": "120f0eb7f9da513a969ae35aa731984693e5529d1bcc8bda00f643c449161938a587004d42ccff716e7d2f1f8e19eb92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740633, "uuid": "d5d1116f-7a76-46bd-a36c-42a874d295a5", "value": "T14A123047A2D0CE3FC8D9533844A7122472B794BEDF629713064825B53F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740633, "uuid": "36eb2cf5-5184-49a4-b73c-d874c819a711", "value": "96:GqTVJWWGXzS6dH5ML09V1J9G8YmX+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHaZMWT1YmOhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740633, "uuid": "ffab13eb-c713-41a7-a117-24958a9ca127", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740633, "uuid": "9855066b-b5b0-4e76-a7c8-5d471a8ce6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740633, "uuid": "b52863e9-7424-4068-8d0c-d37805d9ce39", "value": "8ee8d6c9e357bb76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f6bfc5-462f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777730449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777730449, "uuid": "c3f43ca8-1333-48a9-a9cd-166aeea884b8", "comment": "Malware payload (AsyncRAT)", "value": "837435509f1b7276bcea8593af27d149", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777730449, "uuid": "50d80a16-8020-4537-a805-6e56898d5559", "comment": "Malware payload (AsyncRAT)", "value": "8ef77f5b654cd24325514fd2e71a079f8b990eed2df157b0f6eca23d10462590", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777730449, "uuid": "98614f0e-62a2-4699-bcfa-d2a0e1ed76c8", "comment": "Malware payload (AsyncRAT)", "value": "55ab0c1c6ab77e465b195147c33179634f5bbae9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777730449, "uuid": "b054cf13-80e6-4235-867c-cf3b95391ecc", "comment": "Malware payload (AsyncRAT)", "value": "56786ce72c1f9c01fee357aac51c16ce32822d0a4d93df14f2163425cb4d3bb13616f6063565cc4928fad680ec2d638f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777730449, "uuid": "a96986aa-52e5-46f8-b2cf-60e2f96eee6d", "value": "T1D3134A84FB908116C5EFABFB15B279060B30EA13C933EA7F4CD4556A1B737814581EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777730449, "uuid": "86195a71-ab83-4324-bdfd-23420919d765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777730449, "uuid": "01c6270b-b4d2-4d1f-be23-d2d2d0e1ac30", "value": "768:qGuTBDYB0fHSlR2xgHXZCsFWPa9WfhVOwhDrmEFQ5L4QDBWd8WNMp:qGyRi6HSlR2xIjFv9WfhVOw5KEu5LBPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777730449, "uuid": "f001ab8c-b821-4a82-a191-99681b778a7b", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777730449, "uuid": "e4d3e57f-48bd-4666-adc4-cec3d61d5427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777730449, "uuid": "3fa2f565-5547-4673-b7b5-395e49545635", "value": "77_CS2_HACKPACK_V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66a80e2-4639-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777734991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734991, "uuid": "b28c54be-7630-41c3-998f-321a8ab898d5", "comment": "Malware payload", "value": "84cb36e202c04057e810e176daaa4b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734991, "uuid": "f80dca40-1d6a-4d2f-82a0-eb6f3969b73e", "comment": "Malware payload", "value": "8f81228b5d5b664681bbde500e24e38aacbf23acaa6aaa50d42d3f5f82f27148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734991, "uuid": "27f7c05b-9028-4008-bf00-21e5b0f71b6e", "comment": "Malware payload", "value": "46c27e379f7dcafa0bfa7a6c36cf6e09af63f478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734991, "uuid": "b0f6f19c-4354-42d0-acda-eea6686ee3cb", "comment": "Malware payload", "value": "f737b52e7cf30565c9cd1fb880ccc9dc99c4bd614625164ed1fcf3e5354e1e678ec88490968c50a0196e3958468e84b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734991, "uuid": "46c9c76d-7a6f-4f37-a2d6-67dcb922b3cb", "value": "T159E59F067C9209FDC15AA73198EAB7807B7678180B3523D72A81B2783E377D05D7DB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734991, "uuid": "3e790877-2b50-4765-82f9-0614ec9662e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734991, "uuid": "22b37bdf-ee13-469b-ba5e-17b51b6baf08", "value": "49152:vcI7E482XUM6FjC0dIczfDUjvQjF2pdhoE:vntEr8AuvQ+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734991, "uuid": "3025c400-59e1-4f8f-8255-db8f6c768379", "value": 3269336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734991, "uuid": "daa0cf82-51f2-4c84-8e4e-487b162ffbbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734991, "uuid": "bb116af1-5389-46a3-9e4e-0e720f24ede0", "value": "activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dff4b5-461c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722156, "uuid": "8625ac77-c9af-4533-9acd-eb64c5139f74", "comment": "Malware payload", "value": "017a20060f7fc072c136a5146df96594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722156, "uuid": "62473f7f-ec52-4786-b823-8a10fc085e65", "comment": "Malware payload", "value": "8f86d976e7ddb95c99b3f49b0a038f80de12313c2cbde46475956cb00c27dc36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722156, "uuid": "69f83c25-4b96-4f0a-bf3b-0cb97be7a5e3", "comment": "Malware payload", "value": "29984e10a1ce6b8fe3a8482bc35c257133e6b26b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722156, "uuid": "ced4f1fc-1949-4ba0-be13-3275d49f8ac4", "comment": "Malware payload", "value": "ab788accd88073039660f70c8b463e360cb017d498dc7348f06fcb2cec109150461b4a0f04b47092a7bcd84008c98149", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722156, "uuid": "ac7ac458-4a62-4655-8f15-71b93720cccc", "value": "T1B7227103F167CAF2C88625305E9BB7BE5361D442EB948F1FF9184879DE63A8C101B386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722156, "uuid": "541f85a4-fe14-4be9-b0af-cef173709d39", "value": "192:f5Ab2H7LSI0DaOSwpVriRiKGp3btEK6I9cA9Z2H:fKiV03FrGyREKtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722156, "uuid": "a767449c-15d1-4a84-8d87-e420a4de27ed", "value": 10294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722156, "uuid": "3e15b5fc-60e1-4a4b-afa9-94d63d98904f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722156, "uuid": "2e259c34-3f01-4a3a-9998-abb85ccc38bd", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b45fe1-45f8-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777707019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777707019, "uuid": "77231894-d977-41ef-bdff-e02c3121dbd0", "comment": "Malware payload (DCRat)", "value": "6cca4262a5cf4d135469c0f2db46fa24", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777707019, "uuid": "ea011ed8-62a3-47c7-a154-455bce9f6331", "comment": "Malware payload (DCRat)", "value": "8fa7c3818473d8a904cf5652a4fbd9ba96795a2e82b8f189d870ddb9a172353e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777707019, "uuid": "bfedf831-4fc8-4a7a-be05-1054661ae7be", "comment": "Malware payload (DCRat)", "value": "9e9145e43d2fe853d3c234eca85b3ec31202e02b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777707019, "uuid": "9694590a-2984-4331-b40d-82987989ce34", "comment": "Malware payload (DCRat)", "value": "55859d877a539f2c84680153cc69123af6f4942357543e7a9691f0d4cfd9d84abe72394c862f7683e54a8685ebebe061", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777707019, "uuid": "0ca23d2f-7dea-4fb8-94f0-3ae96eb96199", "value": "T16805E6017E44CB12F0191233C2FF454887B4A9516AA6E72B7DBA377E55123A73C0DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777707019, "uuid": "2d50c360-dc21-4ec5-895f-f3e540bd4232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777707019, "uuid": "7da9bcac-530a-487f-a9f4-9877c0089dec", "value": "12288:hRZvG8CxrjgtqRH4sR2TX49pXvtIt8AuBsGZeQvS7g6T4:hK8UjgGH4bTX4XX1N9S7gC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777707019, "uuid": "c5460433-06cc-4f03-b791-bf0c0ba4d7a8", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777707019, "uuid": "319d9c95-5fab-49c0-a088-316f9a10d7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777707019, "uuid": "99572d6d-bad5-4146-919c-2453bf20c3fb", "value": "08fa7c3818473d8a904cf5652a4fbd9ba96795a2e82b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9910f599-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736150, "uuid": "724ef0fb-d5c2-4116-b48e-d63cc6523c21", "comment": "Malware payload", "value": "e8aafcc0b9946ebf855e926fe50ed1b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736150, "uuid": "c26272d5-8cbe-4419-834d-f31f90f9ae26", "comment": "Malware payload", "value": "91262e92870867c5ff41ce79675f1ba816f83fa09bb47ef9da68631a77f2822a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736150, "uuid": "912fa091-619e-4f50-953f-56d66fed1426", "comment": "Malware payload", "value": "cbe6e823b44e13807bfe313c8fca4c21de6adc98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736150, "uuid": "d3abb3ae-da9f-4878-bd10-54f6a3ff488c", "comment": "Malware payload", "value": "a7bd47223d68a3bc003d163bd0bb48b0e00922597a04cf1259509cc9628df6b3acbfd2b2203b06155623dee8637a8fa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736150, "uuid": "419c8553-fbf8-4b65-bc09-cef51060cf35", "value": "T12C12B863D293DFB2C4C1223A8B879B786211C045FB05EF57E12C4568AE6338D8977763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736150, "uuid": "89afed40-2e5b-4f63-9638-e6be75008b4d", "value": "192:f8PuIH7LS2/31MvsNJnMgSgfeiPPts51xrgeDIg9Z2H:f8mI1dM0NJMs5lW1xrRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736150, "uuid": "1646cc28-66b6-4b10-8e60-f13d709e176b", "value": 9562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736150, "uuid": "630b3c80-b5e6-4afe-b5fc-7fb744095c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736150, "uuid": "263942b3-127d-49b5-95a0-ca7ced7f21e1", "value": "boatnet.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dc0449-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736301, "uuid": "fe64161c-f9df-44e9-99f3-5a82ba4b6704", "comment": "Malware payload (Mirai)", "value": "28bf364339cd6a6eeb9e53979d9b6acc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736301, "uuid": "65e300f6-2a2d-40e3-823f-b392c2f8020b", "comment": "Malware payload (Mirai)", "value": "919d9db8d72737fccfa0f17f8eb56742a65c5e5cec4d1c19bb069b3c3d87779c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736301, "uuid": "865b8418-cf3b-4b17-9751-cd2d7b22d89b", "comment": "Malware payload (Mirai)", "value": "cba1cc9a61b221ce748ad4dd628c4b294548c48d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736301, "uuid": "f86057c6-fb22-4be5-b6a4-8b5769d7a3ee", "comment": "Malware payload (Mirai)", "value": "0e533c36239699c0cf2ba79768ed236ca8268e5f9e984c54cf9b7a7dde967ebbebd37f3307d73e1f7b6e0185eb473816", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736301, "uuid": "a3c5ee25-dbf7-4498-bd99-ea7f5f9589fd", "value": "T19FC3D506BF114FF7D89BCD7346EA0B05258CB82B16B92B757534EC58B24A1CA1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736301, "uuid": "2dcdca9f-1cf3-4935-bc62-7ac0188974a2", "value": "1536:D4w4zW/h4SZsqEzLMzgiDSAP3POgjaXbzTZjifPNXe/SRKEEFCSmR:UxW/rZsqgMnPvjarzTre+mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736301, "uuid": "ef7734f0-3917-48af-b02b-e6dcf341bba1", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736301, "uuid": "2bcf0baf-ebcd-4bed-ac87-869401ca1768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736301, "uuid": "6e7e646c-e896-4089-b3bb-c22dd5477704", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aab6a36-461c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722301, "uuid": "7169ec3e-d035-4366-a76f-8c4b5c07f7a1", "comment": "Malware payload", "value": "dcea4ebf905dfd615725ee7f50e80155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722301, "uuid": "f58cdc02-d6e9-4f9c-9185-428189ff789e", "comment": "Malware payload", "value": "924d04927474d82bb9c31bd75bfa01a15746460d201d682ad4155c116a635dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722301, "uuid": "8b712961-66aa-4df0-bb7a-583ce238b427", "comment": "Malware payload", "value": "637e8bad78e94edf6b49d7a3fe625a5396754464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722301, "uuid": "5de268c8-793b-4e4a-9fac-51f0ec2382a8", "comment": "Malware payload", "value": "f40a885d6b62d9541a37a2328991993ef91040ccb6580987a4d774663f8dcf473dcf8b0d6b5c7e493342fcfab1fd2e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722301, "uuid": "e32f2134-81c3-4e9a-905c-991935788a70", "value": "T130745B4576A40CF9E967823CC9A34A06DBB2BC560771EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722301, "uuid": "f6526a7e-a97b-49f0-aab9-d6f1f8a35734", "value": "d04feef9f2f0dd0a18187fe3826aaf2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722301, "uuid": "a44f33e2-9af6-43be-8a72-8f5d207521a6", "value": "6144:O6YaTDvpL7IF/Kz5vRzxoKqlFoBRtJDzD5/5kzh:OCI+vRyllFoB/1Dl5k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722301, "uuid": "f0fbb849-9637-44f8-a413-3286585571a8", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722301, "uuid": "a5c6ae8b-e7ef-4eec-93b8-5aa5cae27104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722301, "uuid": "43dd4d6f-4731-4add-b378-7baea74b3744", "value": "wmiprv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716d8be9-4659-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777748539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748539, "uuid": "332a77c8-71d1-4e07-8edc-75ade060b34a", "comment": "Malware payload", "value": "fe7a0fd082811297c77606f77257361e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748539, "uuid": "7953f2b3-b68d-499a-bc8c-a8e88f4d9a92", "comment": "Malware payload", "value": "9269c2dc990ede131f6a4a831e6c0d6bfdbe8005448c5d71b582eab01ba852fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748539, "uuid": "449006a2-e610-4dc7-a7ba-ff2e9ab8461e", "comment": "Malware payload", "value": "144ee36d7e909e463c1c561d1f3661e11dcc7386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748539, "uuid": "e642d388-4203-4a27-a8e3-d4fefeab2e3e", "comment": "Malware payload", "value": "123129cba4475e97edb9cddc66706c02b8e6f19785c98da678f6c526ce70e563894b84ee16d08985acb81dc07a63ed5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748539, "uuid": "c08353b7-e35c-40af-8032-fe487c1ad087", "value": "T118762A97B8924952C4E43637BCBE81C432630EBA9BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748539, "uuid": "67210c37-05ef-4127-873f-817fc394e32a", "value": "49152:uvQ3F8K4V6I9k6QE3Qd9hjxw513d0+q04BVcSVP4GFsbmyWkdup5Ev+:sb6I9klEgd9hjxw51A4GFsKV/E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748539, "uuid": "e74d10ed-0387-43aa-9820-9e64349c27a6", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748539, "uuid": "469d5543-b001-4dba-9e68-50ab601d9942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748539, "uuid": "8e120bc6-4ea2-4833-b68c-9f9b0d074115", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e2a248-464f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744275, "uuid": "e745ef37-ced3-4533-8d97-a7c5e66ccfad", "comment": "Malware payload (Mirai)", "value": "d717c6d5ee02426034e7832a91bb891e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744275, "uuid": "a45fb4c8-f471-43d4-9050-05254fe85a88", "comment": "Malware payload (Mirai)", "value": "926e89c2530ce63cf0d146a166b7947645b1d9af7f2ef4c998e67fca54a9ed20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744275, "uuid": "852bdac7-28bf-42c9-b633-484e4e59ae82", "comment": "Malware payload (Mirai)", "value": "15c80beec8fdbb4279d1b489a581620dc2a4eac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744275, "uuid": "bc3755a0-35b2-4bd7-b280-6e4e3187a110", "comment": "Malware payload (Mirai)", "value": "c690e0a70f33b81fcfc7f1e84903063de53972d0dc8e66013e7554258b48997928ff02a9070087ba80647967254a10ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744275, "uuid": "b97e34b2-c249-48bf-bfb0-6462c70bc8a3", "value": "T1D214E946BD518F23C6C311FBFB9F429C372667A8D6EB3102D9257FA437864DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744275, "uuid": "1a6908f9-b00a-4d7e-b5ff-6344a50f8714", "value": "6144:lVIhEOEEGyUqOOsTN29qIvMsN8G/LjbJL:jIhEO5GyUQsTN29zZGG/Ljb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744275, "uuid": "98e618ca-1c16-4f27-a2ef-859eec60dad7", "value": 205404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744275, "uuid": "e4da5465-f339-4106-817f-43e419731a09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744275, "uuid": "6c0a816a-1286-4e27-9414-707704a18a4e", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b083d064-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734901, "uuid": "92bd3814-8db1-445a-a95a-4d9e702ad30a", "comment": "Malware payload (Mirai)", "value": "2984164da7982928e9fbff56d36aa721", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734901, "uuid": "f87da8a6-bab8-4e5e-9bc6-dd1bf40dcbb4", "comment": "Malware payload (Mirai)", "value": "939f7edef0a60358c16653197b6aee7d37d7f3b6654a58815b2b9ac97748f7fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734901, "uuid": "80c324b2-53e2-4b64-89a7-955e87b16ab7", "comment": "Malware payload (Mirai)", "value": "c57210178627fe91da5d5ee875a888ed5ed3546a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734901, "uuid": "bee0831a-933e-4869-b5eb-fb67d5180273", "comment": "Malware payload (Mirai)", "value": "1358bf44a66960624583541833da93cf250af10bee4e155938849523b4a3570f8a148bae2ce9a6a5399b8248d22cbc48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734901, "uuid": "d7ff3909-114e-43c4-9b7e-75a1befc650d", "value": "T149B56C99EE0E3D42E3C7E27CDF4A8BB0313B76A8E32280B37952415CC0DA9D597B1655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734901, "uuid": "f010423f-757d-40a7-86cf-f9e2be25be91", "value": "24576:1deyMyQpUPiW1BEqTUPQAQ9vhCYqOrQuyVvlCecWCswXf8dBBLiyp6pufDFmyLIX:IbOiToCI23qhgAfGvt4yPc07fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734901, "uuid": "c9894271-ab56-4062-8787-c62270eaea51", "value": 2489264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734901, "uuid": "995a07ba-af57-4d8d-a532-77964f1e714c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734901, "uuid": "ab343c95-58ba-4685-90e7-692a6040978a", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b468574a-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746933, "uuid": "e003d797-2a4f-454b-ae75-aeb9cdbe4967", "comment": "Malware payload (Mirai)", "value": "c61e41720b1b7769ecf1a751d2304897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746933, "uuid": "bf92ff17-993f-43dc-b981-e7fb4fc61da0", "comment": "Malware payload (Mirai)", "value": "93b9de7279cdac2c417a9475861ad1f89c7ea37bd6045d52bb520f8eb2cf4501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746933, "uuid": "b916a249-2ede-4871-b621-6b83ea2deb80", "comment": "Malware payload (Mirai)", "value": "dc9e33f889fbe4006921e298b68d39c387b1db70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746933, "uuid": "9f666f3e-d357-4725-b9ad-633eba59f3d3", "comment": "Malware payload (Mirai)", "value": "e818811d7d0248e4ae0c745c9a4d446e490d592aa93403070be7e54b76969700e6ac595b3af2a4bffd674a97b9952fd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746933, "uuid": "8a8fdf2c-6e87-4de0-8bda-b98e1a60abb5", "value": "T14223F1897520BA7383B0743CD4A6EC85742E16E4E05A31F315BAAE3C393675B25FA487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746933, "uuid": "acd3bf79-aab3-42d9-99ac-958f78241580", "value": "1536:eDfURTAOVYB6Dk2HPkrjDQLmp0b/THUtEzA3C:ewTfLPCQLmp0rT0v3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746933, "uuid": "943cd3cf-b544-4ab5-a4ca-f69dc0a9ea61", "value": 50060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746933, "uuid": "21150bfb-783e-40d8-9389-b8179f2c0700", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746933, "uuid": "63c9350a-1594-4bd8-8695-9a2c4ff0cd1e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d749b2-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746931, "uuid": "945c8457-7b05-434a-a655-9658d50da249", "comment": "Malware payload (Mirai)", "value": "745e6dc064e08961fbd270b64ed7ee29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746931, "uuid": "f2e5c78f-c90c-42b6-9f0c-a60e0d96aa87", "comment": "Malware payload (Mirai)", "value": "93f7215ada77b50f8abdfdcc3ec9909a0706563c5829791dbe5638a3583a8b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746931, "uuid": "b33924e8-1a63-4816-85b4-cb0e185b39f2", "comment": "Malware payload (Mirai)", "value": "abb5a6a8dab873942265344a2427b29daed5273e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746931, "uuid": "9259a4ec-c666-4a1e-8fb1-399eb5de82b4", "comment": "Malware payload (Mirai)", "value": "7141dea1f960b288372afedde4de9c21ddfb607e071115911ffc9a6e377e6028e8feb3bb2f27a27abbc2e9c7b1061970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746931, "uuid": "d31256f1-16af-4e20-ab42-259919b4fdd6", "value": "T1F4B56C99EE0E3D02F3C7E27CDF4A8BB1313B76A8E32280B37552425DC0DA9D596B1615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746931, "uuid": "f983be00-82d2-4175-9142-f39c0500d44a", "value": "24576:vj5jZXvdE+bE7TyHu5BheBi5K3yFO8/2ZxcxCLwF0nDdeF0Zo7kDphA4kU/KBqKM:tlVEJcARUilbAERTQe4zPc07f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746931, "uuid": "cab9cc79-f763-4dc9-b25d-f77cde4419cf", "value": 2472880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746931, "uuid": "cbcf7fc6-74ff-4ee4-b35b-2c7b432f9bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746931, "uuid": "b509a35f-2562-4682-b2ad-a9097457faca", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3659545-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777706129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706129, "uuid": "7c3117a5-401b-4bca-b61d-9c0ba4f134e8", "comment": "Malware payload (DCRat)", "value": "191789c7dfde687b1efd0e36c2213a1f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706129, "uuid": "71b4d987-f509-4c59-9181-118a38bb13b8", "comment": "Malware payload (DCRat)", "value": "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706129, "uuid": "5e712fb4-eb79-4912-bad8-1b3804e30826", "comment": "Malware payload (DCRat)", "value": "3104dc0fd41732486d9060f8093832e0f3350061", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706129, "uuid": "005a94dd-c11d-488e-8643-0fdfb34dce96", "comment": "Malware payload (DCRat)", "value": "47e098ac8701f9963f94de113e567bc62d6ff406419dc4e0124efa13a066505ad9395ec1fc9f7853801370e19ec16627", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706129, "uuid": "a9042f3e-01fc-447c-9cda-9337e48070f9", "value": "T1B4454A017E44CA22F0191633C2FF454847B4AC516AA6E72B7EB9377D55223A37C0DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706129, "uuid": "8d3983e9-5098-4de7-9372-2946579f8c88", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706129, "uuid": "76dc9fc5-1fa8-4897-b4f5-af2981fa0182", "value": "24576:U2G/nvxW3Ww0tPK8UjgGH4bTX4XX1N9S7gC4t:UbA30Pf3TX4n1Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706129, "uuid": "e9d3515a-d2b2-487d-bd1a-332a90f6cfa2", "value": 1164939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706129, "uuid": "dcd89180-f560-4755-bb54-889e9b64cad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706129, "uuid": "34206372-b04a-488e-b501-912cfede94a8", "value": "191789c7dfde687b1efd0e36c2213a1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8d1de9-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719275, "uuid": "0030bee4-a08d-4e80-b4d3-503fc2af25ff", "comment": "Malware payload (Mirai)", "value": "622fbea60d1219bd4099ec5c6a8c0c14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719275, "uuid": "80a3e900-bffa-476a-96af-395d5d259fff", "comment": "Malware payload (Mirai)", "value": "95b6f4d9e11e95eabe74b77e36af17d25b255fa203d8bf108b0519ebd905eabc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719275, "uuid": "2e31c71d-cdea-490c-93c2-a0670208e3e3", "comment": "Malware payload (Mirai)", "value": "a275780914239c238315f3907f0a1757c0893bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719275, "uuid": "ecc8bca8-7b96-44e7-b603-ce3934d10f74", "comment": "Malware payload (Mirai)", "value": "9efa56dd5898391ddcc25e5b20aa2eb221b4b12fd3bdad5c4b8059ef203b70132139be353bc96949f982da6d194c2b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719275, "uuid": "6c23fe7e-1189-4a3e-81ea-14c6058e0170", "value": "T1BF849713D9118991E0654CF3227B3245A94787BB8AE732D3ED1A4EB1BF2151F42BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719275, "uuid": "28f04096-e132-460f-9327-ee17a9e875ec", "value": "3072:qpeLF3LZeaila1X56sRg5TYz+8D6J+joCO/vFv2CLQM/9uItyT:oeLybla1X56sS5W+Q64joF92C0M/9JyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719275, "uuid": "6574c64a-a6ba-49dc-aee9-f45d62facf74", "value": 394022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719275, "uuid": "a4702ce9-9df1-4612-b999-9fd535f9584c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719275, "uuid": "df052941-be91-4199-9be9-f0205135f23a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66b3240-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734911, "uuid": "33957ddb-fea4-4c6b-a303-a295ce53f31c", "comment": "Malware payload (Mirai)", "value": "c077ed961e2cbf5f7740952135de47b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734911, "uuid": "955bae23-8bc4-48a9-a9c3-932ba4661fa7", "comment": "Malware payload (Mirai)", "value": "96beebf569628aedd24edc2302992f086174722efbcb21a296e453dcc9bdecb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734911, "uuid": "ed68b908-72c9-43cb-a99c-0c3031bffa8e", "comment": "Malware payload (Mirai)", "value": "afea959b7ab479162acab03172af8eefb4f2d18e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734911, "uuid": "0774422e-e361-47a6-9748-449dd6de65a3", "comment": "Malware payload (Mirai)", "value": "561781822d6ba9e30d763f10d73c931b358f0d9ff8b069b14d28720467c9bceb0bdd9db9a3471524242341df08763d7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734911, "uuid": "ad039fda-9f09-4cd9-a3ad-04c9b8e6b941", "value": "T120C52844EAC740F5FE470E718167F33F8B346B05C420CEAADF94AE16EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734911, "uuid": "a7963e46-656c-49d4-8143-fc848b7a9a1f", "value": "49152:ytHQKuyKPzSHUS1UWoXRhv5h7yE+xaV38lJTYBhbJ+upRkVng2l:ytHQKuyyzS0jVhgxlYBhbJlpRh2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734911, "uuid": "0fae627b-f8f6-4d1d-9b3f-c3997e9a1d76", "value": 2554840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734911, "uuid": "2a5a68d5-be53-4e53-b226-0476d3275e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734911, "uuid": "5c6cfc4c-c714-48ab-b9be-e9c5f94224f7", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825ce314-4681-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777765747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765747, "uuid": "6dbe64fa-a096-4328-9e9b-de82e330dca7", "comment": "Malware payload (Mirai)", "value": "abd807a1bb4641119ca3601c3d0ccc3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765747, "uuid": "ceedb55b-4128-47a9-bfd8-2b538d176fd3", "comment": "Malware payload (Mirai)", "value": "9756ceebeb89b86c4e3755b23039faf5536313e8fdec7c4ee2423c815cc7f900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765747, "uuid": "062b5c50-14ac-4189-9d62-83cd3485596f", "comment": "Malware payload (Mirai)", "value": "c2ed979c002996ba499ad50f4af7b0f740fae926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765747, "uuid": "102cde3b-37fa-4c60-a78d-d4a56f7fce28", "comment": "Malware payload (Mirai)", "value": "3e6bd0bf46e393111e661730fd8026a1f6e20a4f055058f000ae5c329c25e50dca885bf664f23babdab9a264cc843884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765747, "uuid": "533cb64a-ed58-4242-ac8d-55384df7b0fe", "value": "T1D1E52A156F500FFBD86FCD3346A94B12258DA40622D53F3AB878D914FA9B60E4AD387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765747, "uuid": "9fdbe4b9-3cf4-41f1-9fef-212881fbf2e8", "value": "49152:XXzi8rdhyBXt/mfG7yyJKb0928ooTVWA8EiNB3pAvPIA30:O8pl+wzTpAIAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777765747, "uuid": "b8abb328-c6d0-4ee2-8305-763b2ef2a3d2", "value": 3148040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777765747, "uuid": "94e87e3b-eeb3-496e-ab89-91fd0559ca83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765747, "uuid": "32a637d7-4d02-430d-8c71-5fb587f6f175", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72038ca5-45df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777696141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696141, "uuid": "4beb30c1-4a95-471e-a63d-55fa4aa0f9e0", "comment": "Malware payload", "value": "7421f597ff29aa59ece4029d92b610d6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696141, "uuid": "53916c02-25fe-4460-a3d4-74642b099488", "comment": "Malware payload", "value": "9817f96551e9b2a2530952a47979ff85267a1e4452350a39af850a6af659a464", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696141, "uuid": "82460123-5a0f-4261-b227-34f9e83c8ef1", "comment": "Malware payload", "value": "f35ac3b6a7cfe5f676925ebe97ef53673721152c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696141, "uuid": "4bd14bcd-7b43-41e4-86f8-6b049a544103", "comment": "Malware payload", "value": "2c5fb0edc9080fd4b24409be76bc0069536d495ca5dc6d798ce5bf4123bccfc797b70726caa595d0bffdda2422060654", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696141, "uuid": "30d07c17-44d3-4128-b743-a1003d3bc55a", "value": "T11215CE0799489B43D11942B9BE070C992F496E0CA9D175EF306F7E8B3BB47760C6E42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696141, "uuid": "2e54eefd-3c02-42f0-bdfb-c4b383cf0300", "value": "12288:v0Xv+2Y7gX3umqfXLksVyOj3hvAZ0akbPDfhPuD1nMoXaPfy/syNPGmkpr:v0f+2Y4+mq4sV1ADKP1Pu1mP6RNOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696141, "uuid": "7463d48c-f121-44f8-8f3f-6a68f1bf4372", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696141, "uuid": "787373f3-c041-4db8-b92d-62919c9f463c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696141, "uuid": "0c2d9cb6-a5d3-4351-9669-9ebf2953f9c7", "value": "SecuriteInfo.com.X97M.DownLoader.2343.7996.8835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e177ff8-45f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777705074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705074, "uuid": "14cab87f-091d-4b74-a439-223c39293482", "comment": "Malware payload (Gafgyt)", "value": "5013f0ab8965e9dd1c72032855511eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705074, "uuid": "0bd382f9-13d4-44b0-be9f-1e5c30ed3506", "comment": "Malware payload (Gafgyt)", "value": "98564366fb732c13255b1df0a65fe1838561d014591158e19a75ba841f3369c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705074, "uuid": "1d7013b6-dfe5-4ceb-a60f-4a5011aafaf0", "comment": "Malware payload (Gafgyt)", "value": "48ac0d023a444a0f487367d35f6f0fbecd3eda46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705074, "uuid": "4bb0d077-1327-4584-869d-4b73f145bbac", "comment": "Malware payload (Gafgyt)", "value": "8037cf08633d185fae776c6945e829ad6605c812975ea11426112ac84ae9aed80dc4e726bef71cf20ea074732ea9b6ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705074, "uuid": "20ae627f-e11f-4e75-8897-1a2ad5cf620b", "value": "T14BB30823BA260E27C0D264B622F74731F9B5A7DA18F885077E615DCCAF641C13663BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705074, "uuid": "047249d8-dcc7-4dcb-ba1e-c973f3a27f79", "value": "1536:wp+rVAV/on5fEzdspyeaAo95I1tPCt85rphasJ2sr:wpsIo5fEpPeaAoPm1hrphasJ2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777705074, "uuid": "efea4c2e-fabe-47cb-976e-1224b494e3c2", "value": 112292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777705074, "uuid": "bf686bed-2354-4a51-a012-0916c40e5c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705074, "uuid": "4760a471-b764-44d2-8773-3326488001cb", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed723367-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694630, "uuid": "b401616e-a440-4ef4-acc1-80b6fb9c0164", "comment": "Malware payload (Mirai)", "value": "1e8805ade46de492f7478e999a4607ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694630, "uuid": "1027e889-736b-4e20-90db-0b9413572ea0", "comment": "Malware payload (Mirai)", "value": "99700223dc3429a2115dd6f91d911010a39eea10693cc781914b9c2b281c1440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694630, "uuid": "35b9b039-390f-49c2-a964-2fcf622b65f9", "comment": "Malware payload (Mirai)", "value": "a9a91b8f92b04507c79dbf70dd7c6be061807dbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694630, "uuid": "85681ed4-dede-4734-9198-29333cbc9095", "comment": "Malware payload (Mirai)", "value": "02326a93aee17f03c3cb969667e5348c1d1d5b7804ebf2d0f630f67d9d274e31c8da21e85edd2e8b79240c9cd063770b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694630, "uuid": "61a97187-db18-4b45-817b-33ea8d4f6deb", "value": "T16B732C077A42CAFFC08BC1F047FBA93A8922B83E1535B1A9B7E0FE552A45DD12D1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694630, "uuid": "1e235624-b579-4930-9380-d6d5af4d3d02", "value": "1536:TqT/BcOtYW6kXQm5ge7lY+6/1C54sDTKpkxgyJbxFwvW7nAxzOpngkY097:Tc/yOtj6kvtpY9NC54sGpkxZJbAW7AS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694630, "uuid": "81968874-aed2-4d4c-841a-b3a0d393b0ef", "value": 76624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694630, "uuid": "a0d23c22-3797-4520-a3e9-a865ae5e1882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694630, "uuid": "09cee8c3-69f1-454c-8680-280b6da9a9ba", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b5bc96-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777706127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706127, "uuid": "bc9fb158-24e4-4820-8966-5fe718cce50c", "comment": "Malware payload (DCRat)", "value": "0fcf34f0086e09a7a359ce2ab5a93ffd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706127, "uuid": "514004fb-53dd-4e50-9612-e429395276fd", "comment": "Malware payload (DCRat)", "value": "99b6cd32cc25ea611de1e0fe5d5b22b201a7e885da87ef1031988dc50986b562", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706127, "uuid": "531fd726-4090-479b-83d0-2a8c8f8887da", "comment": "Malware payload (DCRat)", "value": "6ab985b162e173068380108fcd421f9242332c77", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706127, "uuid": "aba924f6-1a5c-4575-953b-087b7939c25c", "comment": "Malware payload (DCRat)", "value": "12246102adab94c654249c69ba3f459dc53bbd9f70bef6cc78fc65afd125e6cd6271023614f54ad1ab211118c12d578a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706127, "uuid": "a0819bd5-3af1-4609-a2b5-f185ea695bc1", "value": "T1A7658C027E40CE12F4191633C6FF452447B4AC556AA6E72B7EBA376E55223933D0CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706127, "uuid": "f9438129-5a5e-4879-904c-6eb3649d5dd6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706127, "uuid": "eef800c7-eacd-40f6-855c-7bda59ff7fb9", "value": "24576:U2G/nvxW3Ww0tRM4LwYPRHUAePrqMBm/nUyv0Gtdgq6a+/Hz9+0kXmFf5:UbA30C4BR0fq/B7CYpXmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706127, "uuid": "f89305be-4e9f-4746-9e33-323dd345e862", "value": 1515132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706127, "uuid": "59cfab88-2ee8-443a-8fea-2a048a406fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706127, "uuid": "7ba3c4f1-2255-4f60-a599-5a103b4072bb", "value": "0fcf34f0086e09a7a359ce2ab5a93ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0a14e1-4665-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777753930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777753930, "uuid": "2bcd4ed8-aafd-4592-8ba8-01f59ea42d42", "comment": "Malware payload (ConnectWise)", "value": "38262b0e9a39481af6ef20e9c1805774", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777753930, "uuid": "69f0c3b1-4954-4069-9010-ff2af2e3e46f", "comment": "Malware payload (ConnectWise)", "value": "9a7e2a618cda6366228528b47726ab7ae78c4ebe01b8054924e2b6d656151970", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777753930, "uuid": "d1fad700-da86-44aa-99d9-78ac51990e07", "comment": "Malware payload (ConnectWise)", "value": "0b04b50c6a35a697b20d8f8c436bdb5a5144d083", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777753930, "uuid": "c57832a9-07a2-49a7-b0e2-6f225724c6b0", "comment": "Malware payload (ConnectWise)", "value": "a7e483febd32a1bbc810d483c690a57f044bf1c2a6025b9d4422ac6eae6b524db365c76895c4df47b7b63fff6f973ee8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777753930, "uuid": "9713d672-a7c6-41eb-8560-56cef8b0d364", "value": "T178838C03B5D19C71E9721D3514B0C9A15A3FBA111E748EBB239802AE5F341D0AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777753930, "uuid": "7860236a-48a6-432b-b8f6-ea9115293cce", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777753930, "uuid": "018db287-7988-43be-b325-6dbd2d9a4d55", "value": "1536:HXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvm:XE3x5KBDYiKWm/iSw0fRMvyge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777753930, "uuid": "6dd09d5e-46e0-4bc7-8522-a693ec2c5e56", "value": 86408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777753930, "uuid": "f5817830-455e-4112-b771-bda23f90bcfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777753930, "uuid": "d032bee7-e2e6-4c95-8aa3-4799c38dde71", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6fa069-4652-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777745737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745737, "uuid": "5fd83721-ea8a-4f8b-b7ab-fe836b8b224e", "comment": "Malware payload (Mirai)", "value": "5f25ca7b69ae6ef0595c83e706bd17b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745737, "uuid": "19fcd081-60b9-4caf-8018-cf6a7c46d691", "comment": "Malware payload (Mirai)", "value": "9ada12e8bac8d5787e279c2458961d2fd7455342621ec4d6bc66015c3b4e2e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745737, "uuid": "785be708-f61d-4fa1-9b62-75223f4b7aed", "comment": "Malware payload (Mirai)", "value": "b005fd109061cbab5ce1f16af827d3560eaef2d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745737, "uuid": "548ea715-a134-47f7-8f24-7976e40fe551", "comment": "Malware payload (Mirai)", "value": "1f35106a92e5ddff0704c7a6823682eb0a51a093fdf055256fead5bba74e1f30902cf6361106a27e6aa9b95d7a271ff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745737, "uuid": "b897e2e2-446c-4988-893b-388ea3d0d579", "value": "T157549A1A2E22DF7FF66D867047B38930569876D63AE1D544F16CE60C1F2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745737, "uuid": "4ba71fbf-cecf-45c9-984d-e9df847d6437", "value": "6144:MarBJiIvS6thmkn8n5w5RKhCUD1EAyQgxtjRs6:3S6tB8oKh3sjRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745737, "uuid": "1f870aa2-ba37-4005-82ea-e29e8547fd75", "value": 304680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745737, "uuid": "982663ea-5447-4b3d-a471-b0db648b84f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745737, "uuid": "5ad66cfc-ff20-49d2-9d69-ccd1bb9ccaff", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6427dc23-45e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777699554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699554, "uuid": "e6130983-b771-444a-b12f-0991a69f3414", "comment": "Malware payload", "value": "0681014cd94e8daca2291b3176f51ee0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699554, "uuid": "bee2cc13-aac3-45c0-8d8a-0d6653c611e3", "comment": "Malware payload", "value": "9d11193a880016674ea596a9c4816ffc9c79e8c7da0ca1f24f9436469273144e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699554, "uuid": "da067b14-a450-4101-bfca-b77c594858b5", "comment": "Malware payload", "value": "ad6a9ab85d7cff26ba0e4a939cb4c9fd5a65bacb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699554, "uuid": "87620e30-3c64-4ed1-b5e6-43b664322218", "comment": "Malware payload", "value": "bf39d1f00178c74740912bfaaf743b187b404bba58be209ffcedb2bb41ec728d1f3ced1d225bf12fe5cec13a67a2313a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699554, "uuid": "e5487e87-f1e2-40f8-9b3b-e49c8c05c960", "value": "T1B9136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699554, "uuid": "3b4ab649-0bcb-4f9f-9c78-5ae79ec83674", "value": "768:bqs9NyXsZztC29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bvHusZGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777699554, "uuid": "fdff0f46-2d77-4297-a86d-6ab470e051f8", "value": 45421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777699554, "uuid": "9231e37d-d99b-47a8-af44-ba1ef758b1ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699554, "uuid": "06a534ad-24d3-496d-8bbb-a1666ebe744d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e71533d-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723892, "uuid": "44bc3158-2652-4d6a-b13b-fb041f5ba434", "comment": "Malware payload", "value": "5f481160db32328b9b569c7b60c7d92f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7532", "colour": "#E301CC", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723892, "uuid": "353aa63b-8b04-4471-a367-f6fe4e0d3e66", "comment": "Malware payload", "value": "9d5548b19823ce8cbc5d6eef0a3405251aaf996885f169f5f3d6f460a3588e0d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7532", "colour": "#E301CC", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723892, "uuid": "2629e0f3-24d8-4b3a-9678-fcac92eb7525", "comment": "Malware payload", "value": "b11998aab2ff49c93386c365617109f922f97993", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7532", "colour": "#E301CC", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723892, "uuid": "40144416-fe91-4348-9bca-4fe472591deb", "comment": "Malware payload", "value": "8c42ca5a0f7a9b58904d1f1232dac8752be7250e4fb44c4934170eef398d2b9870c762796c4348740ea7b181d2bfb37d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7532", "colour": "#E301CC", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723892, "uuid": "3c97d5e8-859f-4df3-8b2f-096101f1bcf2", "value": "T1BE0733D81C6CC589D2D61EF4F2C227AFCF0E95D98B6698FA863729A7C0C9C540643C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723892, "uuid": "377543dc-f8fb-44e2-aafe-a5cf097bb9e1", "value": "393216:zTd1X753w3NsjJJuwzGo/TL/ON5iuZ7owQNvq/ywC/r:3ry3Fq//ONIuZfnqwC/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723892, "uuid": "9fb8f55c-56fe-43bb-9167-0702606d1f98", "value": 17273587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723892, "uuid": "344ff1a2-78e2-4dde-90c3-6049024bcc9b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723892, "uuid": "46eb7a1a-270a-4917-ae56-0600b8d13e5e", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20c9b9b-4653-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746044, "uuid": "15125c3b-b62a-4194-ad07-3c19f396c734", "comment": "Malware payload (Mirai)", "value": "62b9ea7a91743ea138583303a334f2aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746044, "uuid": "38f9d1e6-989d-4d3d-a5ed-a3811041ece7", "comment": "Malware payload (Mirai)", "value": "9e25d48ad9f5c244db3fe890cbe352e8e7f36ccb86a754528ce9495732a6fd74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746044, "uuid": "3979b741-fa56-47af-a4b6-acf0be1293a7", "comment": "Malware payload (Mirai)", "value": "e33bd9c05cf3ad7211ecec20fc3e43a1dc3b07b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746044, "uuid": "bce2159b-6535-4b94-a4de-e629ab50fae5", "comment": "Malware payload (Mirai)", "value": "e17b2b416513c7b92c831e8cc3b33fa55ad465d929e2d1b06d86c17397d86f65610a3c4512f195b3ac03aaeefa89be75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746044, "uuid": "26ad7c9e-3e50-43a0-a1aa-f4ea8a49d9d6", "value": "T11CF25C56FA83C4F6EC270570402BB36FE772E51A40B4C71AE73A9976E913110662B3BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746044, "uuid": "e5d27fe3-148a-403c-a2c0-d9f492577a5b", "value": "768:fZbiVrMvDQWPTRhIcMwPD7qEQjNVpjww3JipfBLlJpyARJ/FIa022IB:fZbiVrMvDQWbImPD7qjNnAXJRRt0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746044, "uuid": "ed576090-7e65-49b3-b0f9-48124a3ec606", "value": 34772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746044, "uuid": "3da7748c-8f84-4f8f-9096-30c8df839ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746044, "uuid": "636d9c6e-a688-4188-ae13-c84c731629e8", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6508461b-461e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723178, "uuid": "ae8cee76-5b7f-433a-b366-928ca247c9dc", "comment": "Malware payload", "value": "6b7a5723d4508a2098211ce2d7780124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723178, "uuid": "19a9f326-c6cf-45ca-a90b-ee5ed9321cc3", "comment": "Malware payload", "value": "9ed2ac431e1bc62f21499327c21f75155191aa6c0cc71eec0e48e54662a13dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723178, "uuid": "9e60f46e-4747-4161-a9eb-13cd2337f5ef", "comment": "Malware payload", "value": "3f1b8e77f8a93cdf150b973239de92756abbcf16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723178, "uuid": "d3640faf-ce3a-462f-8f89-ca618146ea5b", "comment": "Malware payload", "value": "79da918096759e7dce2d418b3f5ad0302be30fe55368b344f72ed65adb4b6acd7fb68bd13f7163afbb9fb05db54b0f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723178, "uuid": "cefaf40a-900c-4f1b-8b9c-f6fb04c09451", "value": "T1BFF19E0E9151E361F3AD47B624BF128E71C33EFC84D9679B45841111285AAC1AFACDDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723178, "uuid": "08c36b39-14ad-471f-a74b-1a2daf57f0bc", "value": "192:fMSnY2hzq3Rm4/XzW0CI73hTpWOltZZEaBHKEyTY06sEEVJFmCTjM:Pnzhzq3f/iY3hTp/ftBxniVJVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723178, "uuid": "4c280e0e-e23c-4a39-94fc-fb4cb1bfffc2", "value": 8096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723178, "uuid": "0fa6022c-2e49-48b8-a223-10310efc7b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723178, "uuid": "077daf17-263f-47f8-8b85-eef2b3d1a254", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3452cd30-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719231, "uuid": "9faa1edd-2726-4fd8-97f9-46ed19ecb750", "comment": "Malware payload (Mirai)", "value": "09a17402fbb4cbe28726f0bd9aa4c5f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719231, "uuid": "c9cdf69a-bd38-47bf-99fa-68eeffd5cb79", "comment": "Malware payload (Mirai)", "value": "9f9425fd7fd02f770332469a14f04cc983b632128c2c1d6ad2f089ceae975ab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719231, "uuid": "81c691d2-4a1a-4031-8503-36680c0fc6f3", "comment": "Malware payload (Mirai)", "value": "06d9c34f02d094161394908d279471b890cedafe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719231, "uuid": "dc07d7fc-998f-4bca-8b7e-876a5fa50495", "comment": "Malware payload (Mirai)", "value": "b4c984e506bba145ee88638ffc2fd21133f1fc150332c65a65231827ca69ff812104f644ce99a04d2e74cf69469feaa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719231, "uuid": "2c219ea3-56ae-4849-a5d6-2041671302fd", "value": "T18B13011D83A5BE71E2B2793D84D9464AFF1D4B34727A74893B6093F0D8C49E54BE3281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719231, "uuid": "1a2093a7-ed6d-4120-aca3-86a609066da5", "value": "768:8pZqOgAG3083+jToISVkqFTr2VSCti2MeJvzG4+j4zGz+qqPmndjVAs3UoDE:6qfAcbkU2zZMeNz5GSPmndjV1DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719231, "uuid": "bc043a5a-4f80-40d4-810b-a81d1fa25374", "value": 43480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719231, "uuid": "2ca033b1-7844-4196-9a1f-55e1ec543fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719231, "uuid": "0d5f9098-187d-45c0-aaba-1168d9473231", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d34bf5-45eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701114, "uuid": "4cff7391-dade-422b-b11d-758aee909120", "comment": "Malware payload (Mirai)", "value": "05594f080c387893a2f9bb040e895d50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701114, "uuid": "9db6ec7d-81b5-426b-a8be-308ca51daa44", "comment": "Malware payload (Mirai)", "value": "9fd3a1ef1f9b242850dac7e06aae37c00e153e7f1d616de57b94bc4550365e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701114, "uuid": "b4367560-463d-4e40-8d0a-19a0f4666fe2", "comment": "Malware payload (Mirai)", "value": "b8579c030c8b98d2772ec1380b57eda117893725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701114, "uuid": "e5ffc9c2-aaab-4d9c-86c9-c0753b7c9c28", "comment": "Malware payload (Mirai)", "value": "057b28f51cbb4f95d3c3b077537b623bc91c547735c88d22aea0dc1607ac0214cc009ee03f20c90512e057b08b93f849", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701114, "uuid": "81481b5d-932f-4823-a37e-ec33abf0b0ae", "value": "T1A5D41A0AAF540EFBD82FCD3706A91A1634CC645372963B3A3539D914BE5B90B89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701114, "uuid": "64124cf0-fe8a-4619-9ccb-318a269908c5", "value": "6144:o+6gjUzmoZ4dP3KsEoSI/YCU+Nw09z4+MoisFKPe+BHg2pTtfvDuyXrqmD:oTGLEo3YCU+94+DisMPrq2pTRqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701114, "uuid": "5830414f-73fb-4c34-ba5f-a55689ba2c6d", "value": 648204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701114, "uuid": "ce0fea7d-94d2-4ec9-894f-3244cd0fd2ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701114, "uuid": "3ddbd02d-2a49-4717-b3bb-2082fcf6a322", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79c2aa6-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724202, "uuid": "f28a5120-26c8-4717-92be-cc0948e48055", "comment": "Malware payload", "value": "d361af0c6cf40a67a65382f9c94a57a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724202, "uuid": "8f857f61-2774-4058-9231-2c358d829478", "comment": "Malware payload", "value": "a1773a96b9fb0e0bae91bfb1c8496bec3dc22ac57199a1b8cdfedff1463caa00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724202, "uuid": "2ff5bb8a-8e20-4e4b-98ff-338acd708e0d", "comment": "Malware payload", "value": "d22c781bde1ecd48637c35343f5ded9bcfd136e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724202, "uuid": "11819df4-fae2-4a05-a63e-bdac7e047b54", "comment": "Malware payload", "value": "8601fff700b326d387752ad8f01735e2da7cb24092500b573e9b8ba61a21ae3d66a0de447cb0d040897c3665ce6640a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724202, "uuid": "cd8b6931-3dcd-4ee9-8c28-43987a8741e1", "value": "T1F32833DF289F44FBDC804D749F0B1AE617B69E82E8428C3665D9354854F3F62602BAC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724202, "uuid": "eb096a25-d81b-4345-b0e5-28ab3fd35c76", "value": "bef1765298b9a91965863255b4278f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724202, "uuid": "3538952f-d028-43da-8ada-cee38a9bb70e", "value": "1572864:rdtd4OFU/JEMU2ifI2DqZnlDtCuRH3rrNU5II5+8L9iJzrTxaHHK:rvYEMUllDWXpRXrrNUb51kJzr1gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724202, "uuid": "fcd278d0-1bde-43ab-b182-af2256963f9f", "value": 98249216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724202, "uuid": "318e0bfa-a098-4ef1-8fde-a8b92ac1fb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724202, "uuid": "a8037da4-aaef-4955-b8a4-46e7dea7bb7d", "value": "Xeno-v.1.3.35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076026d7-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740630, "uuid": "f8a1b9e4-9bcf-4804-99e9-83a041756bc9", "comment": "Malware payload", "value": "de70c76d93a37ce64266fa3b5fd59a4a", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740630, "uuid": "755c218b-561e-4b40-b30c-a8ab6006f833", "comment": "Malware payload", "value": "a22937f74febea9ab8961ff74ee2a2157c9d82db892e82d9e912e28da984eab6", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740630, "uuid": "d6305ce3-7947-4d17-8e84-86a1e372756e", "comment": "Malware payload", "value": "bc286b4291c599e20b14d4160e967d2a900275a2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740630, "uuid": "65f635cc-abd9-49c7-8dcd-4dfb7fe6a577", "comment": "Malware payload", "value": "28244371480f0d11768b0432dfcfdfa9a876bd731b6269b3c972306606b52983aff14ce2ccb837be56c7d2c2fba585f6", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740630, "uuid": "3f355543-f001-42f9-a5d1-21e24c95ed47", "value": "T1F146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740630, "uuid": "92d20211-1360-4d06-9d3c-fe5496797d27", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740630, "uuid": "0749072c-c514-4797-baa3-46f2eaadd78d", "value": "49152:zfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:Hqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740630, "uuid": "f23cbb6c-601b-4b1e-9ce9-64c88745515e", "value": 5648984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740630, "uuid": "75d4a1c8-9deb-42f6-b5b9-efae5472f78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740630, "uuid": "3b7e318e-d062-45b9-8305-d960a4c24622", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345826b7-45dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694749, "uuid": "97be83b8-4d67-4a97-9b73-e3bd16f38297", "comment": "Malware payload (Mirai)", "value": "e8c2e1877cef2d29757b555792391dbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694749, "uuid": "58207f85-1795-47fe-85c7-18af6f57364d", "comment": "Malware payload (Mirai)", "value": "a234551e5242266eaf041afa0d68904d701d8ac3275abc8471945d30b38460b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694749, "uuid": "045561a9-1889-4111-8311-32fb67407c3b", "comment": "Malware payload (Mirai)", "value": "aeff603d364bc80078f4409638646dc8d33ba2f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694749, "uuid": "52a53c2a-f664-48d2-ba64-c5181200937d", "comment": "Malware payload (Mirai)", "value": "571fa6b69abf6fa02db0064dc2b83501e286c4765678590402791b50fc6b2a3b523c83855973dfc2056e10b8cf954978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694749, "uuid": "68443ca4-301a-4aa3-8625-b6af0e103de1", "value": "T1ECA30946B9419F02D4D621FAFBAE418933536FB8E3EA7101DD205F5423C69DB0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694749, "uuid": "2588ecd3-193b-4c8b-9f7b-d04ee8ad023e", "value": "3072:2NIEdm1o8jvma+cTlW3C0T4B04IVDy4puv:umqEea+cTlW3L4B0RNUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694749, "uuid": "9314ba0e-72d9-42e9-931e-5f83ebef80ae", "value": 104008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694749, "uuid": "5210a9d4-f99e-42e6-a927-3ae4b5aeae89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694749, "uuid": "a89e49fd-de1b-4240-8f64-6d0ab3aa8503", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff63b94-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736645, "uuid": "1aa46f61-49dd-48a3-be82-f425c0bbc319", "comment": "Malware payload (Mirai)", "value": "310d363ff222ee349948cb52f2e83741", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736645, "uuid": "2f2a80c2-a732-4677-b45f-b84976664ccd", "comment": "Malware payload (Mirai)", "value": "a39b9ca61cb94cecdb77632ed54c26e69626d3569f1ff04956de52f51db2474e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736645, "uuid": "516336d1-3123-4ed1-9b67-9a86695a68a4", "comment": "Malware payload (Mirai)", "value": "fac2c17a415287e6de8897c5dabdeea79af57772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736645, "uuid": "ad883ecc-359a-4b66-90bf-f0f7c7ccd912", "comment": "Malware payload (Mirai)", "value": "f510c692636db662fd88051d1a4c5d5a73eca7fb008b59de536aad948a502f84e3d3ec012b5025ad1cfc6ed9c8eb03ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736645, "uuid": "09a723e2-3b92-4e83-9b0c-2435144ce2ed", "value": "T1F8D34B46FA418A13C4D513BABAAF41493332D7A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736645, "uuid": "151fb3d8-6021-4fc4-9f65-0bfa4a3fe18d", "value": "3072:5KacBqVuJVkWH/IOPZoxNOqMP0wctzHnBPF+84/M/92L18Yj:kacBQuJVkWfIOaxNOqMPVoJF+8MM/9Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736645, "uuid": "3b23d360-7a71-4e73-93e4-8213b69cb163", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736645, "uuid": "04cfc89a-59dd-4641-9039-6fc34feb0696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736645, "uuid": "9921a132-0e07-4c6e-8921-e67c776c8e90", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d4bda9-463d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736326, "uuid": "73c1e59a-62c9-4ae0-af0c-6c251afbf78d", "comment": "Malware payload", "value": "8b0f099ae516a6d932362ad44864e383", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736326, "uuid": "77c068a5-55af-4f70-acf5-62cf485aea9e", "comment": "Malware payload", "value": "a3c020ff73a6ee9d729c12de1126e24e069cef0b4fe9d7652ecf6481e88554cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736326, "uuid": "ff574d24-b7ed-4949-b8eb-967550ec9339", "comment": "Malware payload", "value": "63b7ac6c32ea844ba9a52f02df5206f87818a106", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736326, "uuid": "80d1709b-b202-4cb3-8fe0-ceedaffe1b95", "comment": "Malware payload", "value": "8d02ce10f8dd1500761aa42b642e91f5fda0180717b556215cc9fa61bb505a3516ffa2fe3ba89958762036680696bc09", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736326, "uuid": "2286045e-7faf-402f-9661-a7a7cb35180e", "value": "T1C7E0E5C5D1C4B043E5AAFA94BB79E28CA10452D754FE2F1ECE413860DD88860F157702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736326, "uuid": "6b111be1-5e24-4dfb-a729-25ec7562cb4e", "value": "12:OGG6fPa96fP26fP16fPz6fPl6fPv6fP+6fPBD1cEHxn:I+y9+u+t+b+N+3+2+JGEHxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736326, "uuid": "65324837-21af-444b-9b99-440674576f12", "value": 411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736326, "uuid": "ef0fbcf2-d270-40d7-a0da-6545751c8db9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736326, "uuid": "dfb21780-9e09-470a-9658-52e52fd8a7f3", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fb4b83-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734915, "uuid": "85bc1394-6135-4708-9efe-bcfcc2b62b34", "comment": "Malware payload (Mirai)", "value": "7296ded61eab5e1d199d7f641f26b57a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734915, "uuid": "20d73434-b1ae-4518-a0c0-e3e33110c719", "comment": "Malware payload (Mirai)", "value": "a3ddbee26594af0e9c32a8bfc4b89cc8fef1305bb889128c3fb8f5fa95ba05d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734915, "uuid": "e79d3a26-7e8c-4599-9ce1-62496484b944", "comment": "Malware payload (Mirai)", "value": "44e8fdb92281fafed659969c4d4a54f8fee74487", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734915, "uuid": "9a99134a-490e-46bd-abea-6fa2e6436324", "comment": "Malware payload (Mirai)", "value": "74c3b2784348b97636d3241a83acec9e08c233f58be0cb108d1e0afe603897e68998f8cc828855ff903ceb317c2dc11f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734915, "uuid": "c3fcaebf-9944-481f-b438-e7bb93b7726b", "value": "T1E5E56E626787DCAFF7A903B50AF389B4B3E8A45231B5CDA1C36F76061F251A4450DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734915, "uuid": "df08e75c-9af2-49a9-8e63-2d87e08a7708", "value": "49152:h/vF9T8qr/5rRRfkNsrdVTY5qipGkPP/Cr:5rRRfkNsrdVTY5qKGkfCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734915, "uuid": "908f1229-9b2a-48cc-b8f7-7087961bb519", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734915, "uuid": "e8a41a7a-a078-49e6-be33-cf1d9c8a4c50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734915, "uuid": "ecbe4297-6293-4c56-a1af-5166f8bf671b", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe30066-4629-11f1-a769-42010a9c0008", "comment": "Malware payload (Pony)", "timestamp": 1777728082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728082, "uuid": "0c4cdc4c-8825-45be-9763-17cca23f28de", "comment": "Malware payload (Pony)", "value": "a9d3e959c8c31c35f62a8408a6a05bcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "flcr-eu-cc", "colour": "#C890D1", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728082, "uuid": "b565750d-6e4e-4d82-8e53-b569b5a8b235", "comment": "Malware payload (Pony)", "value": "a53a03026dd4efe462769a6e8d648454efcf53d40eb765bae506249baf4d74c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "flcr-eu-cc", "colour": "#C890D1", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728082, "uuid": "72ec9113-edb6-4995-830a-5fab41761bdf", "comment": "Malware payload (Pony)", "value": "c8e424d68c2b0559382b11388704e55af6bfbc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "flcr-eu-cc", "colour": "#C890D1", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728082, "uuid": "e5a6a6eb-9d9f-4942-82a6-c35c550cf929", "comment": "Malware payload (Pony)", "value": "ee5219b016d097dff250943e3897252f6b143b77b5fb802802bb5d072d693186e018eb341b429376519c95240dfa7814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fareit", "colour": "#F9D67F", "exportable": true, "hide_tag": false }, { "name": "flcr-eu-cc", "colour": "#C890D1", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728082, "uuid": "bff8a66d-7260-45e6-9240-d2bd64f75256", "value": "T18DA31903F881E0F1C5A2177237C16771E3FD9D79BC768D4AEF8D6845A9B2687AB12402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728082, "uuid": "5f698d64-dbbb-4b9c-a61b-b0f6f28e67b0", "value": "085f942c74d09a78dcd2b95a4c1c7441", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728082, "uuid": "24a365b6-cf8f-4a0c-83d8-0075072a4424", "value": "1536:vt8UEN3YqiqTLEcW+L9gs2rS+TTYz52kqnjQXyAOrc6neTvmkzbklql/2fqh:Ch1H1W9+eNkdOrDno0ql/2fqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777728082, "uuid": "9666d838-9dcd-4b1c-bfbd-faa32eb6f7fe", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777728082, "uuid": "571dd89d-b698-4e53-8a61-ab7a293a9eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728082, "uuid": "11641af5-397e-4e3a-9a04-2e347f561570", "value": "key.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9dc68a-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777682762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682762, "uuid": "9caab3cb-5976-4ab5-94d8-13ed12ef64f5", "comment": "Malware payload (Mirai)", "value": "67288ce8b7316ef191fbfe10f7e71c45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682762, "uuid": "5a9a3ab6-4150-4c04-8736-86329bdc844c", "comment": "Malware payload (Mirai)", "value": "a5545ea4597ab1d9f82fc172e2062a2d395d7d4ecb0a25dda6957c40e0d2e75d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682762, "uuid": "041ac33b-e12f-4d06-8c12-4301b8579a0d", "comment": "Malware payload (Mirai)", "value": "e84aad22ef3bef3ed1f9e5afabcd7b7bb47315ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682762, "uuid": "2bdae060-380b-439e-86f9-cdae01c23f4d", "comment": "Malware payload (Mirai)", "value": "38035e29318d03846d9d3f2d4bb91324466d97006d6124d29bb96abaacbd269c96e99b80489dac2e431fe4ea35f82b21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682762, "uuid": "821db5e5-95e4-4c77-9422-bc8d0f6fd1a3", "value": "T149E33942731C0A47D2632EF4363F27E093EFDAD121E4F644255F9A8A91B1E32554AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682762, "uuid": "982b4e0f-18cf-4ecc-bfe8-a11f4942b3f3", "value": "1536:GjLsyLCvtT0caK99ntfxfSHUujbs4w/n+D91/jN1vA5RHLKAJPatqpelPIX:Gj3AJV3ntfx1uk5+R1/RC5MwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682762, "uuid": "d7d3e16c-3256-49e6-b62c-af46797b2402", "value": 150420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682762, "uuid": "cd146fb1-7ae0-4894-9699-3e368c8bc25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682762, "uuid": "2768ef3f-5f2b-423e-a945-04d5c071aecb", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bd7b79-4657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777747880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747880, "uuid": "bc21c5ff-858e-47a9-ae64-486b71f15035", "comment": "Malware payload (Mirai)", "value": "ad02d002b0df79c1597faeed024cefd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747880, "uuid": "56f694bf-7606-4fc5-93ef-75a692221453", "comment": "Malware payload (Mirai)", "value": "a568d99f50dbdc266f7826d2283e278e2027cbebd2ecfbb3f0ffd802e90296e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747880, "uuid": "578e9623-6250-430d-8223-6735fe427fde", "comment": "Malware payload (Mirai)", "value": "ae35cd34262a079055fb0b94967803d4d7f70311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747880, "uuid": "39f90473-ee51-4404-9ec8-7359747f0e2f", "comment": "Malware payload (Mirai)", "value": "85cd7f5af2a5c8396af2bd6a79fe6bd4dd81e76d95f1c292617276f72ba296d774ada36e335ee8d9803902d24a01a18f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747880, "uuid": "ee7dd039-c1ac-4c67-8a14-6b4ad6ee5f5b", "value": "T1402439027B0D0E07D1532EF0263B1BE04BAFEDA128B5E680755EBEC55271DF22589A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747880, "uuid": "0642314b-0480-4bdd-bf3e-56fde49037ba", "value": "3072:HqWQa5P+NVoClxhrnpkZytDx0lzJqiTOY37zZIozjrwnGcfCML1:HxWVoCdnWMtDxmJqiTOYLzhj8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747880, "uuid": "f8e82877-9f85-49c8-9a91-e16defbded8a", "value": 217844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747880, "uuid": "0f2aa503-3413-4521-88b2-53c3904771cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747880, "uuid": "40394ec7-1537-4611-b90f-0efbbe1656aa", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b1c691-467f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777764912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764912, "uuid": "e2b750a5-a17f-432f-a64e-165d5b1bdba8", "comment": "Malware payload", "value": "88ba6a0e24299995bf8d3ae325132f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764912, "uuid": "33abba14-3f7e-4ab5-ae51-254c32ad8c3b", "comment": "Malware payload", "value": "a5919d359b3f5994d091a6deec6c436860a7fcc1503903ef53a68bbcc279e78f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764912, "uuid": "eabdbab6-af86-492c-ab4b-13fc8279ecc1", "comment": "Malware payload", "value": "1dedd057dfa65e24a83b7afd9a57acf1124d0bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764912, "uuid": "65808cf7-00ea-4967-a9a7-3d78e2be3132", "comment": "Malware payload", "value": "8f2c386a999d12a66fb5bf9860fbb9d20a0dc12f9317b9f1e70541b90ad28ec6926eb7783a26cf3b49cdc09d181d9baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764912, "uuid": "2f519240-b3ce-46b4-877f-c1803e6320ea", "value": "T1F017BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764912, "uuid": "8eaf2daa-411f-4c36-934c-668cdd8ff5c9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ5:cqYUQuVDt0TZEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777764912, "uuid": "b65934ca-cd45-44e0-b6f6-8a288152211c", "value": 19496960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777764912, "uuid": "6624d0f5-f69f-4b8d-a861-ec25c96af602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764912, "uuid": "b06c3c4f-a559-49c2-9471-aa22a12a234c", "value": "a5919d359b3f5994d091a6deec6c436860a7fcc1503903ef53a68bbcc279e78f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904d73f4-4653-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746014, "uuid": "7344968b-b265-4df6-b385-ff883e87a625", "comment": "Malware payload (Mirai)", "value": "00cf314f612706f1e880698f5e10490c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746014, "uuid": "e3db2599-01f5-461a-bf6c-e6630d4d39b1", "comment": "Malware payload (Mirai)", "value": "a5b0b31676cc0301e5e7b466b2b300977bc62b534a620bdb05877b99519baf5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746014, "uuid": "2c57b49c-0d2c-4efa-822c-fdc19fe7f38a", "comment": "Malware payload (Mirai)", "value": "317efaccb79611c664b8cf48c78f3397761d66cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746014, "uuid": "78c4134b-bfff-4f01-9a75-11f26bc0591e", "comment": "Malware payload (Mirai)", "value": "0f06418313845dbd1b8256b76ad09a0943592836900ccd084780b2923d1869aa6163862aa1e7769b3f988cf2b3d60b48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746014, "uuid": "e8547fc3-a750-4734-bfea-4a9971af74ff", "value": "T120A2D05885C0828ACC02233F92AF3A6D50E34C5BDB47F55235E64A84B0F55E297FED68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746014, "uuid": "1eb85c78-670f-457d-9883-5a73685d30c9", "value": "384:MEuDVPXJ84gTUkRO2wiPpxvM8Yi8ryJVxYUA/J699Pwru/d5e/Yk41r6xJLoQpHX:pMBXyvUkUO7/8rW/A/JGou/e/vUrOBo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746014, "uuid": "46032f89-ad26-4c32-8102-40d3cac01228", "value": 22220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746014, "uuid": "36c802a2-22f9-481a-8ee5-16cdbee5248e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746014, "uuid": "d1bf0e19-3b53-412e-83d7-18831a6fab91", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9a79aa-4659-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777748536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748536, "uuid": "c2c72a35-ba49-4cb0-a1bd-aae52550ea74", "comment": "Malware payload (Mirai)", "value": "cab142d62f210616bcd32957c85e81f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748536, "uuid": "6da16783-b7f0-4c2d-bea0-2d67363b48ba", "comment": "Malware payload (Mirai)", "value": "a5e7c269d1ea72deabc9af437c777bee482f792ae79b4fa7a889d3a302dd227e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748536, "uuid": "23e6eb14-26a7-49d2-8b6b-0fd7c1868567", "comment": "Malware payload (Mirai)", "value": "ed734274d7fb88bdee83f728d5bcbabd313170f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777748536, "uuid": "255a3392-ad3a-4e61-8923-8c36d04f8ddd", "comment": "Malware payload (Mirai)", "value": "0f597c32f0cc818759aec3ba519fc56601007994b595fdc738cad9ef56b7e3e9a9e40112faeeda7d0019512dc90a04c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748536, "uuid": "3a295ab5-2963-4bc3-99b9-d7790000ddb7", "value": "T1F6142C45BA43CEF3E51304F011B7963E0B30ED3A4826D599EB68BEB4D637AC162157AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748536, "uuid": "cc4ad6cd-9a5c-4acf-8d89-0d83863d61e8", "value": "3072:6EiSTK4eSqV34Uux2ZBO6Llpvh96xKTUdDtXqaholpki:6BSTKGAbBNx4PXqawki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777748536, "uuid": "61be11c1-e5e8-4725-9ed4-b77b7396e6d8", "value": 192996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777748536, "uuid": "cbb0df79-954e-4cbd-9361-eeddf587c5da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777748536, "uuid": "17688055-f167-4ca9-a6de-e1a601b356d7", "value": "bin.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbf5e79-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694629, "uuid": "927817c1-ace6-4a2a-85e6-4519c44f2e49", "comment": "Malware payload (Mirai)", "value": "110dc28acd943e1a0f7819959e1ff1ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694629, "uuid": "4623347e-c38c-4512-b21c-0b9f35ed801e", "comment": "Malware payload (Mirai)", "value": "a66ffba0c49a31030475d446b197bda2db206b1d37fd3454e77b7ca99db59730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694629, "uuid": "a1ea914f-be8e-49b7-b84c-2384c50a80cc", "comment": "Malware payload (Mirai)", "value": "ee4a7b008b97e826bdf4c903aba113d97831d656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694629, "uuid": "0086e981-52fa-49fb-b280-42ce6540a3c4", "comment": "Malware payload (Mirai)", "value": "601d4150292616eda66e066975da9e74e217521c38e1ac47b1efde7ec9b37dbc8d142d863f23cb57d1f86e0f472b0da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694629, "uuid": "5de9bb15-7f43-4a71-892e-fa7f10fb0f6d", "value": "T1B683F842BD819F13C5D212F6FBAF01893716ABACD6EB3242D825BF5037868DB0D67251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694629, "uuid": "7088a78b-afdb-446d-80ab-f361bbd86c1a", "value": "1536:byhgdl7NFYnI5M6I/MMBl2sNPSdkDRH1+bgDqxIjvR4e:btdl7NFtvlMRHrmyR4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694629, "uuid": "10f0ce7f-501e-490d-8239-ff1b07011522", "value": 82768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694629, "uuid": "fc6d00bb-491a-4553-a71c-4acc695b40f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694629, "uuid": "29644255-e6f0-41cc-aa01-9b7b9b67b6f8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09232237-461d-11f1-a769-42010a9c0008", "comment": "Malware payload (XenoRAT)", "timestamp": 1777722594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722594, "uuid": "e753e584-b747-45bd-b651-2bd7ec8e5ed4", "comment": "Malware payload (XenoRAT)", "value": "4f3e0d90354cd0612f660d685825f3fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722594, "uuid": "2de1b623-438d-4f55-8c01-5348014af27e", "comment": "Malware payload (XenoRAT)", "value": "a87cf0954145c8c8d0188af89ce197df0621f34e85ab7f7d78da808b124c8a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722594, "uuid": "8174a54b-37bb-4d61-a254-9eb918dc0052", "comment": "Malware payload (XenoRAT)", "value": "2551777e7bcb2499ae73e4b10efa505773725fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722594, "uuid": "43f5f702-bd05-4b6b-ace9-0c8943a0680a", "comment": "Malware payload (XenoRAT)", "value": "9aad7fb26589c8f15170535caacb6218acf4d69774f09006997be1f9aebc8592a417aaa424442f2417322b3f6a55e62b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722594, "uuid": "2918a883-f83d-457e-9319-036ef30a8c07", "value": "T16084F1927A9CC773ED655AFE5427489A1373BC3BC960F19934DC22E827833E24922753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722594, "uuid": "c7ddf675-4c99-4851-bae5-dcfa27f7efc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722594, "uuid": "d9ebfdbd-75c0-466f-803f-b09b0cb18bb1", "value": "6144:ef2aOVO3YIbwyUqo1mboOD1/Wz/L/GKizOP1H2Eb0WJqkdG:ef2aOwIFym1qm/L/GKhPl2aJqkdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722594, "uuid": "f94a19d5-42e8-44b6-b8a8-a013088c9250", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722594, "uuid": "026ccf97-8647-48f1-8451-7aaca9f9769e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722594, "uuid": "d698f36a-e482-488d-886c-38403eccd3e8", "value": "UpdateWindowns.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a649662-4650-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744608, "uuid": "5d3654b9-c022-441e-8fb1-71eb70880e4a", "comment": "Malware payload", "value": "82262bb8e4c9e25a8af2a1af914234ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744608, "uuid": "ecf3cb03-d3db-4421-ba69-eb88aa8c5943", "comment": "Malware payload", "value": "a8af991184271d7210c431a5cb5497da0e12aead34b9532772c7e4d1a06c4f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744608, "uuid": "d6b0426f-f646-428d-aa51-cb6c76dc869b", "comment": "Malware payload", "value": "7a3782f4787301f875c61e2d0aa62b57335d472d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744608, "uuid": "1170f866-ffc0-49d9-8f0d-4fcc92cdafd5", "comment": "Malware payload", "value": "34d149eaa8351827ee7d6ea15861f55f08d3335dbdd69f5e58a79f3d8ef0ea318859c6aea7711792a22dbe47595ffd14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744608, "uuid": "44e6102e-bb39-43af-82cf-c6dcc92aa3b0", "value": "T197F176C46992912AC3E84EB77F1F87CD336297DAD1DF271BC53CC9183C1A68A9E15A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744608, "uuid": "0066b1bb-6073-4cd9-a528-8deef4aac778", "value": "96:yBdpRShqhwsd519w2FJWe/4Z8O7//ccZ7FNLGYLvmLPkzV1BdLBnnlMc:mdbSIhwavWx1nJ7rLKcLBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744608, "uuid": "60a6be4d-7ab4-4eb0-bd29-61bb216163e0", "value": 7916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744608, "uuid": "4a170503-6b0a-422a-904d-76530e1e2f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744608, "uuid": "e692812c-7f7c-473d-98fb-7c8d2039a17a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f515eb-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743305, "uuid": "93047956-9092-4f60-a949-ce1dd950fd80", "comment": "Malware payload (ConnectWise)", "value": "18ecea4c24ed68b62d2ee80ea3f0b5d9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743305, "uuid": "884188b1-d095-4a14-8074-5e169eda92dd", "comment": "Malware payload (ConnectWise)", "value": "abaec16760d2ba25d78fbe1e7212607dd6c06963c885f58fc783e90f1366880e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743305, "uuid": "cdc79988-1fa9-45fb-a61a-7f6c691f588e", "comment": "Malware payload (ConnectWise)", "value": "10693581bcdc75ff7c6055266bb4e719522c10b9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743305, "uuid": "09c28efb-3e36-449d-b1fc-f7b6a793aa0a", "comment": "Malware payload (ConnectWise)", "value": "5134c5bda607beab1d4e23b9ed2f9133d277d6b6e2811c791f8f85af728dda33c26382c87c8372f21257c8cf1b9ad145", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743305, "uuid": "18a9fed2-32cd-4a3b-ba76-fe3ed8179443", "value": "T12946F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743305, "uuid": "8d8781c0-7108-4d57-9a7e-20adbbb6f73a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743305, "uuid": "d55e1287-8f11-4206-bf18-b044257c8901", "value": "49152:HfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:bqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743305, "uuid": "6ac13664-35ba-47db-b068-565b3cc2541a", "value": 5654192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743305, "uuid": "daa1c047-f467-453d-991f-9dd3eda85177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743305, "uuid": "53896b86-1dc8-4860-8d9c-a77c70815151", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0234247-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736296, "uuid": "ef42d964-063c-4ca4-94d3-7470046cd38b", "comment": "Malware payload (Mirai)", "value": "366e88983fdc3a2fc2624afad8ad6c40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736296, "uuid": "96062576-5c77-4d83-a799-c297426267e6", "comment": "Malware payload (Mirai)", "value": "adb81bbaeed04a9b0026d6521d6639452a83af1b0286ea129da7f5edae1dcb99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736296, "uuid": "85d4ba34-b81d-451d-80f4-fbb1984100b5", "comment": "Malware payload (Mirai)", "value": "abdb0a26bf53872dedc87159040ca5136d11d520", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736296, "uuid": "110d8c55-9719-442e-a34a-5c333c42bf93", "comment": "Malware payload (Mirai)", "value": "30e88ad05c1295406e6e6d407221b4eb19d600b5cc26d190f893e81ce60b2e1735fe6aff4dab6be1790898e6b821abf8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736296, "uuid": "18f9eac7-5bea-4760-b93e-d17a3c25c2ce", "value": "T196930C46A9528E12C5C212BEFAAF415D33136F7CD3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736296, "uuid": "7cb8aeae-d8a4-4b5d-bfea-c543c34a3096", "value": "1536:870nOhjxCMMJEl3EVupOFnjRfGqtCMPc5pyHtLoY08ivJa2RPk0aDQOiFYgNf65J:mtCxEqVupOFntfGqtCl5gHZo6ivJa26P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736296, "uuid": "25cd7ae2-4575-4c92-bb5f-484908edb378", "value": 96872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736296, "uuid": "c3d840d5-c52e-47f0-a7be-2ff77cca7aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736296, "uuid": "59ab4e14-a071-43e9-855a-8d4f0055dab3", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76520432-45e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777699155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699155, "uuid": "8b3a8476-505b-4b0d-bdf4-0c80489eed5f", "comment": "Malware payload", "value": "1c17e11eeaa80086b85bac013de52b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699155, "uuid": "26a141a4-e8bc-4272-b12c-b2022a4d49a0", "comment": "Malware payload", "value": "ae37c07530869690c91d4a4ba789a624f0576d4a2cc7b9d3c4a126347a55bff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699155, "uuid": "94a0c9bf-050a-4fea-89bf-93aa39163e4a", "comment": "Malware payload", "value": "501275f701fc15a3e690dd4bd14f896b29c2d573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699155, "uuid": "61c6c177-df6e-4050-a247-5a6b3f99f9b2", "comment": "Malware payload", "value": "8e3f63cff2ac211f21cf0b98ef3b815e8c305f071d66d89b4be85cb7767340548922acc8434ac6e0ed8a84c845292d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699155, "uuid": "01ad2572-234b-4427-8c0a-0ecc90bddd3a", "value": "T14823E70437FA4111F1BF4AB94DB196119B31B8A79C23D78E06D5058E1AB3B80DEA8F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699155, "uuid": "97d51d14-6b40-4a81-852e-707b1862bfb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699155, "uuid": "9a89df21-96d5-4ba6-b1f5-c6973aa7d61c", "value": "768:Zhe8o8qjjHA+eeb6fsVd4U//w4BC1XXGblfA0fKFcQ:XovA+eJUQ4BEXGblf9fucQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777699155, "uuid": "75f5d3f6-8327-4f8e-b4ec-a75b3ed95a22", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777699155, "uuid": "9f3b985f-58c3-415e-b1ec-4e009eb5b79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699155, "uuid": "71355276-c014-4dd7-a3f6-725543018e1e", "value": "chromess.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa613a5a-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704960, "uuid": "aade3982-82ed-45d8-9939-8261c1f56c99", "comment": "Malware payload (Gafgyt)", "value": "93a10075e2a3095654d76df534c8b023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704960, "uuid": "fa3f5fb3-5276-477d-84e2-a7f3800e655a", "comment": "Malware payload (Gafgyt)", "value": "ae7b5606014ae8b0dddba843031151944f85cf6ec820825cc3e1404e1e0a4c99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704960, "uuid": "33cb05bb-e695-42a2-8b29-30b4dfd43bf8", "comment": "Malware payload (Gafgyt)", "value": "850002e00f7e27b91af00b2b06eb9a88853e4ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704960, "uuid": "025c9182-0bd5-4889-9150-2ef667516016", "comment": "Malware payload (Gafgyt)", "value": "156942d1be0e117758d5cd6e291e9fb01daae7e16b512a19b7a0c5ebcbcb1b0445def36cc8ac619fe5c96f4209a41b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704960, "uuid": "06054e4d-8c3b-46d6-95b1-81b91f69ecf0", "value": "T102E3871A7E21DF7FF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704960, "uuid": "8b2b65e5-0e64-4616-ad6a-e4fa4528c92b", "value": "3072:s7iL2tEmEh02tKMMHqVteriAAwqIcq88Ek32oQKqqc5hspvC:s7iJmEh02tKMMHqVteri+Z3Bbzq95h4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704960, "uuid": "97a66149-dbb7-401f-8bcf-f263c28d8461", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704960, "uuid": "c92e6e64-b151-4089-8629-7d195e552821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704960, "uuid": "f83afce2-8278-4868-9725-751ad6909465", "value": "mps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bfab46-4621-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724622, "uuid": "88e7c2b1-d0fb-4c4f-806f-ee5bea551252", "comment": "Malware payload", "value": "d7997b33ede2980ae250a63670787814", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724622, "uuid": "7b99ffb4-fc74-46d2-8252-e9fcf1262c10", "comment": "Malware payload", "value": "aedd813c45bf62ec529016d78a984aededdbea86f249cac2340dbe8b0144b00b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724622, "uuid": "fb2292a9-3734-4b41-8c62-1e6d6d2c2036", "comment": "Malware payload", "value": "a891c03888e4f9722a7e2686b01d2bc9e23690f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724622, "uuid": "1f5d93df-01ef-466c-9e4d-2f6197b3e9df", "comment": "Malware payload", "value": "0603351b55aca2dc0144905e166cd682c18e21503217574e4cf700fea81142cef3f7524b27d2785beb9306c01090ce4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724622, "uuid": "d032a286-47eb-4393-9992-743b10d8a5e9", "value": "T173137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724622, "uuid": "a3b099f8-f26b-4dc8-89c2-dc9d73e0c174", "value": "768:bQ+79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bQ+Mcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724622, "uuid": "e9a0b6de-14d8-4774-af48-22f6f368f2de", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724622, "uuid": "56f55040-3c79-4846-8ce1-b6d40b45d5aa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724622, "uuid": "f3f63180-5537-4600-9b83-aef880210d5f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895ac5c8-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741707, "uuid": "0db48c90-1022-4248-93fa-d2f8b32fb00b", "comment": "Malware payload (ConnectWise)", "value": "793e863fa495398aa0044e721e610e3d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741707, "uuid": "67d4f951-a1f4-4619-8719-a35ec09923b4", "comment": "Malware payload (ConnectWise)", "value": "b07ea7142ba8593673aa56024912d1ef9a9593ced0d08bdc35d8d6543738bc1d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741707, "uuid": "e6dfd005-8a0d-4200-a5bb-f26e0a64080c", "comment": "Malware payload (ConnectWise)", "value": "883d473fecddab780e4dfc8b2ffa81e6733ce84d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741707, "uuid": "a05cd5c4-ad46-436d-9972-f5f577b5eff3", "comment": "Malware payload (ConnectWise)", "value": "15fa34797ae045667014614d84c24a50ec67f2d160ff1e7cf1b717b722df6a13be88e9a7c123e6b096f3fc043cb89785", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741707, "uuid": "55c6554f-d8c2-482c-8715-8b7074ae5537", "value": "T18546E021B3D995B6D17F0678D87A82A99A74BC044711C7EF5394BE3D2D32FC04A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741707, "uuid": "544a4182-bd3a-4c95-893c-8f481ad0a922", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741707, "uuid": "493e1a39-1189-49b3-b1d4-545ac91bc586", "value": "49152:WEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:TEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741707, "uuid": "fc71074f-0c46-4e2e-acd5-2dd6efa57882", "value": 5837944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741707, "uuid": "58ce9f41-00ea-4174-86f8-82bcf76f5d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741707, "uuid": "2794682c-a26a-43f1-906c-1721143da31b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5d7a48-45bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777682633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682633, "uuid": "9fa4fb84-d4f4-4cb3-8024-2f88edf4922f", "comment": "Malware payload", "value": "eaa38fb3f16d7fbbce630a472f1a6bbb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682633, "uuid": "c9383fa7-56ed-4f4d-8d22-9d242c85a34d", "comment": "Malware payload", "value": "b1ea0ed5b4fecc144c70701179af8e6fecd694dc60bc6e430d06bd8b231f9636", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682633, "uuid": "8a611363-d9ca-4139-a95a-c41846bb3aa0", "comment": "Malware payload", "value": "985731baedbcf29afcaa8193e7d77169820fe513", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682633, "uuid": "ca1aa9d2-ef1a-4b8f-baee-a78d9a178f3e", "comment": "Malware payload", "value": "1f751df10c27eed9eb332abc39213e71d03db61dad3d064e3c30650756f359fea8a08179ef4df83a8fe6d3594cad94be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682633, "uuid": "082a787b-7be0-435c-b133-5ca81291bcb3", "value": "T10F137D6966817C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C4979CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682633, "uuid": "a94186bb-cce6-4832-981f-063aaa2ccf0d", "value": "768:bl+69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bl+vcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682633, "uuid": "4a92d557-3e8f-42df-b95b-a3348102476a", "value": 45445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682633, "uuid": "e68d76ff-0565-408d-859e-6fe54bb46c08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682633, "uuid": "df042a15-301c-468b-a162-a89f76b676a2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a87cbe-4624-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777725831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725831, "uuid": "ae6b2d41-a4ad-4670-b7da-4f8911417598", "comment": "Malware payload", "value": "b4ba3ea1824f0da1dd78dd3a16547dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725831, "uuid": "aeb2eff0-424f-4630-a58a-86315cbca575", "comment": "Malware payload", "value": "b227c4ce8cbb1ba0592e7aa629f585300256a79f79fd7ebb224c732f06b5ecdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725831, "uuid": "f693436a-9500-457f-a781-35457b3da852", "comment": "Malware payload", "value": "0f38a99562ea48276dcfc93890bd46d79ab4b02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777725831, "uuid": "2d7beb16-e49b-4999-8728-c593dbc30352", "comment": "Malware payload", "value": "cd7f0743569e9228bb04fdb4f877d855a3467af50ab3c3468d5109d0a6adeac4bcc7edf243de6e91137948e4b7eae905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725831, "uuid": "de12630c-ae3a-4d8a-ad8e-b8acb781faca", "value": "T1EDE23986669364ECE915C63EC2632233E672F8611B6099EF03E285763DA5FE0173CDC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725831, "uuid": "a9405f0b-d066-42ad-9f3a-92f8f79e6fa5", "value": "98123a6508471ab1c8d80fe97982924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725831, "uuid": "2b802574-e176-44ab-91e3-b2fa58f1f0e2", "value": "384:ePQPR2L+ijoCWAdqRqvgt0pAfqbFx3StAYzIdTKZ/+Gc/Ue:e7r+JIgupzxStAYzcKZ/O/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777725831, "uuid": "f2225d3b-9b2c-40b9-a6e1-2469796ba116", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777725831, "uuid": "a508c97e-62c7-46e0-a875-9d52eb9a2ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777725831, "uuid": "2dfdb872-bdee-4a75-9947-97391aefb68b", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1c1c87-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719222, "uuid": "0624aebc-31cb-456f-b8d4-1cd9b45dabda", "comment": "Malware payload (Mirai)", "value": "5ece34c61db7090e1c9590bd7bafc4a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719222, "uuid": "c300a619-4ab3-41d3-b673-3b9b14b71e40", "comment": "Malware payload (Mirai)", "value": "b3470a0a8e58d4779bbf31995063f522804a6618cbc0537fe5b7b09bc84e76fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719222, "uuid": "61ad51b8-33c7-4aa6-a779-d02cd9b1eed6", "comment": "Malware payload (Mirai)", "value": "bdb10076c4580417ffb217201df704520c2c6e55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719222, "uuid": "b1d938b9-c3c4-420c-bb5a-7b786210cd07", "comment": "Malware payload (Mirai)", "value": "55bbe1288ebd793ed2f1a0b924da884175118246e56a759a7f91fe0c8d3519a33f686d83e3a28fd05ba0cec18ccddb7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719222, "uuid": "90c5de77-f3ff-4e80-bff0-763abd0e69d0", "value": "T18373123194BB1B61DBB59F3EB1B9CF469707CE38E09260E935A26D33CA10D47B5B0812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719222, "uuid": "59e0d835-7c84-4b6d-b4b2-88afd5f69e3c", "value": "1536:/hsyNfNqxfklUohJmUUB8ZaBfePMW6J56HpcJP4f/pETwKh6CDU:/JN5fHcQakUWcUpcJwf/pEUCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719222, "uuid": "65e109ca-8327-4bda-ab23-d1712fe33220", "value": 79400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719222, "uuid": "8b06edee-fed2-4f2a-8847-b8520cb9d44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719222, "uuid": "a3227775-b937-4016-ac30-c4b9de4acd41", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbff5bb-45f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777705076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705076, "uuid": "d387fe23-d7e4-4d2c-b4d1-f21354a9f84f", "comment": "Malware payload (Mirai)", "value": "bf8c598a8eed9c1cdb0d7c37666bb711", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705076, "uuid": "135760ac-446a-4d3c-8aab-9b3ec937a6d3", "comment": "Malware payload (Mirai)", "value": "b34a90ff104c491d1bd5239b3b9d445d78e0cf759295bbb5b1de8006e801d6c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705076, "uuid": "024032f4-af68-4518-bb4c-83d8f2dc8718", "comment": "Malware payload (Mirai)", "value": "1693e83e6bc57d4bcfda1449f425282f830c17e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705076, "uuid": "b4e3ee2d-8d0c-4663-955e-a2bf6ac7b5df", "comment": "Malware payload (Mirai)", "value": "1c7feef3914ff76af1cd14de90e52c216001b4a70622d47fc98ca9cdbb5caff3e5b49e55e9990311c6cdbdb0803df26b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705076, "uuid": "9379ff3c-8cb5-4539-b864-424790e605f0", "value": "T101837C8BB24B5DA0C8528BF04BC75BDD3E233211AE1798F73C1D1A7918752DB5E0A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705076, "uuid": "736d16d8-8543-48b9-9681-c859d02765d5", "value": "768:xu3fNP13bW7kDiiIqtAecPwWzCmY9IsGanakGF34gK2pB554RZh7IfuL3mmx:xu3fNlbNDUe4PrmmYtnvGF4gK5/LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777705076, "uuid": "1eb6c82e-9ea8-46d9-b3f8-1f9bd2437cec", "value": 83476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777705076, "uuid": "1b2e7f41-40e4-4fc8-bbf8-d94ae295b11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705076, "uuid": "3f5a1ef3-f143-4ad2-b7e9-8ebd76a3acb7", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0877f57-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766362, "uuid": "baf57635-aae6-405d-89d8-3359dc94b0fb", "comment": "Malware payload (Mirai)", "value": "bceec29f3eeddf4c1abc10ed39c332f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766362, "uuid": "839d96cd-9d3a-44ab-9926-6dbb9a15b50b", "comment": "Malware payload (Mirai)", "value": "b35ea6b18e0bb373da551d5aef9353b9b63878a771f6930e41f37b332bdb8fd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766362, "uuid": "19fb1627-4c01-4558-aa29-15f434780bd1", "comment": "Malware payload (Mirai)", "value": "09762771811455b854d705c53807031468df35a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766362, "uuid": "cbf25b2c-ca47-4d51-b404-d92a6b2a8929", "comment": "Malware payload (Mirai)", "value": "d073926138e844c93b9c08602d70aeda4ab263319e3da3144192c80d20d23712ab3cd684a1b59555b31d746f0dd1d1bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766362, "uuid": "afbc0ce4-3c2a-40be-a89b-c67ba0ba6502", "value": "T1CCF3C50E6E198F7CF79987344BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766362, "uuid": "689760b4-b40e-4e5b-8c32-dfd5a4cf6999", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwX:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766362, "uuid": "dd0cbf37-3a63-4c3b-8cf0-469c16d91cb8", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766362, "uuid": "71b1e3c9-8537-4920-8ce1-f7949144b93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766362, "uuid": "6b7e985f-b6e2-4739-ba72-3de57244fda1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f842c1f9-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704956, "uuid": "e0f2d451-dce6-4dd1-bbe0-f7db20798ea6", "comment": "Malware payload (Gafgyt)", "value": "4c5a403b162d830b4da44fabecda4773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704956, "uuid": "6f38548c-dc12-444b-9337-e004bb4a5a8f", "comment": "Malware payload (Gafgyt)", "value": "b37375392612d68f091bf723adc6b3b64b63a928f96bbed5e230d5840f14c6ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704956, "uuid": "55db2f08-8d69-45d6-977b-3d1315612e18", "comment": "Malware payload (Gafgyt)", "value": "72f42d255131da48f43b446684c0642208cc8605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704956, "uuid": "bc2e62e6-385e-40fc-a002-d0bc3d4ed7c4", "comment": "Malware payload (Gafgyt)", "value": "1a52b634ee05f899311baf831abbfb4c5742b6aa30628f44ed2a3a3bbbebbc73cf024452a32638016784ca81a896a62f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704956, "uuid": "ec5179b9-8249-4520-950c-ca031d5da6e1", "value": "T11C932ADAFA42CE73D01310F116EA6B218971F9FB1C23D682D7647DA0DD211C29A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704956, "uuid": "13936244-766c-4636-8489-8933126b16da", "value": "1536:47ZyW95LQG9SCn/sYDLwEWPm7GUv0EqaTYRJLWjd2ZOqnJ33xZ80gA:QrJlsYDLum7csY/WJmJ3BZ8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704956, "uuid": "2161247c-a45e-4c59-875d-4da8a5e7e1c1", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704956, "uuid": "ddbe72f6-fd7e-458d-9afe-db5ba4ce04af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704956, "uuid": "39d98f02-f7d4-4b24-a3d0-ae63862ea82f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd089ab2-4653-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746116, "uuid": "b5a22f13-732e-4368-b033-b7b3d3d89200", "comment": "Malware payload (Mirai)", "value": "de2625386e4939b28af4eb9803dd170c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746116, "uuid": "16a9f914-7383-4312-a4d2-393fbf409192", "comment": "Malware payload (Mirai)", "value": "b3b3273972af4abb7428335d4f4be2fcd3b856d7ce003217f2aa9d594f286c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746116, "uuid": "647d81f6-7f6d-42b4-a9c8-021153a680d9", "comment": "Malware payload (Mirai)", "value": "628f7174426c14544ba666e0eabb5ff89c7a95da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746116, "uuid": "ed1ec145-d8b0-45a9-811a-5b7ebdc496fb", "comment": "Malware payload (Mirai)", "value": "7af511bf8e2d334e13190c4f8ac666e274f853d0622955e48fca3bc0ebd7718226025a10e5b54cc1d7bfabc82b6da2fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746116, "uuid": "0837aece-bc68-4e95-ae3e-6118a3d43998", "value": "T1C703F1946FB087DBCA84EC3E0E9C2725E77D5602EA01903183E45225DB73D91E7F62A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746116, "uuid": "12aba3d7-5367-4ae2-963e-d043dd613410", "value": "768:GfI4zlmuIruFUZ+47HU49oc2UIFCPI1St0MLjcHVXIbJ3f:ABEZ57049bI8PGQDLoVXIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746116, "uuid": "98aa718e-3f4b-49c2-81f0-2221b0ab66d5", "value": 40704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746116, "uuid": "a12a18f2-762e-446e-a4d9-d99c1f37c44f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746116, "uuid": "376b568b-2bec-4942-b44a-4a6403dd6d24", "value": "b3b3273972af4abb7428335d4f4be2fcd3b856d7ce003217f2aa9d594f286c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97d5f34-45e8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777700154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700154, "uuid": "5bbf3724-7c64-4568-a82e-39cb6ea4bb77", "comment": "Malware payload (CoinMiner)", "value": "3953c0c5ac7a636addea12d1607cd158", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700154, "uuid": "231b3ce8-6420-4841-94fe-f522d95a50b8", "comment": "Malware payload (CoinMiner)", "value": "b3b79564418d5d9c8f98b60b8a86365633a3377711fae91bca99dacd2bdf8809", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700154, "uuid": "dd889ed7-1759-49f5-bf95-337ccaaf0593", "comment": "Malware payload (CoinMiner)", "value": "f65d6aeee2eb80d30e838b28d60ee88375ee6cd2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777700154, "uuid": "d7e1386e-eb63-4bfb-96d6-367d66e55609", "comment": "Malware payload (CoinMiner)", "value": "04a122f1539d58b20b84c7576a04f2ee1e484627c7ad8f2392b274dbeb69fe2a69cd26c55f35b7df9ec9b817c606e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700154, "uuid": "56ec0fae-800f-42d1-8251-e8bab75c7f3f", "value": "T140221A1A7E8A4331D39049B05479834B553D6223E783A7EFF773969A0B913498840EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700154, "uuid": "06e6477e-aaa6-4462-ba14-eedaff53e965", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700154, "uuid": "96cdc4ae-ae2c-45d1-bd7e-638c7ca6b95d", "value": "192:1bK9oMTlUzBuVx+eGlRPFJxTEZmFhSmuXFh:lsoGUQVwtzPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777700154, "uuid": "d9ca0d1b-bcc0-44c6-8526-0874aae0e0e2", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777700154, "uuid": "30ed27bc-f4f2-43e8-9eae-1c8c94791f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777700154, "uuid": "8b831e31-00de-479e-a0f3-998d08147458", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4165da7-461b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777722102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722102, "uuid": "5f271c75-b49c-4605-8478-8efec4150393", "comment": "Malware payload", "value": "093e130253da88447dc6e44c73b54998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722102, "uuid": "4d79a3e5-b65c-4661-a8a8-d143aeba556e", "comment": "Malware payload", "value": "b3dae423e1d1f7d73792e75f9489bab86af2ede72bfd06dcca610f6010f256c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722102, "uuid": "4bf365f0-f49c-4032-bceb-3b786da4e722", "comment": "Malware payload", "value": "eb41f3e7fcccf1cb0115cf8c66b303b3b391278c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777722102, "uuid": "209168d5-9fb6-4d10-bc3e-a6a9adb89598", "comment": "Malware payload", "value": "6ea44b566ad39d43b99b0ddedd6c5fc0b758d3f47ca5bd746ceb84611c7c254404ff8f20a1587d790ea27e72f8983a23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722102, "uuid": "547e26a9-ba9d-4efc-a157-7466d96a1bef", "value": "T165E19F72F29109A3D098E37732EC4CBDF8340C849F658685E9D84AC200B39A7BA3D537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722102, "uuid": "6efecf27-1523-436a-b889-9914cad41eba", "value": "192:MgcYvTKysrc60qMlZ4SRVihp9gebUNVX9sQu:MgF2ySIv1RWprUFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777722102, "uuid": "24efe95a-cf9d-4a8e-a251-5fc05f74d293", "value": 6804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777722102, "uuid": "155aa015-dd29-411a-b7fe-b048435a2f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777722102, "uuid": "cd53a307-b909-4526-9079-71ecc2f50062", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4b265a-466b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777756447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756447, "uuid": "0155fdc7-5bd2-4038-8914-559a46cce367", "comment": "Malware payload", "value": "3b8b01d0e076eab48f6f156b4266b85d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756447, "uuid": "9e2826d6-7e67-40f5-b33a-24b342ee3a49", "comment": "Malware payload", "value": "b409b5e11163b4e738a069f8a97da205c63a1ef18c7a97ce9110bc4aea83a9c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756447, "uuid": "4f6d4e44-267c-44ba-bbff-5931d31089e9", "comment": "Malware payload", "value": "b61ce45d52e3f1841af1d183381643564aee2d3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756447, "uuid": "d4dbad4b-b943-439c-a30b-ca8c5142dd81", "comment": "Malware payload", "value": "c6d8d0f7e1706c7ffe278a421f668141355c08692f746c3693d10a3447b8fe7f94a0aa02a420d1647227319af1144219", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756447, "uuid": "1a05f710-4363-419d-a2ea-6467591d70e0", "value": "T1164179E2F878D9A3B65B003AF59C72502AC3493E4564B596708F2CD0277ED6DB42E239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756447, "uuid": "acab0a36-7f0e-447d-8934-bae2ab2c451f", "value": "48:vFA5158Na+rEurDU1DhE4KZXYe+Ku34vkRCM:dAq/rU8Ye+FgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777756447, "uuid": "69f5a287-a5a0-4b77-879f-ed1cd150253e", "value": 2107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777756447, "uuid": "ff1ee966-cacb-4a7d-bca2-e2dc548b812e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756447, "uuid": "63545f88-5fce-4143-b477-3034263559d9", "value": "microc2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1a6385-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736078, "uuid": "4f5621fb-5f9f-4725-bc24-a97fedf86c1f", "comment": "Malware payload", "value": "d646c8f92d6c9776f5fcbd7bab0fc138", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736078, "uuid": "a753e9c2-67f7-4433-b435-5254ec18d9a1", "comment": "Malware payload", "value": "b472943ee799263bda370336e805a48479fc9f96d1ea6d9f1756cea93278a3a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736078, "uuid": "b6964d26-ce2a-479f-9364-afb2609e9a2e", "comment": "Malware payload", "value": "6c5963e04ec892b18b674ea1d62f6bb9bfe009bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736078, "uuid": "3c6f6d73-855e-43e9-873d-8a530948b02a", "comment": "Malware payload", "value": "883151ed05b88a25970ee45312767498a5588c6f399634bb1be328d17652b0e4f02675f960b57f803a5e2ef92998088f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736078, "uuid": "9b48704f-7355-457a-baa3-a5cb44174e57", "value": "T157014942C9AD0C3E4D5E9913D610EA18306904BB7BF657FDC884DB6E0757030B360B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736078, "uuid": "c8fc425a-9cdf-4e71-b14c-f47e55e368b4", "value": "24:ZCkBXOu27Tyyy0ytq9Ov0GyVpoQ976UL0xT9tJ+o+/+ARIAADIm+:RB+77Tyyy0ytQOv0GyVpoQ97/LYJV+Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736078, "uuid": "9ef0f190-02b8-4d4d-ad0b-fb627501b43e", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736078, "uuid": "929f7ead-1bd3-40da-8777-a748c595d358", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736078, "uuid": "d7ec9449-abfc-41b8-86c0-cbb977df33a2", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4ef18-45df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777696139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696139, "uuid": "51795a87-a362-4469-829c-a0fb26c9cf82", "comment": "Malware payload", "value": "4400a00943d23e92a6c9ac0c6d9a5b9e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696139, "uuid": "8208fd22-5851-4c7b-8758-e3eb374f72e9", "comment": "Malware payload", "value": "b58e91bf60c89788f092c5a708765adfdb2354ed8833f3b90fa6027cf4d61873", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696139, "uuid": "de912774-0e1b-4890-a997-4dc0e4c49567", "comment": "Malware payload", "value": "291ff05596f8d709efd289cc1fabaae29716bc53", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696139, "uuid": "8e28e3f8-ec33-4674-9235-98a73e5f5925", "comment": "Malware payload", "value": "4a139571f3a2addebd97b106669a58cab76867eb18cb8eae1827d5227ba95a428a0a9a78f727611e6a1b23ace9e5cb25", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696139, "uuid": "f85625e5-cea8-4543-b349-1ef140d7a7a0", "value": "T13315CF1399488B42D11D82B9BE070C992F496E0CA9D175EF316F7E8B3BB47760C6E42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696139, "uuid": "d220b863-3c7d-4c96-95a4-0b95e76ba6e2", "value": "12288:f0XvjJ7gX3umqfXLksVyOj3hvAZ0akbPDfhPuD1nMoX08DgFTT+3Mt:f0fjJ4+mq4sV1ADKP1Pu1ZW3+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696139, "uuid": "063e4ffe-9ec6-4d81-92a9-ca0946c4a7f3", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696139, "uuid": "9217eec7-2511-47aa-981d-aedc3da992b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696139, "uuid": "8f7bf961-900e-4f22-9d94-78d70f64dfc7", "value": "SecuriteInfo.com.X97M.DownLoader.2343.19708.29579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c571171c-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743526, "uuid": "e415802b-372e-4b06-a595-ef4910916eda", "comment": "Malware payload (ConnectWise)", "value": "16cf87daeda4532267f509422b17236c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743526, "uuid": "daf44c4e-2fb7-40a1-b3f9-4635070be7b4", "comment": "Malware payload (ConnectWise)", "value": "b6719ff8a819329dcf4d66afbbc8c1bdc7aef2b7b2cf263c756328498146aad3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743526, "uuid": "3356c080-a34a-4fe6-94a7-ac4f80733756", "comment": "Malware payload (ConnectWise)", "value": "5a13be850ac8f26e95a72770dbaff760fc287a4e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743526, "uuid": "dd7dd94b-c47f-49ad-b9fa-4ed5c978ad2e", "comment": "Malware payload (ConnectWise)", "value": "f56e13bffc6b0f6f626f668f176ed263711c961b065228b6e10bc780de7c45631273d80ca595d1aa4bcbb7eb4235824b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743526, "uuid": "b1d47202-3565-4fc9-87c6-abd3a389097f", "value": "T198646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743526, "uuid": "46123e62-6694-43e3-a12d-afc0c747ef64", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743526, "uuid": "b1cce054-401f-46e5-8eb2-b5bc40fe7736", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi98PdO:41iw7gryNkSV1hy1Z1u2JLa98PdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743526, "uuid": "5f3c3065-68a9-490a-a062-1e8e499cbdec", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743526, "uuid": "487ede9e-926c-4b4b-8407-06383ca3e2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743526, "uuid": "56b6822f-edd2-40cb-9d8b-bbecc016c351", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b82622d-45cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777688346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688346, "uuid": "c7e3a9c5-e05a-4858-8097-537c73d028cf", "comment": "Malware payload", "value": "51d5bb49e36be54d6817eb4b4d1e9e69", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688346, "uuid": "f7462044-a4f5-41c1-ac1a-36471f4c5b18", "comment": "Malware payload", "value": "b691f72e33f48e971e7162d45801b4b9dc3cdf857c5fa22f6f5efacef1e93d9d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688346, "uuid": "57f73c24-d0c0-43c3-8278-5aebc8208c93", "comment": "Malware payload", "value": "ed538d088a0f55f1ef948f6870ab46372696fdc1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777688346, "uuid": "264b9e3b-5ff1-475e-bbf9-42d263b54f84", "comment": "Malware payload", "value": "334f54ab2b07da1081d7de5176e71d06df4fda147697fa66758d84c0da2a9c31a5f10f74efd39feb9971242ae8123fc5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688346, "uuid": "6f46b422-b000-40f7-9e74-b1245de40479", "value": "T175E4AF16F7D824F4D4BA917888930A06FB3275892B60EBCB536456191F63BE1AF3C707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688346, "uuid": "6bf254d7-93fb-4c8f-ba0c-b9ec7a61fa98", "value": "ab09640b1e5e7ebcaecce235f70d5d3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688346, "uuid": "f5ab8f7e-6e57-41b8-af8e-8b131cb5ad15", "value": "12288:M8DIe2JpT62kHdC0iKfj0qXUpvSJFFeU/w+WV8vioITxVP:McFCnK73svSJTeU/7ioIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777688346, "uuid": "35c3a328-6b84-4c41-a745-5f4f9737ff31", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777688346, "uuid": "96954ec9-5515-4dc5-a321-4d9407ee2ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777688346, "uuid": "123a9be2-2701-401d-9376-f0d7e7592469", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3555483b-461f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723527, "uuid": "74e1bb8b-718f-46b0-b272-65c5c73ba6d5", "comment": "Malware payload", "value": "546bea72664db04bb325d6d677b63324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723527, "uuid": "9f1f1c59-4e0b-4168-82d7-859cc976fafb", "comment": "Malware payload", "value": "b712de4ba27e5c6a9116487ad1f6e78d1be502a33f05c0454f11bb7f5dc57ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723527, "uuid": "dbcef9d3-76fd-4f9d-aa6c-f8001a8e3997", "comment": "Malware payload", "value": "22aa350abdd19175cdb5e8a751c2e839f69b1fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723527, "uuid": "48d9f2b9-5f1c-4b3a-b4d8-a0a7f8284176", "comment": "Malware payload", "value": "3a458838a3f7d9099257bc4766e45f0623a2759b54aa93d43ad7eff9ba14ce69ad636d58289c7a53a973558deac8b550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723527, "uuid": "23dfb7d6-e7c1-4797-8912-367c734709c7", "value": "T1DEE4A34CBD51FC04CE6E3DB38BE2A4A11B3210C63F129116370A6FFA9B553B659A217D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723527, "uuid": "58dc45dd-98a8-45cb-9434-4e525d97348f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723527, "uuid": "1b5505e0-ad1d-44d3-8ff6-ada30b2e12d9", "value": "12288:+uTDMTfnu733E0z6mISXq/wRW4qtYr7OJBWfy8:13E0GPBJiO+fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723527, "uuid": "35503d52-c1c2-4cc6-af4f-6b02b94710c8", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723527, "uuid": "6b5215cb-1bc5-46c2-84c2-49de1576e34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723527, "uuid": "34256aff-5333-46a7-9f4b-d1d31bd3e37f", "value": "fd271773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1715431-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734902, "uuid": "08867c3e-273f-448f-b27d-3c1cab821264", "comment": "Malware payload (Mirai)", "value": "52935b6d9b1357f502cb0b47a11e97dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734902, "uuid": "7012de4a-df8b-43c7-9908-dcaf6c88516a", "comment": "Malware payload (Mirai)", "value": "b75cb6a8c955679b967d064d0639e609f60d0d91909784bf4101e30a66f78cab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734902, "uuid": "fb77ba5c-3be2-4896-9e05-2157284aa000", "comment": "Malware payload (Mirai)", "value": "cd04d0fdd8b1c835c634c46abb572c5eb3e58c19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734902, "uuid": "0c4223b6-7778-4da1-92ec-8266f0486cab", "comment": "Malware payload (Mirai)", "value": "2e1c50d67235d516ff887f4fd529c542fd0b4f3b857819fe746cb841ac5faa518a0204dff25876f09eb56899689010f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734902, "uuid": "f20f0908-6818-466a-b03e-84acd3655358", "value": "T139B55B41FC51AA56C6E0A6BAFB7E828C33272BB9C3EE30174D044774779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734902, "uuid": "08f5cba7-b8bf-4453-a53d-24a5d96cfc66", "value": "24576:7nAlXAzskwEtBXs9pQaAVz7C8ehxYJ9WDQeq8nq13hxepMEMZgjAAZC/rTo+pWvW:7nASLXRaMzaWWbGxeMPsOrE+pWvPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734902, "uuid": "c8128fa1-0ab4-457b-ae65-521baed5a4a1", "value": 2490172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734902, "uuid": "3528486f-e292-4e20-bb24-478d7002041a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734902, "uuid": "a731e6d0-e454-44ae-bee6-978a622a3a32", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b493a541-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734908, "uuid": "73f24d84-b7a7-49fe-b78a-631e80bdd357", "comment": "Malware payload (Mirai)", "value": "72b59898bb85edae755e22274453a470", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734908, "uuid": "d510025f-14b8-42c9-8dd6-dc4cc14ba317", "comment": "Malware payload (Mirai)", "value": "b83f4f36defa3c07bdfc9241fc9a8baf476fe459294f0410aea2864e41d61627", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734908, "uuid": "3cb5601d-b06d-4005-b227-29ea2b3e8af3", "comment": "Malware payload (Mirai)", "value": "720a8e486ef36dfcd2f3d558408622a456f8247e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734908, "uuid": "37aaad08-1d0f-4b3d-88e9-431ff43b3c24", "comment": "Malware payload (Mirai)", "value": "89c6ebdf9d46d84613a0e6c8cd8e0d75467c909d23024d3c16d4c77f2f845941bff28f6ea248032167df73b45c24f295", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734908, "uuid": "597e6c7d-64a5-4804-9001-b026b1ec2f80", "value": "T118D55B41EC509A13C1E15BBAFA7F828933332BB4D3DB70164D189B706F96B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734908, "uuid": "1a19799e-78c8-434e-80ce-b1a0a0a27a41", "value": "49152:faT7YvUgHkyXalrVCsBJlCztYAUSZWvPlaE5SxcwB3kyqKLa82xyPbAKR03:fS7YdursMOzOEZWla1cwhkyqKLa82QPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734908, "uuid": "8f572b61-d53f-43f7-b4d6-330340b56abe", "value": 3018300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734908, "uuid": "d1ef002e-3a8c-4542-adbe-574c049ffaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734908, "uuid": "55f329b0-ed8f-4506-b90d-1d72c97ef4ed", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb93720-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734952, "uuid": "d16f68e3-9cc7-4c74-9c15-81830562ec1d", "comment": "Malware payload (Mirai)", "value": "3820068ed48e278edb06e887d7311dfc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734952, "uuid": "41575b26-da41-40da-b684-fa8fb4f2ebc7", "comment": "Malware payload (Mirai)", "value": "b977a55886ed02f882c84da3cdc83d4eba153be5caae12d155676fbaa5f45cef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734952, "uuid": "68b5cc61-85c8-4773-94da-f769c727f93b", "comment": "Malware payload (Mirai)", "value": "e560e214027e27b0369ec3526310b868e5e8fb70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734952, "uuid": "c91ae501-a74e-474c-b579-e46a959f8d1f", "comment": "Malware payload (Mirai)", "value": "9fa00aa6b5e58b227ab4f4104d27e08a7d2468600f667f1e73bcf40e8d84f360b5ecd74b6d67b4c734a50b69a2ba8b57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734952, "uuid": "950fc4b6-52ae-4d43-8606-2e414a4f978e", "value": "T10DB55B41FD51AA56C6E0A6BAFB7EC28C33272BB9C3EE30174D044734779A95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734952, "uuid": "54c5938f-4c1a-4c8b-8feb-66ac3fdfd974", "value": "24576:+hciBPBkGqYWWJPz1ujVeBco4rbUUrXyEbD/xhwMAmyOpUqSKSdJXZmx/U/oupWf:+hZW0uReKoffEb1aqpzSxxAupWvPlev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734952, "uuid": "1a6550e6-c74f-4262-80e9-24e8cb51f48e", "value": 2494268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734952, "uuid": "1bd51a54-cc54-485a-af33-09c9dbac0c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734952, "uuid": "bb139858-2d8b-44fd-92ce-490ee0df9a43", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730e773f-4620-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777724060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724060, "uuid": "41df5446-e684-47e6-bb35-a6251614bbf1", "comment": "Malware payload (RustyStealer)", "value": "cb46d2d7154aefdcc8c16699f5646763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "odoriu-shop", "colour": "#48C054", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724060, "uuid": "49e827e8-8ff2-42a4-8997-d3f9f80a1c5c", "comment": "Malware payload (RustyStealer)", "value": "b99c55db31c2cf5b342397c8a0a49b8eb240f53c777a90c07ebd3b7ec99d2a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "odoriu-shop", "colour": "#48C054", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724060, "uuid": "7c0d3ccc-5755-4eea-ad95-4b475f5e3fab", "comment": "Malware payload (RustyStealer)", "value": "2cdfea99725cd405bffa903872ab461edefa9397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "odoriu-shop", "colour": "#48C054", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724060, "uuid": "2f3fac08-8d26-4519-8d8a-4a0cdd66e29d", "comment": "Malware payload (RustyStealer)", "value": "9e5000334c3381ab9edcb75e6d6cd02a4939c7780a54ab3c1ac9c3b76831ce15b8511cd0b93587dfbdb30bd9c2c298ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "odoriu-shop", "colour": "#48C054", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724060, "uuid": "cf1b573f-03eb-4c74-ba63-ec784d5ca713", "value": "T1FDA4BE22BA9657BCD45AC074C34686736A7270CA1B32B9FF05D442387FA9AF61F39314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724060, "uuid": "83f45573-ed3c-42e3-86cb-8b7ee178e99a", "value": "cc5fe7e29bcbe564299b3986c55703ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724060, "uuid": "58fe586d-c377-4af9-ac7f-cc14f38d7aa6", "value": "6144:aaj8jQL3is846RwuQ0llXJNw4YeXuneEsfiaE+wHLOe5hwVq1XtRZEXooqQt7L39:aatIpYounTbHKe5hwwZyb3v0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724060, "uuid": "bff5cd7f-14f9-4b28-8ab3-15cc5fcf1178", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724060, "uuid": "9a3d7066-803f-442b-a899-efd2568decbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724060, "uuid": "a1ffb072-6e92-4174-81bc-2e692e749b21", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ddca73-45e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777697242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697242, "uuid": "1664bf91-7d7a-4138-9a38-d583445fd6d2", "comment": "Malware payload", "value": "5508395bc361f066f8c95b81bc89fe80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697242, "uuid": "79141287-1b7b-4d2b-b616-be5c44bb4675", "comment": "Malware payload", "value": "ba1e65aace99d8a6a27dcc87f7fa1dffb79d04c35fe594d16107b8a2b2aed145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697242, "uuid": "af27adb9-0ab3-4350-af92-9f4f8eb91076", "comment": "Malware payload", "value": "e7d1d5fb670ed877ac447c870382a02d0e70d57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697242, "uuid": "eb4a0dc5-b9fb-47fb-8f3a-1f016692b019", "comment": "Malware payload", "value": "bd674cb9a44fa800a0c0b49956bdc0fa2d49931f5d95f3f01987835b1f6654a1b34f1ed860fd3523efcb95d198e58adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697242, "uuid": "a1e6f613-5b71-4f3a-8bf0-ca15f3a2df88", "value": "T1D715286496F24461EB188F7C4A57754C27E7B3F06A30676B8BCBDCF2CD161D0502AA6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697242, "uuid": "fe6b8031-258a-4dc9-826d-c05faa01cacd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697242, "uuid": "d4459633-aefc-476e-bdac-f4290557187b", "value": "24576:FdOpkgFHBsmRofpKuxmQXqLjzT4Zzx/9i+wCBbXtA:ykwBDofpXxmQXqLjzT4ZzxFinCBjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697242, "uuid": "f409c494-4aa0-4218-928d-1e8547b07bdd", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697242, "uuid": "6d7ccd57-7533-499b-a90c-6031cf572451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697242, "uuid": "328d6070-4b0e-4666-87f6-6425f2f0737e", "value": "Batman33342Wallhackstest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d18d9a6-4639-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777734680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734680, "uuid": "547b792c-f61f-474d-aa37-703712bd2baf", "comment": "Malware payload", "value": "e78f511a5e7c09ddb7d146890365c8b7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734680, "uuid": "3f569375-2a5d-41f0-8dd1-45e0fa5c96ca", "comment": "Malware payload", "value": "ba3ef7b0911ec524fb9e51ae7529024fda7371ee4bc0f786f828e45ea7535e89", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734680, "uuid": "71175e8a-7d32-423c-b31b-6d31cd8f4319", "comment": "Malware payload", "value": "b4765663fece578c8167d525423a1ca211c9c8a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734680, "uuid": "fb95fb7d-838d-4ad8-9b5f-b25a73cd3feb", "comment": "Malware payload", "value": "7583fd755c376c362304d57aa8e6d9f3a61eeb1d54586113cee6644fe143c05910a63a106f8d17d44f817d92b60ea18c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734680, "uuid": "3d1b78f4-4a2c-4a34-b20d-9d68459c384a", "value": "T188C6129AFF1CF41FD8BB5933CEBAD213326666458942A7377508D20C6A434896F89FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734680, "uuid": "a1a9d45f-108d-4e30-99a3-9090901a493b", "value": "196608:qm4E3nK4HX46Jd8uM/k0wctLVw+plwAiopJPSLdo4RZfRevkldHLY1jtszekPrJi:dnK4HokMftLhpmALPPUdo4RDAkldHcFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734680, "uuid": "31eb926c-9762-496d-9476-f84dbc1a6e48", "value": 11795386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734680, "uuid": "4cb1512c-37b2-44ae-8187-c24d3ada9bfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734680, "uuid": "4c03c22e-0650-4b48-88fb-e7e559e06995", "value": "Love Text Messages_4.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f4849e-45e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777698490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698490, "uuid": "5abd2954-2624-4723-a7c9-5fd7314ee5e6", "comment": "Malware payload", "value": "cf8b1611456ec4c84742771ded2aad4e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698490, "uuid": "d93c3e89-323f-40ba-92bf-bcffb5c90cbe", "comment": "Malware payload", "value": "ba5d4060afcd7cea7f2c8a5430c555d6f4b2651d7909b4f94830e8a3fc8d5b0d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698490, "uuid": "c2cf98c3-993a-4328-a17f-4ed7844058e8", "comment": "Malware payload", "value": "f19a97b94f396bc91dd16d6adb9aa90483b96826", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777698490, "uuid": "e20130fd-b577-430e-a89e-80c58d269d4a", "comment": "Malware payload", "value": "496cf95839bfd41f8757a55b03b53fa631ca93c2f474d2488f33f944f844bd4e6f028e7ef9ab0b98d997a4bbd8a22429", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698490, "uuid": "6af88878-28d1-40b9-993c-123a8915cb43", "value": "T10F86BFD673C8BEDA8545DD2B6704F631419399338FBB90C6ADA7170A86B9D910F38F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698490, "uuid": "6252b827-015d-45fa-b2fd-922b2ce72878", "value": "6ebf5b7632506f2cfa75dd687cf09739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698490, "uuid": "9680544a-7f04-4a21-b299-d4625aa2bad7", "value": "196608:bq/EW/jkAqHBw3qTTrJVqF1gW9+bbAxWhpg/3hmY6OFBqyBcbwERiIN9xAEqva7f:mTgtuenDqFubMxl1BbZa0Q4Ta7O3/xSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777698490, "uuid": "9e9688ce-f0c4-44f5-8e5c-d126463e834f", "value": 7883264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777698490, "uuid": "d8922343-0253-4d26-8e64-6800d1ac15b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777698490, "uuid": "a95e8722-39a5-4d91-961c-63a0ba86f4b3", "value": "BugSplat64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2351f199-45ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777701593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701593, "uuid": "6c8a8fa6-bd23-4d82-a085-9a8199bd959f", "comment": "Malware payload (Mirai)", "value": "4558498a67be625e8c2d03b62da19962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701593, "uuid": "3b3e2918-9852-4ce7-97c6-05ed6a34195a", "comment": "Malware payload (Mirai)", "value": "bbc07f580245be4f9b491f3a041ff45416f58f54f60439da5444c0232985b94f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701593, "uuid": "b70ea736-fb9c-438d-a9bc-4fb96066f0d2", "comment": "Malware payload (Mirai)", "value": "28110060982f435208493462e4aac307cad630de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777701593, "uuid": "51e12dee-af9b-4bc1-9fd9-3feee213c887", "comment": "Malware payload (Mirai)", "value": "280c741573f308d998c18503a53d874359820a8351038502f1a2ddef53eb7561c0942ddd213b035790ac733202e8f833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701593, "uuid": "7dda7bc3-b7c2-4617-9b2e-21038b75eff0", "value": "T14433F985BD829916CAD80377FA1E42CD331173C8E2ED7223CD257F51B6CA52B0EAB061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701593, "uuid": "6fdb8685-3b0b-40a8-9371-31d1136f10c9", "value": "1536:GYFWtRPT3f1qgM4hUGLh1n544D0bwbZn:DWtRPL1ptmGLj56bwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777701593, "uuid": "dfbdc0a1-d452-4132-bd5f-f228677e61ab", "value": 51624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777701593, "uuid": "288c8f21-1625-4595-b92a-a6bf6bc0cf3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777701593, "uuid": "b7e17667-8058-447a-b39c-41faecddabd9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a981460-4653-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777745789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745789, "uuid": "30a30deb-9ffa-4355-b2bf-041f0cee3ee5", "comment": "Malware payload (Gafgyt)", "value": "8cd92a5ca9d473440a9b410ceaa118a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745789, "uuid": "c9c68544-c8fa-4fa5-b8cc-736d83fc5b29", "comment": "Malware payload (Gafgyt)", "value": "bd4f98e74c575d2f7ab5d1938b27c8c70b96109ef54b9c33077508ee858881d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745789, "uuid": "b5f2c02d-70a0-47e6-aa09-4f3e72d68f91", "comment": "Malware payload (Gafgyt)", "value": "741ffa02ac54c36e1377b22d3eeb12a86e884cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745789, "uuid": "228b2d12-f4c1-4542-87c1-152fb9ddf7f5", "comment": "Malware payload (Gafgyt)", "value": "751003b67c7958e880a9557ca13afebcae6a2360f3e06f1764497363d37a843ff3af30938f4bd97a9689f975a7c39919", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745789, "uuid": "ff6c2d0c-d9ab-41d0-ab7f-c23510a1fed8", "value": "T1FA33D60AEF514EFBDC6FCE3746AD0B4235CC554722A4373A3174C628B65A64B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745789, "uuid": "99dbf197-a3c6-432f-aad9-158f344ab676", "value": "768:XUhGVGLe/TRc8IwdW1fYFnuUmoENJl2ZHuQXiXhoejeuLToUznzrGb7+Kht5JIU:X1V6uyOGgFkEZHu5ho6pLToUjfLylF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745789, "uuid": "5ae80c01-fc5b-4ea1-b215-0ddb2ce477df", "value": 53400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745789, "uuid": "d2cf5e05-c287-480b-b484-dbe67e1e8041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745789, "uuid": "3286a240-9b5e-4a1e-8de1-6d6b0947c58c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6bc416-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740637, "uuid": "eaf47035-b16d-4ff0-aa98-eab3a4e9766d", "comment": "Malware payload", "value": "7c32a9d095178e2b778c09eb5200260c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740637, "uuid": "8001ada3-2c04-4cd5-b04b-06ac66afd589", "comment": "Malware payload", "value": "bdb5280b0100d0b9fb73872b0fcce03b84eaac278486740a80d18b29d4add0b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740637, "uuid": "da503abf-844b-4b00-aab2-cccb06cefec8", "comment": "Malware payload", "value": "17b4175e0667812b64c955369fb5d87f955b46e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740637, "uuid": "c96c2b0f-5fcc-4685-a804-0b3b11174d18", "comment": "Malware payload", "value": "7d4d0ef13d4de5fc3668ec56d8207c8590c491a9574783982c960630508bbafc5db61b6b25fe8dca7382e50c6a4ba094", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740637, "uuid": "9dd08c19-741f-432d-a37a-e5c479ca3686", "value": "T16522EC17F3E5DDFFC8AA577409A712703223C836DB428783680C46543FAB29E6EA5744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740637, "uuid": "dfdd3371-d9dd-4134-8702-f301f8ccc8c5", "value": "96:B74+elu6BS8TddeqMO+LtsVVQEnqN42mqMf7q1aiBcNQ2yMBxdxefnbuP:Bso0dx+LtsVif42QfagQ23jdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740637, "uuid": "df97c20b-14d3-4603-8ec3-e2d220a65491", "value": 10768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740637, "uuid": "ef05d652-4c06-4e63-b836-3a39f013ffe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740637, "uuid": "cd327c41-0d0d-46cc-86c8-f6243333178f", "value": "bdb5280b0100d0b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147a501e-4622-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724761, "uuid": "1a576183-20d1-4c8c-9a42-e30905894f77", "comment": "Malware payload", "value": "87050162f6fc069e7949d36adb00c56b", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724761, "uuid": "d67dbdeb-a4a0-4243-b7e3-93d887ba49a7", "comment": "Malware payload", "value": "be93679dad8fbde43eeed40870dc81eebbb81d6454eb2108d2c2eb471191a4f6", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724761, "uuid": "95ed7c4f-0e6a-4e81-a053-0034839873cd", "comment": "Malware payload", "value": "78fc504daed1f17eea953eed2ed3f3a934bea63c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724761, "uuid": "a8ba74a0-c7c7-4633-8993-a7eea4554e34", "comment": "Malware payload", "value": "22557720aec9df1f0bb7d3c3d53fb12074d08992d5ac9cda1a7a58638dffc6b13bd2271c779a1202f73142231253fde2", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724761, "uuid": "87e5035a-32fc-4eda-a0ff-df94f7a22e5b", "value": "T136343B03F19544F8D89AC27D8366A523E6717C494720F69F5BD84B222E27F90BB3DB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724761, "uuid": "94d48825-f32a-4049-a212-48e1401428cb", "value": "b831aa37f772944395d882fdbb5a825b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724761, "uuid": "15e8aac2-929a-474e-a91c-91188b87e38a", "value": "6144:Vw3V118LdJ0Pz1n7LFdmlQcGrcSxbSOslJWU5Zz:VYv18LdJs17LFdSTGbSOsTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724761, "uuid": "f493158e-a640-4d2a-99c2-79e864806cb0", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724761, "uuid": "b85e18ed-a8b5-484e-bf1f-a93e0698a565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724761, "uuid": "2a2d84db-3497-4a6e-aae8-e3f30653b2fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f138a8ed-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777766363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766363, "uuid": "87bdae46-ef49-4f8e-8394-29f30f8ced5e", "comment": "Malware payload (Mirai)", "value": "7f1acb1984a417de165e2121f285207b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766363, "uuid": "9877cf87-a99b-4d31-9bc7-41200d012277", "comment": "Malware payload (Mirai)", "value": "beddfa97f5d61c69f26a857c8210d8c1a4d8b8b7d6b716dec35c7dd2935018f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766363, "uuid": "30c153d8-a387-4c8c-87a7-e4bdf6db37ba", "comment": "Malware payload (Mirai)", "value": "0fd6ec29eec63cfdf178512d0f968c8278e1de98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777766363, "uuid": "63165983-7ad1-40c7-9347-17969bb1ea7e", "comment": "Malware payload (Mirai)", "value": "0b77c605b15668d8b5187ddc969cddea54d3bef5290bfc5ee81424d0475eecc2bca45a486517a6aae34c2a60750545da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766363, "uuid": "a0e7aae9-da24-4552-9733-ce0298d7430e", "value": "T1DD93D591BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B117B8551F0C63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766363, "uuid": "cdfaff57-da31-4dbc-a103-c3821a66f1c2", "value": "1536:Ud+d+6yn9H/NTzULgW4W2luLaN5q00brz9ikZcxew+7YY1:++dAn9eL6w0ecxetd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777766363, "uuid": "866df0c1-841d-4618-ba43-090d84737e74", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777766363, "uuid": "6b5d2eae-023e-482f-a1d8-adb64261b680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777766363, "uuid": "26e11214-e1ae-4445-8ff1-eef6e7e200d3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051cb977-4647-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777740626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740626, "uuid": "7f642160-f203-435b-b2ae-9c5b1978e110", "comment": "Malware payload (ConnectWise)", "value": "46e98cbad8f9e87f4226ce81dc06cd55", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740626, "uuid": "b2f43206-1d31-4a61-a040-f54f9ec02977", "comment": "Malware payload (ConnectWise)", "value": "bf391b5e07fc8d83c486b61d10b02705f78835f154a342e769ec07127ca685e2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740626, "uuid": "aa3ddf29-af4b-4e03-890e-bcfde4bd12e6", "comment": "Malware payload (ConnectWise)", "value": "e6bb3da2554e11253f9cbaccdb4722b4d0c08423", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740626, "uuid": "9836449d-c56b-4aba-b79f-270ddff004b8", "comment": "Malware payload (ConnectWise)", "value": "ee3cdcc158b570f5bb282e841b0ae5ed03d9c16816df798dd383da598f2135549c4a6d643be64dcee7b1f094ec5b89ee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740626, "uuid": "f9f28c57-b2fd-4966-bac8-45207c96c908", "value": "T13246E111B3D695B9C06F053CD87A5269AAB4BC048712CBEF57D4BD693D32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740626, "uuid": "df2bd79e-b4d5-4e63-8c8f-f377bf39f06b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740626, "uuid": "1a24fee6-1e25-44c4-8609-66c8f7361dc3", "value": "98304:jFs6efP09BNKtMj3Mgay69FHG2O0fIT2GWd:pfefP0wtCckYRFY2Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740626, "uuid": "b81bcfe5-cc18-473f-a649-9a5486b5c322", "value": 5505104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740626, "uuid": "52edbf12-329c-40d0-a249-5bb836142d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740626, "uuid": "31d6507b-d109-4384-b3b1-8548198112e9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb7fed2-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736079, "uuid": "0c61072c-6a73-465b-9a84-15dbc516232f", "comment": "Malware payload", "value": "bd81b619c88aeec8e96cf7150e6f99e4", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736079, "uuid": "fe2c17e5-85c0-4d0a-ad5c-34d079db305c", "comment": "Malware payload", "value": "bf3cf8febb0ca339ec3462d6611323fedd0ba374dacfe4490d97168f725e60f1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736079, "uuid": "ab7997af-37e9-462f-9010-613503d5d2b7", "comment": "Malware payload", "value": "7b4091f0b9350344e747ccc81935fad0d7347e2d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736079, "uuid": "375fe71c-d246-4fe6-86b9-85b23283c81d", "comment": "Malware payload", "value": "5c4c686da1510d2e51ce0d1cf0ba896d3de8be85e5136aab37f9e890ff38475cc55e103b6908c58993d97a12fc6c7b08", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736079, "uuid": "c8b7f0d4-1afb-4a6a-a113-4f4dbb3ef15c", "value": "T127D18D76C3E88D73C024727622F90EFFA05508C48B8E824D77858ED6E6EF2F1AA34154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736079, "uuid": "03af42d8-ae4b-4a85-8f11-abaefffe5438", "value": "192:MApiVMSaUsoFJgvM0nMlZ4SRVdhp9l4S9urax:MoIladoLFv1RBpDt9uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736079, "uuid": "03d321ab-dcc9-4a50-a48f-0b9aa5b818e6", "value": 6604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736079, "uuid": "c0cf22ad-5b89-41a6-a044-9053ff532739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736079, "uuid": "25ca2cff-98ef-4dfa-913f-1519f4a666d1", "value": "boatnet.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb636ef-4655-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777746677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746677, "uuid": "245759f3-5e07-49a2-8677-14b038bb9ff7", "comment": "Malware payload", "value": "60c72ff2c4d271bda8b81b481be5f7f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746677, "uuid": "5ada1470-8f3c-4e9d-9d1f-21c2c608be9b", "comment": "Malware payload", "value": "c19cd4bb37b77fb75f613e52bd611ecc73264acc8882b935b895617dfc219b9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746677, "uuid": "bc828103-378c-4460-b83e-74698a649290", "comment": "Malware payload", "value": "b47357cb99aca925a94668d0fd3383f774477475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746677, "uuid": "dfc78aa1-7cc5-415e-85a5-ca1ef1483cd9", "comment": "Malware payload", "value": "379af42fd6c7afde96562f40f53011aef5c2b45bda19e63d5b3529fce0652169bef5e38d25ca9a163a8c9fb52740c760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746677, "uuid": "18a1a77b-4a98-441e-873f-3187bbcb2b71", "value": "T100860905ACC53BE6C42C5E7444EACA6522B06D140AF2463A26A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746677, "uuid": "0c646f62-c492-4fe5-85ee-f0adb057c658", "value": "49152:cX7W9BJ4KGlHi4Ocyc0CQ58WTBAYWCBIE17Il8ZkFc55Eo:PhuLQ5phImDOFsEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746677, "uuid": "39176d18-c1f8-4e5d-92a9-95bbc4165d5b", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746677, "uuid": "bdcf532e-c343-4339-8a6f-2393ab05601e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746677, "uuid": "1b117d4f-2e46-4851-bb9f-4ac4a0540cc3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba93f6a-4631-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777731215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731215, "uuid": "8027f76f-4058-46f5-9d78-b05792ede320", "comment": "Malware payload", "value": "bd03090c3679a897be2ef7867a167e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731215, "uuid": "43346f3e-d0ab-415d-9ba2-5ca42346620f", "comment": "Malware payload", "value": "c1c177391f6f65f8089f110f90a475b1ce398ac604f29f55acc1063455e94c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731215, "uuid": "d783686b-cad9-402b-a33d-65241b4190bd", "comment": "Malware payload", "value": "caebae0df35541668ca9ad6192f3f68fedfc406a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777731215, "uuid": "b1152622-281e-4db4-8c49-a1177e5a5bd5", "comment": "Malware payload", "value": "c556a1f633fbd626c19289ff7568e7dba26bd1db97f6b3a598ec15e10a6a4ced372fe98939d2737b2d2b59d91dc487d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731215, "uuid": "5e55b682-3909-47ea-856a-b93c162fb172", "value": "T1E7E65C19E253CF6E187703E055655FFCAEEEB10E6A5A1687D4F9E24332E606C90BF840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731215, "uuid": "66de2a96-3018-469c-9847-a95290181e5c", "value": "8aa38e38703592d8f048f419a7cc92c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731215, "uuid": "cdcc33f3-87f5-4a34-a876-181044de977d", "value": "98304:+l/5cDwlCZC+UItGORqAo0eYKE3Dg5O3uqnRG86Y8AXIenk:+l/5aG6HeORDsYKE3Dprl6Y80fnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777731215, "uuid": "04241650-4305-4ccf-a04c-f55a3c6dbc4f", "value": 14878532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777731215, "uuid": "949f0bee-7ef4-4933-ac7f-7d266b57b1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777731215, "uuid": "4b4975c3-7ec9-4082-9cf3-7a9ae19e61c6", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e79a546-464f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744158, "uuid": "cb28e099-4c9a-47c1-b094-b69898a81b3b", "comment": "Malware payload (Mirai)", "value": "04eeea62d73938d4909bda763c1abdc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744158, "uuid": "e8e98da0-1e8c-4327-9e1c-21ffe40d1ab2", "comment": "Malware payload (Mirai)", "value": "c2481af34afb3a91267009e729d779f25ac500554dfa1e380d1e913bbb58b71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744158, "uuid": "b4f7f521-5e14-418b-bab6-c05d34c959e8", "comment": "Malware payload (Mirai)", "value": "b67a6f88426639cd27d175da53ecda7dcfdd4923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744158, "uuid": "f4b3a6f3-af64-481f-9259-e29687ef411b", "comment": "Malware payload (Mirai)", "value": "c55c87f36a5cb19fb0b28d5e286f0dc3c8c54d994f249145f10e87ae9189f2f2882261b9222729eebd64cee55b349654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744158, "uuid": "7f7cc371-3872-45e6-9eee-c77cbf73b2d1", "value": "T15D045B63DD65AF8AC516A0F0A1F18E384F12BD2689570FF9A4B2E9F44143DC9F1097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744158, "uuid": "6dbc036e-8515-4df3-896f-4812aa4ab53e", "value": "3072:n5uf//nPAaHJWAjz9pUpGsydTwWl/2+k+jU7nGYl:n5uf//PAaHJWAj2mtl/8+jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744158, "uuid": "97dda49c-de48-423e-9a0b-e4955d076ae3", "value": 189524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744158, "uuid": "734b53c0-e3d9-463f-9bd1-cc99323fa078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744158, "uuid": "d3082cf7-d386-4567-ac15-35602cd84a14", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66f206a-465b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777749594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749594, "uuid": "30be1432-1529-4bc3-ab46-169275d9e823", "comment": "Malware payload", "value": "0e405293738f2e0834cdd3d42db31a75", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749594, "uuid": "3832a1e0-7e2f-467a-8e7f-80259a445f50", "comment": "Malware payload", "value": "c53546838e32fd9baeba4179f491153958597a8a722ff5fc8627b0b361b4a6aa", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749594, "uuid": "ba6e49fa-0491-47f8-9df1-02c397baf7c9", "comment": "Malware payload", "value": "8a3a9f7d43b58daa4b5ba5e592ec585fc8a091a1", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749594, "uuid": "3ff32226-3ae8-461e-b811-c705cb84bc2e", "comment": "Malware payload", "value": "75fbdd604214b9014e1f671813dcfe30b801bbbc1f7351457bb2935f1b240106d8ebd92565098218c01b4f1c147dc393", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749594, "uuid": "91d4ece1-a9a5-42df-8428-2ad77e2a9a3b", "value": "T1F446F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749594, "uuid": "aa8be92c-9526-418b-bced-63f984232591", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749594, "uuid": "6d789f5f-23e4-4568-a4df-6d2f7831e5be", "value": "49152:IfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:Prs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749594, "uuid": "f4f4e931-0717-41db-bdc4-aa12527b4946", "value": 5648336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749594, "uuid": "fefa0c09-4fb5-499d-b5cc-f9aae2c3ba8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749594, "uuid": "545658ea-7677-486f-b644-f2418dbe6d06", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504f567f-465b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749342, "uuid": "9b4c8c2f-a96b-441d-bff4-6bcfedaa4afa", "comment": "Malware payload (ConnectWise)", "value": "dc914af84c8a159a85f60b88dafa21ec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749342, "uuid": "df06117c-37e6-4ab2-9be9-9094d85c47d2", "comment": "Malware payload (ConnectWise)", "value": "c650e7f765c2b0f2f8683fedc44b137cf8799497a534a4d1a1ccf798ae7fdb4c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749342, "uuid": "4ab9a909-fc1e-47c0-8d6e-8d4f50148855", "comment": "Malware payload (ConnectWise)", "value": "3f41b8092839de9157ce04b18a9696f97bb152a7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749342, "uuid": "9c3d2ca2-6c34-481c-81d7-f4b0eb00b407", "comment": "Malware payload (ConnectWise)", "value": "5ddcd2b7c0420962cfa51c3e4fc4fe20ba99a5d0996001f176285b27e0631ea0b1e36fe86c9097caf152b54f60d71860", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749342, "uuid": "724457a2-9fe2-4f02-8577-150aaaa74d33", "value": "T11C646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749342, "uuid": "b261ef68-089a-4f67-8fc7-f0bc098980f1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749342, "uuid": "e5cde4b4-027e-40d2-a789-465054b9d1c2", "value": "6144:lmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9qP72a:Q1iw7gryNkSV1hy1Z1u2JLa9qP72a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749342, "uuid": "65a1b458-a1f2-4e19-a581-59739a8a4080", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749342, "uuid": "0a0b196c-eb48-4506-9fc8-7e9f1697ce1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749342, "uuid": "fb968c67-56ee-41c5-8432-cc599eb526bd", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696143b3-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741653, "uuid": "fd42d95a-98d3-4dfb-a8de-5c0b3ee6b76d", "comment": "Malware payload (ConnectWise)", "value": "476a7685295e31c06a8c7fd33dcc0e2d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741653, "uuid": "f84986da-a419-489c-8e7a-6ab9755b92eb", "comment": "Malware payload (ConnectWise)", "value": "c773f9dbde8cd7a94f06abcda11f28d2a05e5d0323f65ee9a3552b78e6e5ba6d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741653, "uuid": "162d5dde-6140-4d8a-83d5-9cbdf349ea32", "comment": "Malware payload (ConnectWise)", "value": "6bd4c1a0c8619dbc06cfb459ea52bd39bbfcbebd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741653, "uuid": "48d6198f-13b3-435c-9fe9-75cad1bf9c7b", "comment": "Malware payload (ConnectWise)", "value": "b7fc76ecec7c8fc4143c427aa8b0129cc39434f7aa63584055f5a3a9b93677830d696ca3dd017bbd4e3fa8051823ca93", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741653, "uuid": "569a8d69-7eb8-443c-add9-2f6b820a861c", "value": "T14E646C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741653, "uuid": "40877c75-0b4f-4d00-88b0-3db3e12993f0", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741653, "uuid": "40680ac9-50d3-4778-ab49-63e7b80564ef", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9Ur:o1iw7gryNkSV1hy1Z1u2JLI9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741653, "uuid": "39458435-424c-4990-b47f-5dba63f1673a", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741653, "uuid": "7a4f77ac-7d27-434e-a337-4c0bd0a59347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741653, "uuid": "db193c64-c923-4636-a137-3167a9409e86", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc92573-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734920, "uuid": "eca6c4b6-fd35-4666-b886-8227c8c298c0", "comment": "Malware payload (Mirai)", "value": "f258280acd0d909ca34439e4306b69f0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734920, "uuid": "b7a40f5e-532f-4457-b1d1-1f9b18d5bb19", "comment": "Malware payload (Mirai)", "value": "c78cb8b1a6790d51adc5397e7e589dbb948d30b9076d02d57a1319dff4e1abf6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734920, "uuid": "9c46859d-8fb7-43f3-9e03-58ae3b679cbb", "comment": "Malware payload (Mirai)", "value": "4124b4eb072986402c3c01a295e4686dfd369991", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734920, "uuid": "db5a3edc-f454-4970-b7ec-8da15d8ac86e", "comment": "Malware payload (Mirai)", "value": "ab294cb4ca7013132961641e6de01da817d099dafe8749dd709407fe49df1c0f33183dd9d4bed8278a8b5c0da2a93af1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734920, "uuid": "d65cd514-326f-4283-8e9a-c8e713b256c8", "value": "T134C59D63D868AFEBC526D571A538CEF60B53680052260FF63596E3B44947AC2F3067F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734920, "uuid": "7211daf2-9464-41a3-975b-c6c141eeeed9", "value": "49152:4XY1fM278BYeZdyBhmqks/PziC2x7T4YJK+QhdLLxVVJmvPse:Rtb/6SLRJmse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734920, "uuid": "d151d749-1d6a-4980-81ce-5d97bfc2e121", "value": 2695112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734920, "uuid": "43d852d8-5049-4ef4-b08d-ad6d14ed8c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734920, "uuid": "cf56da71-0c66-41a5-9d97-763289418890", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce0112a-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777697690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697690, "uuid": "a7a9c715-94a0-4631-9e5f-f0cbea5d78fe", "comment": "Malware payload (Stealc)", "value": "059bdbf179f89147f85464642d7dc4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697690, "uuid": "3ad7be15-9834-4955-8b50-63b7ecf408e2", "comment": "Malware payload (Stealc)", "value": "c865559a8dc200b297f365f1e233234319645f7a0278ceb223202c7eb9b1c12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697690, "uuid": "d2d2792a-7a20-40f8-8539-650df90b5907", "comment": "Malware payload (Stealc)", "value": "32f85c0941d5d1748dcc99fce9bb46cb02c5f9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697690, "uuid": "6283ecde-723d-4038-bdb2-85191f0359c4", "comment": "Malware payload (Stealc)", "value": "e76088642db00843c919dcc81a56d579db8f944c7ddf76864d35f249cad0e12a019346785bd2048e9494bac1c530aaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697690, "uuid": "96c85260-ec40-4e44-9aab-e280859d0271", "value": "T1981523A772A630F8E17BD178C4A04681E733BC7687745BDF439486251E23BE1AD39E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697690, "uuid": "a8a093b4-3094-4a68-9a29-5717d7d774a7", "value": "75c410d3cdd17cf4a33ccaf94384484f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697690, "uuid": "7bc6248d-a36d-4c6a-b0d4-92b28739c228", "value": "24576:jPJHyKOKeuROVh1HrXvjjG1uVFidFpBYu:bJHyaOxHrXbS1Ui1B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697690, "uuid": "0dc78365-5235-4a98-9e85-08b835d25cca", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697690, "uuid": "2ba8fa8d-0e7f-4116-8931-4f2080c10092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697690, "uuid": "e6512a01-be5c-4eae-96d0-69e4458e3dbd", "value": "cbuttc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0020e2-45d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777692829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692829, "uuid": "1440bd6d-a80f-4d42-b598-ca40270650b1", "comment": "Malware payload (Gafgyt)", "value": "e3d38efc653943ca1169e5807269506d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692829, "uuid": "62a9d524-74cf-43ec-b122-6d7be70401a5", "comment": "Malware payload (Gafgyt)", "value": "c93e47e7aefd6ca8d805c43cc66114991c35cc821d5998bd642dcaf483f27f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692829, "uuid": "4929becb-0ec1-4569-bf92-1b1a7410011b", "comment": "Malware payload (Gafgyt)", "value": "ca72014b4ea0ac7c951baffcaa29ecbdb3939a80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777692829, "uuid": "a019d6d7-806a-4c18-802a-0b1acb9c0e85", "comment": "Malware payload (Gafgyt)", "value": "154695f1d7c5ea21d5b2224964e7e02fa61fcd6f8287d41948b957a1fce6de00244d1ed80bb7efcc5dec685a0a7876a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692829, "uuid": "2e0452a5-ea03-48a2-a14f-07a8deb9148e", "value": "T16DE3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692829, "uuid": "cac06d87-d3f4-4c14-97c8-74f810c1dbec", "value": "1536:JOMO7IBo+0NFgNZhEyv2zJuoaZ8jCSRCt6+5Jx0/Jwq75hspCnKxD:UWhEVzPasCB/e575hspCnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777692829, "uuid": "e4784cf8-42a8-4f4e-b8e4-36357174de8c", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777692829, "uuid": "ac598a0d-b8f0-4d63-82c3-1be33e9e29a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777692829, "uuid": "daa1ffb8-82d5-4043-85b5-0a287256a0bf", "value": "mp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc8a6bb-465f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777751190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777751190, "uuid": "0397e428-90bf-42c0-837d-612be6fd3187", "comment": "Malware payload", "value": "178313a95d5854e7bae38778a3bca55c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777751190, "uuid": "c3c6d0ab-4fbb-446b-b22d-0031d82b0f84", "comment": "Malware payload", "value": "c96c8a5b9b1c85a113a47f161cd8d07953ab5427b1d41ace86fb22b23262e7a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777751190, "uuid": "982860ff-c18c-4d3e-8e76-cd57bea47b1c", "comment": "Malware payload", "value": "15c0ca203426ab6f9d490ccf79cc2f996647cf1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777751190, "uuid": "acc6f985-dae9-4e57-a81d-3baf85796b51", "comment": "Malware payload", "value": "d289d57ee2de87532a3d88cabb0ee28b4d0f564abadfe8711318f430e1ad18b9c5896adba37c60774d3efbeb74577fcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777751190, "uuid": "b04f618d-0b6a-40ee-bc30-8c104e091c79", "value": "T14C57CF77920678EDE9B98CB4D01025816DAC78875778E3C7BAC470E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777751190, "uuid": "3771e5e3-eec2-45ab-a147-b71021a43507", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ9:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777751190, "uuid": "f09ee920-1e75-46b3-89b5-0d10573291fd", "value": 28016640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777751190, "uuid": "1549a52d-56fc-45c6-aa97-808ae0b31e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777751190, "uuid": "e4329b7a-f3c1-4457-9a84-5bcf20723547", "value": "c96c8a5b9b1c85a113a47f161cd8d07953ab5427b1d41ace86fb22b23262e7a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3edb71-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741655, "uuid": "1275b4be-3d07-48aa-b42a-498af9fdbeb6", "comment": "Malware payload (ConnectWise)", "value": "774348287249d2f908a719b3956ba3e2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741655, "uuid": "c32fead9-ba31-4064-b762-bcf5b17dbcf9", "comment": "Malware payload (ConnectWise)", "value": "c9a3313ba2d8a596acddca5a1291a5481ac20e1a9808999fe0a30543ed14338c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741655, "uuid": "30787328-787c-4334-a62a-d8b8ac84a59b", "comment": "Malware payload (ConnectWise)", "value": "c49957a53e8ef7dcc729348a68e0f089cbe6bcea", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741655, "uuid": "bd09967f-50dc-491e-8042-db8e97c80f97", "comment": "Malware payload (ConnectWise)", "value": "63c0725fc02514a8439ef2f1f1c81cf637eaf5f11fa7b320a6148a8f5b53e1ee3a07a10a239e55b8cf7cf8ad4bf5489d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741655, "uuid": "ba92bd29-0fa6-406f-8290-957b5bd9c4b8", "value": "T127646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741655, "uuid": "1177ad49-6f17-4ccf-ac84-f2f6add0adb6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741655, "uuid": "0d43c133-036c-468e-983c-0e564283fb63", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741655, "uuid": "8d26f2cd-3a60-456d-a90b-961fb9d97521", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741655, "uuid": "a250edb1-268b-461b-80b6-c4c11cc1641f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741655, "uuid": "a9c5b50b-f9e1-4804-821a-fab701c124f5", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d843cd-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736307, "uuid": "e8fae035-2578-4e87-97e3-aa316cc5f719", "comment": "Malware payload (Mirai)", "value": "8dffb62f8989a82ca3dd9c94dafcc154", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736307, "uuid": "13b0eee6-cef5-44e9-91bf-3f6e4b389a78", "comment": "Malware payload (Mirai)", "value": "ca42cb004c85d431cf92b6cf855194354bbbf794e24e19ecfaaa58b962764803", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736307, "uuid": "947797ee-2083-48c0-9151-9cd7144ba07a", "comment": "Malware payload (Mirai)", "value": "ec2c1d752303ace6eb9eee5831a0ca0c41edf5a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736307, "uuid": "1886d794-4b9d-4804-882c-c4b14c12e053", "comment": "Malware payload (Mirai)", "value": "20a1bf0b437ec8668b092b43c7f65af78946c841969a8f63560a5dd55c33063430aadc3d367237c2a9cdeb9250dbb5ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736307, "uuid": "b66e0219-fe83-48ec-bdba-62b120947420", "value": "T1AF9329227E760F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F646C032477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736307, "uuid": "d342e381-e5fe-402b-ad7e-8896878d1fb8", "value": "1536:568MSzlPyzhCJuWsZIJXc7V1SYdJD5trAgENWq5O7M4XVhUto7:560A2jM7/S0lxZENl/4f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736307, "uuid": "4862c15f-ed37-462f-9d54-7ce478bfd621", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736307, "uuid": "7dab6c0c-ccc9-413d-81b9-fa24e29a02d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736307, "uuid": "5232df5e-2979-46db-909d-a983e3c6e7f2", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2327a9-466c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777756637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756637, "uuid": "4bafb6b0-aca2-484b-a5e4-f48413f1dc8d", "comment": "Malware payload", "value": "01d98944085119ef3d67046b2879d99e", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756637, "uuid": "bc057c45-772a-4c91-9a1c-7bc31b22b970", "comment": "Malware payload", "value": "cb5d8f190371cc1fdd70982c0f11eb5d73c936fd2c2426e1ef7b7baf8483b666", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756637, "uuid": "3c89a622-b7cf-4edf-af81-e1cb86d1521a", "comment": "Malware payload", "value": "9aa2085f7150563b00b3c5331b5740de88b7296c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777756637, "uuid": "8db3e0c0-887b-436b-b27d-dff1a0df8981", "comment": "Malware payload", "value": "796ec49f709b5ca31b8fc687cc4d1e2e5d32bc9c9b0f7d094ca85fdb1e9034e0ed07f5581c037d3cdf23b52d4c5b68e8", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756637, "uuid": "b1f935c8-e976-4793-bde7-e858d27d81ee", "value": "T1BF648D5823ED8A26E6FE62B4E83D040D47FAF51A612EFB4E199410FD6C53F8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756637, "uuid": "a7525772-04c3-47a5-af3b-60846746e967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756637, "uuid": "f980d031-fd0b-4d5b-9974-fd3d2ae6b5c1", "value": "6144:f2TCpFqxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:OTSu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777756637, "uuid": "75cc9a80-a83f-422f-bee9-2e2b335e8403", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777756637, "uuid": "eac6fc85-f426-4eae-9a17-381629ee0e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777756637, "uuid": "7d55cb92-6594-452f-b565-af3dd4893878", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed463d64-45cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Chaos)", "timestamp": 1777687758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687758, "uuid": "a4ba6d37-6930-4cf6-9a3a-294082dabf20", "comment": "Malware payload (Chaos)", "value": "5c792389eda9b6e3c0a26501fcaf3aa8", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687758, "uuid": "dfe38efa-01b0-4a5c-99a5-d07347038fac", "comment": "Malware payload (Chaos)", "value": "cbe100c6df230f335864b23fef453c96effc9430cb9e963f62f4f0af92512ae5", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687758, "uuid": "966e15e7-f3fd-4f87-b152-b30cbe6c5711", "comment": "Malware payload (Chaos)", "value": "e5ab1aa3d9e901b3b0489d8a2b6a48325755a241", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777687758, "uuid": "8cc92030-85cc-465c-9b69-c2a30772c94b", "comment": "Malware payload (Chaos)", "value": "08eb4f52d9a9ff83cd632c9afcd88254ab218889cc27c38fdbd6d22061cef175f3b5e8f874570f1b73073af5736089b0", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687758, "uuid": "61596a79-79e2-430e-ac3d-f458ecba77df", "value": "T1BC83080433FE8724F1BF1F7968B452414A76F866DD36D38E0D8D108A0A72B99CA60B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687758, "uuid": "37ac7475-bb28-4093-a6cc-8d8d92470dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687758, "uuid": "646202b6-5b26-4572-b6a5-45c1396ff99b", "value": "1536:ntnKV3GVufIhEQfinYaDFuggn598GwH4o:0pOoGEEVsFMn598GwHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777687758, "uuid": "ba8ab2c3-40dc-4ab5-82e5-aab0cc02fc52", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777687758, "uuid": "d5bfe700-389d-450d-a935-563893b325ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777687758, "uuid": "14a79884-c520-4d8b-9a50-1d30c2418a5d", "value": "LB3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01a2ccf-461e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723331, "uuid": "d8800532-80f7-413c-820b-d037acfb4bdc", "comment": "Malware payload", "value": "fe9945378a65eecd9a36016f4956299a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723331, "uuid": "b8cba359-3b54-48ed-a757-47b4ba416725", "comment": "Malware payload", "value": "cbebd291e5abe2264d77ea76207ccdc6a55fd0391820416c7172c48c1ba8b723", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723331, "uuid": "4c8eafe6-76a7-47b1-8e89-3f1b71c81840", "comment": "Malware payload", "value": "e25ebeb5ce60cdec887583ce1117dfe7eb237a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723331, "uuid": "d5af3cb9-8db4-4630-8b75-4995d6461665", "comment": "Malware payload", "value": "876c1be70454329fa6b282e98e9ba9f08658a20309fa8c5a7e134da2a162c3510851fb4a5672dc9adb911acab50f7dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723331, "uuid": "d1138564-e5dc-4c19-8fa8-c32444a85fa0", "value": "T1B742A6D25DE2C82BD7D1AB7A6B5F8BAD3321D282C28F7727421C99183D1768C4F26741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723331, "uuid": "052971f8-add5-4a17-8c6d-c9b637965f6f", "value": "192:J6GDVSDWsNJenxwiJTRbClci+LmbvZ7InBY5668SG:J6GaWsNJMdR2SVKb2nBYE6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723331, "uuid": "9025dee1-385e-4b5a-90e2-5e9443c1695d", "value": 12792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723331, "uuid": "e38ec3e1-463f-4036-820f-9d0e7b314488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723331, "uuid": "2170a647-1c4c-4372-9747-c80d8e80d61c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7d9916-4672-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777759270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759270, "uuid": "68eb0624-9092-4c23-b725-02556bf5b9ca", "comment": "Malware payload", "value": "9aea4cbeae015b6fe133d29881f19ad7", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759270, "uuid": "3592364c-cb27-420d-a732-1186382e9a36", "comment": "Malware payload", "value": "cd3a991b18f7bfef31de760ecf84db7c10b34b23732c83cd0c0a06e9d4ac2f34", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759270, "uuid": "1684fa82-a869-450f-bd67-d980ecb4b579", "comment": "Malware payload", "value": "62a2b57f6e159b13dc9f9a2c265391523a2d404f", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759270, "uuid": "7c31d77e-97ee-40cb-b438-fb80da2fb077", "comment": "Malware payload", "value": "3933b3d8e073f0b53fd5ceb36157a9af3d0acbfb82cadeb054c4dc0d4d7e79c5b7c3ff0e530d3b75851282cab2688e41", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759270, "uuid": "e2c84aad-3a6e-4c32-8a0c-ee88341345e3", "value": "T1323120A2342634088A379990C40A03A2EB826344CB013ADFB0E8E0D4BC057D5C7DBD4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759270, "uuid": "9e756d3f-361f-4d53-a791-87b429dc4e59", "value": "24:wLYgSoldUma7xV76AXLjGKVF5qVl9z8aqC5ZnUghdRJAN:5gSoldUmmI4GKVF5iLJqCHnUIjiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777759270, "uuid": "e6e02d54-fab6-46aa-9f34-9e2b6e1d5c5b", "value": 1449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777759270, "uuid": "98110675-1e4b-406a-8d1c-d1458a93b7f5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759270, "uuid": "e032eee7-eeb9-47b2-860c-c2a4f7d462c4", "value": "April Statement.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f19c2a-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719228, "uuid": "adf441ef-6681-42b4-911c-2f76bc050a3c", "comment": "Malware payload (Mirai)", "value": "f564f82cc189bf570c956d02dfe2d171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719228, "uuid": "c7d81663-17d0-4e32-998a-06d2e62c30ac", "comment": "Malware payload (Mirai)", "value": "cd760df406fe774d666ea6ab286f84c93156264d150502cca7011285827c83fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719228, "uuid": "c704ea3a-cdcb-4a1e-8d31-9ddb8c2de45b", "comment": "Malware payload (Mirai)", "value": "5739997f6eb1a5263eebc26bd351b994127ff93d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719228, "uuid": "8100fc09-f74b-42f0-9cdb-7102b570b41b", "comment": "Malware payload (Mirai)", "value": "b97f320caea28cbaa50e38eee1604d038184d509c0bbb6172687576d928b02eb7c1508b3ea3ded5a40a811a5fcc6679d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719228, "uuid": "80fd55ee-d8da-4821-99d2-84f769eb3493", "value": "T1288302099D0B71329C81213268E42A51BFDEF0E4B8DF16E9A8BD8F5899BF4437F36145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719228, "uuid": "63ca7dff-2d0d-4638-9dc5-afc3190d528d", "value": "1536:Vet7qvHhrx8XRou0xYzfzwt1dHv8lokRbcQymw7EsviUy5g89DR5o:Qt7qvp+XAxGUX5vkl17yB7Esv3h8ZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719228, "uuid": "637849c9-36aa-4c62-8b96-8d9a5979cf03", "value": 85720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719228, "uuid": "e7bcba61-ec56-45a4-9ddb-a908db920153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719228, "uuid": "76e96430-73e2-4e05-85f7-f17f522cc728", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170ede20-462b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777728630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728630, "uuid": "adbddfa3-8be5-4cf4-8091-a31aab049664", "comment": "Malware payload", "value": "fb89a70ab6e6db5e524e47ec600c4c3f", "object_relation": "md5", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728630, "uuid": "c54f7e89-d9c3-4205-861c-a3777afdf7ed", "comment": "Malware payload", "value": "cd9681de96c369cac354e7bedabf892f1b7e612aef2cc1ccaa9eecebadf1e41e", "object_relation": "sha256", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728630, "uuid": "eebe167c-69f3-4fed-b161-173a8821801a", "comment": "Malware payload", "value": "b78523e950abe2e2c8337c76145067444a5a0542", "object_relation": "sha1", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777728630, "uuid": "d9f4c139-1a09-4386-a7df-d6c9248315e4", "comment": "Malware payload", "value": "3735a391d8df2ebffa770152812edc229af656bf2c83eaeea8edeaacb7023d13f9cc2a457d3947b5968265dbc3e6d7bb", "object_relation": "sha3-384", "Tag": [ { "name": "CrackZone", "colour": "#A3FA3B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "solidgma-biz", "colour": "#511BF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728630, "uuid": "e6f1a4fe-ebac-4a74-a0ab-6ac72e8ce0e9", "value": "T1FBD55B43B9A044B8D495F231E8F572A4BB38B44C573967A32B12AFF11D7A3D08E36716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728630, "uuid": "b07cb8ff-0bc4-43b8-b2b4-bb20c66022cd", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728630, "uuid": "8c26ad93-e893-4327-b9b0-24cbef28e684", "value": "49152:reJEwClGPwPrWomCnoGKiICYliSqJFrtJLqSA4h3z1hwaJnMEhWxesBmsf6k09/b:ZlGPwPrWomaoxiICYlBqJFrtJLqlq3zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777728630, "uuid": "f8f02f07-6e88-47d4-8122-4f02fbc35eea", "value": 2816240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777728630, "uuid": "9d8ad9ee-22ff-4c3a-bd14-3008e73c0439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777728630, "uuid": "a39ab0df-c476-4822-88f8-2f6735bc1ef7", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96cc5ee-465b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777749626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749626, "uuid": "8885fd5a-d264-4362-b06e-a96f0e3691c8", "comment": "Malware payload", "value": "8c28dbd773b859d2667276f478457734", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749626, "uuid": "8c067146-a2cf-4b58-a202-fad2798e49f2", "comment": "Malware payload", "value": "cda030ad2d0076fc2fc96aae278fbf21b2244b27826d3890da32adb1e953a42d", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749626, "uuid": "bc6ebadd-70a8-441e-a31b-94ba36b51598", "comment": "Malware payload", "value": "05bcf8424821b3d368e57aea2403157be34f8f61", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749626, "uuid": "ea7bd0e6-a88a-424f-b1b3-4b841bf3e9b0", "comment": "Malware payload", "value": "c784e5bf54ebe5734d344f46d63c293df962f13cf9ef504ddf29754eeed852ca33ae54b441de2c7bf0fa28c716b9eba6", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749626, "uuid": "153e120b-2fcf-45ab-a1a1-0794d9c1634d", "value": "T18746E151B3E699B6C0BB1638D87952A5A634FD049311CBAF53E4F93D2E327C04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749626, "uuid": "8f0bb083-02d0-449e-955b-26bfdcb0b195", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749626, "uuid": "38eb6dfd-5fe4-4938-a88b-3ba256401c5b", "value": "98304:6zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:6hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749626, "uuid": "15721bd3-3ced-4eb8-a057-6d42223d2764", "value": 5712048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749626, "uuid": "68f2e97c-169e-463d-902c-c9e20945ce09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749626, "uuid": "57d03917-7f74-4e5d-bf03-4ce81af0f138", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b0a376-4656-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777747341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747341, "uuid": "df669029-e128-4c8d-a0cb-060a65544067", "comment": "Malware payload (Mirai)", "value": "0f75ade808da8cc50203ac7469a53530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747341, "uuid": "531e9dcd-fc0c-404a-975c-b420652540f4", "comment": "Malware payload (Mirai)", "value": "cf9d9611f7856454a64084cdc4a8d78ad1c59e901671bcb34e6fafed311c3375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747341, "uuid": "7dcc6f2e-7ce3-4911-8ce0-d47be0a79277", "comment": "Malware payload (Mirai)", "value": "77e73314c8ddd3eefc19f873b8d10946c0b8a2f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747341, "uuid": "36cc7d51-fdab-4f86-877e-05231ea4b706", "comment": "Malware payload (Mirai)", "value": "54c75529fa6b70a2ece58c0a148768c584f12077e67f04329e029cf3da3c93bba00d8cf9e080909acae8c37e3bb3cd9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747341, "uuid": "4f65c3a0-22ad-426d-b088-56ebea0dea21", "value": "T1ABB57D03E683C4F1DA960BF4125BFB7B893695160125C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747341, "uuid": "d9e89ccd-5e6a-489c-b285-dcfa3b42f316", "value": "24576:OVZYbGnqbrtAXXOsUfn2ScC8pwKssvVKTBYdXF0MA5QdH6FJ5vuldHyhJ+6Qcd0k:Okz+SUpwK7iMADb7PQ7cmZNpTkVSvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747341, "uuid": "1fbb309f-4963-4d62-9bb4-a5276eb7ac55", "value": 2395512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747341, "uuid": "242815d4-9e25-4632-92b3-afdde21d695c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747341, "uuid": "dedd5d1a-2118-4667-99e8-5108ba0dafc0", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3e442b-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777682873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682873, "uuid": "cc7a8e67-a26a-40da-ac98-6745feab2a15", "comment": "Malware payload (Mirai)", "value": "a8e4f074ba2d92a9807c1f4c4b4f7d9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682873, "uuid": "15cf86a9-b39e-488c-9181-5294460c0f52", "comment": "Malware payload (Mirai)", "value": "cfea6749dd5d0c037aa1eb94dc7be45f1ed7460b893ffff66c501c03af5fd801", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682873, "uuid": "56efaa1e-9e5b-46eb-b88a-29f2e850714e", "comment": "Malware payload (Mirai)", "value": "5a86beaa1ec79d4638aa2ff58d7e880569b74721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682873, "uuid": "93b007fe-795d-4675-8271-4a13f532a51b", "comment": "Malware payload (Mirai)", "value": "7402ed32de766515c113ae61b4090535d722f01f9936e60a0cee45c119dd5aba22d2fd2c710255d1ccebe3f9e326a8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682873, "uuid": "80430cde-a61b-4f09-a900-579ad4f2515e", "value": "T1CAD36B73C8296F98C265D0B0F0358F792B63A59152871FBB1AB7C2B58083D9DF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682873, "uuid": "a00bd0b3-0e34-4fe1-bef1-d0bd8bd4b828", "value": "1536:F/MOslND+6CFUE1ZCfNRI4zjlwoSz/BC0hPK9WnV8MdTtVOCWEGXg49YGPM:FhQ66aZyTI4rQ/BdhS9OdTqCWRXgyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682873, "uuid": "61f3ac6e-76a7-4615-b46c-10d4cc17dc6b", "value": 133952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682873, "uuid": "7c444108-5c21-498f-8091-31b9a4113615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682873, "uuid": "f66c231e-eb3a-4e9d-891f-be01359a1422", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67180e52-464f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744227, "uuid": "f9149c38-2cc7-4110-8669-957b206d7ea9", "comment": "Malware payload", "value": "922ca8cdce71bfbafb3dfe5ec842d116", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744227, "uuid": "0f97e722-a55c-43ab-8afd-0e94f1b9bf6d", "comment": "Malware payload", "value": "d05f508ede3043cf30f993b135a07904967129219466a7cc11cd39e9041b973f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744227, "uuid": "fa224aa8-b402-4712-ad70-484542485ac6", "comment": "Malware payload", "value": "64a80a734c07727ce348b536f0ebe9dfe8a3363f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744227, "uuid": "131c3533-ca04-4fba-a0a3-c17c125e0b00", "comment": "Malware payload", "value": "1c51ed437a4628893b55ea993c773088775517cfdc14e402bf4dc1b9b1d1b452359712f9feab098ddd17e6994fd81233", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744227, "uuid": "aed233bd-34c2-43a6-b839-069ffb3d92c1", "value": "T1B0011081466AC886D91C38F63861934E5808D5F0246741F42AC3C7EA08847A06DB690A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744227, "uuid": "22083d89-0735-4132-8751-ed73db6700bd", "value": "12:5jOqc1tgSZ76IK3/QIhVC6kDR86FYt0P3ND40ZRAXKOkMZ2uTKfaRiFMrLzqFy08:9O/2+3yIaQquYE4KeKOkq24RqczAyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744227, "uuid": "3de93f60-44cf-4c5e-8bee-a5ae3a6778dc", "value": 727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744227, "uuid": "f5bcf9b1-8b71-4daf-bfc5-931be5f1a941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744227, "uuid": "ee243785-e0b7-4400-9096-1b6fd5dcc2d0", "value": "Info.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1cb381-4619-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777721153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721153, "uuid": "b3373600-ce14-47cb-80d0-b48ae1fb2f02", "comment": "Malware payload", "value": "09ebde313d3534b0aac3c059627abc10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721153, "uuid": "59d74d93-4fc9-4172-8c09-6b621c442a42", "comment": "Malware payload", "value": "d09ba127026dc067f615b6171cfe9394e1da5125335580810b1bbe6c2268bda0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721153, "uuid": "238f182e-70f5-42ef-bbbd-e67d27ec0ed6", "comment": "Malware payload", "value": "65a4b6bfb272b89f137843f3dd36b3c419f06e3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777721153, "uuid": "e2691dc5-e516-416d-ad84-81452538984a", "comment": "Malware payload", "value": "21942daecb3bb76681966703a5fa4649c2fa317d202bb728edf19dd86b3a7293f8fa00d3091f9abd398987d918ed870c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721153, "uuid": "4cdb6387-5b2a-4194-b482-ffccae4c4fe7", "value": "T14B226393E2F06EAFC4EA1239045F4539635BCA05D71A4F7BA09C94442A43F8D7E3B35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721153, "uuid": "d0b20ece-bb70-4867-86d9-b4d1f5f6f035", "value": "192:qCAw7eUSGQZQcZ9EjqmOj1SV4PWKdGBIIJnpE5ohSG:qCbiXyjxOjwAlGFTESL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777721153, "uuid": "b31c3cf6-34d3-4fcd-95e2-8ff11acc7660", "value": 10760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777721153, "uuid": "1f82919f-fd03-4fbe-b9c7-abd28574dbb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777721153, "uuid": "5be5d397-fe82-4d14-9715-ed98aa188226", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e62f73-4651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745037, "uuid": "7846ec4b-f5ee-4020-b1de-05f99b5c640b", "comment": "Malware payload", "value": "63b61febcc2213a8c74940b7a4c53051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745037, "uuid": "4a6f23bd-ea06-412b-b3b4-2be65d48112f", "comment": "Malware payload", "value": "d1f5b9c952aff5929f7dcff0011f3c4d2845bff910bf330a60b9f49915d33e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745037, "uuid": "e7d3839c-d73c-4259-a9db-da15a9d91ee0", "comment": "Malware payload", "value": "2207e22ea45afc58b9a35f5d35502cebf11bf6c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745037, "uuid": "8ecceab9-eb3a-4478-8880-ec972dac6b40", "comment": "Malware payload", "value": "b9be7438a2ca657900e8732e0910e0791ead26c623d6e19401619ef0679a6890fd85f630fca22c8473d740744ec54ceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745037, "uuid": "c1290a35-1a90-405f-b144-6adcfefdff38", "value": "T1F3E27C46EF87E0B5F8530175403B572BA232F5395079DF32CB249836EE53620AA5B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745037, "uuid": "931b660c-bba2-4cc1-a85a-83b1da1a1ddf", "value": "768:bpshaVvd5zNxhmhl30uzAfDDv8KJjL0nfP+MizeZXIa:OhaVvdnEl3BoDndqAeZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745037, "uuid": "ca982145-7092-49ee-8fc8-d4bbfbe47d5d", "value": 33844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745037, "uuid": "6c8a1911-75a1-45bd-9b87-5df602af82b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745037, "uuid": "f1c84573-9214-452c-8149-b0fee1a11c12", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ebcf1e-464f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744277, "uuid": "dfde8e36-3699-4959-920c-c3b5c782fe54", "comment": "Malware payload", "value": "9199e33ed721e64195e76ba2206ddcf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744277, "uuid": "b6d9703b-378d-4ecc-80bf-4e004545de66", "comment": "Malware payload", "value": "d286289e326785bfbf145743a3e004e002292e7f6555a38ad74ebaf310621ebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744277, "uuid": "73c96531-3500-46e8-be94-6b7243d3c875", "comment": "Malware payload", "value": "180e01e2d0db733e145bfeee52bfdaaf799922a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744277, "uuid": "f505b75d-e480-46c9-9cad-d79188367bba", "comment": "Malware payload", "value": "228e36c6662f33b54f8b82309daa1d6afe21eef3d8c0d0e581185efa77882efb1f8adca437abb37b159d6423cc5bd671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744277, "uuid": "60de3c42-4eb2-49e6-832c-a8168c204462", "value": "T154767C91FB48A136DA460A3248670B30B3A15D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744277, "uuid": "b133f160-a38d-4fa5-a8ea-86e53918fdc9", "value": "49152:jCKwGYUgc+7O1NbVL3dyhGi/p8VWzxqRR1eiHVRW8Pwy9/MtJGflHHUt5Ee:MUtJNbVEhGZoCTji8Pl/GJGflnUjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744277, "uuid": "de7a7e9b-c1ee-4480-8bec-52e91ddf09a0", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744277, "uuid": "8885abe2-383a-43e0-a3bb-f12e4ebe3c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744277, "uuid": "8def9778-d7a3-4069-9464-f7e3835f7d98", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f98701a-465b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777749341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749341, "uuid": "e47c2f98-2337-4a81-8457-8365e4e1f745", "comment": "Malware payload", "value": "9c3231ec45e787e98e44ceab5f3c2295", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749341, "uuid": "523df496-e1af-4441-9709-a48eaf17b346", "comment": "Malware payload", "value": "d2a3784853fd83d9e8c2a5567cd47e89024049554ae9ecbae8351cb89fb34a42", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749341, "uuid": "cf41355d-ffaf-44c7-84d7-c5d1c1b8c554", "comment": "Malware payload", "value": "0217a273d79605a63d19143b2528c619f99455f7", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749341, "uuid": "69574cbe-be74-4815-bff8-e1eb9908cc2b", "comment": "Malware payload", "value": "d557e70d4ce9cdcb20edbf2018eee503e1912a427139572eae725c6e1aca3db316f17940951754e4be90e5116b666aee", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749341, "uuid": "ebf86119-5890-4930-a196-d8797d175d51", "value": "T19446F141B3D695B5D0BF0638D87A42666A34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749341, "uuid": "6ae15834-b1a6-46e0-b8a3-61d41e429b2b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749341, "uuid": "bad00fec-e1d4-4d46-979f-3b36f91c62f8", "value": "49152:6fmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:drs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749341, "uuid": "3f08c586-f8d3-4fab-8279-00c9b84cef36", "value": 5656840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749341, "uuid": "3bae7137-2b02-4409-97b1-ffc7338f755b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749341, "uuid": "caf31819-8b53-4b3d-bddb-b223fad8965f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c2d38d-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743307, "uuid": "3af6d0d4-6878-4be8-85dd-00b81b8a961f", "comment": "Malware payload (ConnectWise)", "value": "dd2c7162a730dc3063489a53ba0ff005", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743307, "uuid": "82fdef09-da0a-42ff-a783-fca45e96cb6b", "comment": "Malware payload (ConnectWise)", "value": "d2cc4d978d215a424e3ca10b9442f31e4fd48822aca3fde85a5ec73eb49c03ba", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743307, "uuid": "aa07a2d2-6811-471d-a9cf-7c13014c365d", "comment": "Malware payload (ConnectWise)", "value": "01b33ccc560ba8288ecf85b089f653ca0fedfe50", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743307, "uuid": "a07e7d90-531c-4054-8dd2-0b84978e57b3", "comment": "Malware payload (ConnectWise)", "value": "abb17f9304c2f7065de33f2efae443424eab6fd92b5784f4387659775218ab67b3fa14a9b19a090634afbe5d1b9c6c94", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743307, "uuid": "f352f564-1108-437d-891f-3362d71bd5c8", "value": "T171646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743307, "uuid": "d7a652ed-ef84-4d33-adf5-116ba72bc3fe", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743307, "uuid": "3d1bf028-da27-4fd1-a907-26d158a8a9b0", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti98l:A1iw7gryNkSV1hy1Z1u2JLI9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743307, "uuid": "c76f9080-3538-401f-9bed-f183bdbbf6ac", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743307, "uuid": "f8335e0b-cdcd-450f-a6c3-fe8f81d684a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743307, "uuid": "39870d2e-1ee1-43ec-a703-0062646c0449", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f949a8b-4621-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724323, "uuid": "0f98eec6-61b9-42aa-88b7-e036d4881bc6", "comment": "Malware payload", "value": "ed74627de365e6c4c371ecbddfb7c6ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724323, "uuid": "e361b6e5-aa5d-458a-b1c7-f426aafef688", "comment": "Malware payload", "value": "d349b2a6911bb59144c850bd56aaafd06469b304c3a3951bebaececf6793e5bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724323, "uuid": "17790c54-59fa-4be5-9fec-849534816fef", "comment": "Malware payload", "value": "39c975475b00a5a77c75ed729f1ed87a38670a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724323, "uuid": "14a12065-80aa-4a95-9430-fd3d1bed128c", "comment": "Malware payload", "value": "48131846ee69a9721459e7ae135f55f601bb0206d043eb2c9fee1e9d9e51b0ffe9a18c10a121ec59dfef43dbb70e56b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724323, "uuid": "94764127-4fb8-46e0-bee3-d14d997666f4", "value": "T1B852C887B792CE3BC0E0C23005875135B5B3E8B5DB22632B1905A6B16E53B9C1E1F75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724323, "uuid": "629299cd-fa66-45b8-9cda-fe528eb3f5bd", "value": "192:G/RMvxFB7lNTOcSR2wxtAQFmYl/NQsGDYox41kQIcSS:U+vxFBu12GtAQFvl/qWyAkQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724323, "uuid": "b6a43759-0313-4269-8307-f251bc40d7e0", "value": 14080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724323, "uuid": "1dd3d85f-b2b2-4b9d-8035-a4d2ffb4b582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724323, "uuid": "417d3d7c-8459-4b7f-b95f-204accd3ad34", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8b11ce-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743321, "uuid": "ca6fbc43-d710-4916-bd8a-50edcf9072f0", "comment": "Malware payload (ConnectWise)", "value": "e649ca39103da9051827380d40abb038", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743321, "uuid": "1814443d-3f87-431e-b16f-53c46a463a2c", "comment": "Malware payload (ConnectWise)", "value": "d3ec837279d37a10bbaf5c64c0021020ab40f709a4150b8aba181ae5ffa24c6e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743321, "uuid": "56087eb3-7a4d-49aa-b3c3-5adf6212da5a", "comment": "Malware payload (ConnectWise)", "value": "bf8c8fe09fd4549b82fc088cb14b0fdc786054e3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743321, "uuid": "06999cc0-9c4c-44e8-88c9-184a6f3f6fba", "comment": "Malware payload (ConnectWise)", "value": "04a01eee0cc5b94013099ec102abfeaf47dbd4c71982323b351977a381d156280e0307e6350fe2caeff2529526b7bfcb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743321, "uuid": "4aa83e6c-ff67-48ad-a177-606cd3b7066e", "value": "T1BD46F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743321, "uuid": "a8dfc325-80e9-4f07-b1ed-0876d59c7f76", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743321, "uuid": "bd58851a-58d0-4b8b-8ad8-64767322e26f", "value": "49152:sfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8ifD:Qqs6efP3rn/TYGVxz3GBwRVkGuyXOMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743321, "uuid": "befad25b-7d7a-4a95-a161-58828d0f9207", "value": 5698144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743321, "uuid": "e6b04f64-eaa5-4156-ba11-5defaa3cf94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743321, "uuid": "74fa9d45-8d1e-4238-b285-28e08851f4ca", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1548316f-466e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777757404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777757404, "uuid": "97e255c3-871c-40f6-983d-b08b5b000b18", "comment": "Malware payload (Mirai)", "value": "d5ba6143f6d0b519da37a50b555af937", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777757404, "uuid": "e41acf0a-1961-4e50-a7e8-15ece3a07a6b", "comment": "Malware payload (Mirai)", "value": "d496b03b6bd5dabe6c314ad089185789c0d476ca5bc825a450f2daf2a52761a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777757404, "uuid": "0124e669-8387-426a-be58-5593a14e11b0", "comment": "Malware payload (Mirai)", "value": "5bce6edfb3ffabea0936519d3fa3ca10002fd650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777757404, "uuid": "8af5c39f-4214-4e56-a368-9b1ade191a5d", "comment": "Malware payload (Mirai)", "value": "8b1c0cf9e5d58c57466a0984e5c057385a8966c29929d2d2aa5acd69053a8fa77de5301f678001e23eb69fb98827314d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777757404, "uuid": "1067b33e-b6f9-430c-af4d-63470820482c", "value": "T14BC59D63D868AFEBC526D571A538CEF60B536800521A0FF63596E3B44947AC2F3067F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777757404, "uuid": "b843361d-7ee5-49a1-800b-5f7fa464f47f", "value": "49152:HtmenlpiDI+eadQTvEmT0/P34exRNQVd5+CV1zkqtC5wvPseX:M8y/DMze5wse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777757404, "uuid": "bc875bf4-e244-4537-aa5e-6d4200da032d", "value": 2682664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777757404, "uuid": "321e5eee-fa7c-4a2a-b8ad-cacf18398e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777757404, "uuid": "c97db9ed-db34-4710-abc4-38ed5383c844", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8774bc4-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724177, "uuid": "edc270c0-4d3a-4b4e-b2ca-320432d82f57", "comment": "Malware payload", "value": "51d3b8daef141be10e805a6f37cc8049", "object_relation": "md5", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724177, "uuid": "509a9107-49bb-47d0-96cf-51352cf9100a", "comment": "Malware payload", "value": "d49f69b555858ae50827b2df8af7b14b6674f9f1dcc83c158edf9db90339d9ad", "object_relation": "sha256", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724177, "uuid": "8bb7b1a6-6a16-4ea2-9169-cc78c95cbed8", "comment": "Malware payload", "value": "08d676c904be10d7023eb8da34a3d9802a3d9535", "object_relation": "sha1", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724177, "uuid": "a3c827a9-f763-4ded-949f-3bb7f3241744", "comment": "Malware payload", "value": "48fcaeb4f1f50f2f24c42d0c415eff0d756d78df1f1a931f4f8b5d3e3adc1c9226b3ee76159248971260fdedf6ef512d", "object_relation": "sha3-384", "Tag": [ { "name": "comples-biz", "colour": "#201400", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "firewai-biz", "colour": "#5A4FAB", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724177, "uuid": "511dd492-387c-48e2-90c8-b7f503e0c7d1", "value": "T1E8D41CEF6B6465E0D8E16AFDD4D06D0193B07C9CB990409A1282FB3BDD3B9B38E1815D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724177, "uuid": "cc6f73e8-66e7-4e18-bac4-ece04826e395", "value": "6144:sglEaO3q0jtJSbKjeDafyhzLR8TT5EkntVTeVxq:zLYq0jrSbKycyH8uKeVxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724177, "uuid": "a55d9900-da5a-402e-8d38-4cdeb5e73903", "value": 649968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724177, "uuid": "e7a41f2c-1931-4ee1-9867-c4fe6ddcddd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724177, "uuid": "b669259f-52c9-4b2e-9a8c-8a997330eec2", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73b1ef0-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (N-W0rm)", "timestamp": 1777706136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706136, "uuid": "85da3502-d018-4d7b-9b9f-193eb444db5a", "comment": "Malware payload (N-W0rm)", "value": "75129373c27ff1d441f75533181be9e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706136, "uuid": "85ef9413-0fea-4aa3-b153-281654df204d", "comment": "Malware payload (N-W0rm)", "value": "d65c755ee4b5560ad58ac6ec373d5cedb332ce2282594d098b7360f9505daf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706136, "uuid": "3ff3adee-8ac2-4125-b9d6-498c70c0da84", "comment": "Malware payload (N-W0rm)", "value": "8c5d0a3baffbe2df5881e005491e6e911f4766d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706136, "uuid": "87d3be8f-542c-4bc1-b2ea-fd26257de7d0", "comment": "Malware payload (N-W0rm)", "value": "73b6148b74a581501bdf8426c94759b3df9a7e443664133b2872e9d635c272a57c837f4e1e92ce60024b90be3f0ffc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706136, "uuid": "8ae1c78f-5dee-4eeb-b280-109f6a96934d", "value": "T1C01833C1C6B89A10E89F1931A76798A31FC4EA4B5BC08CDAFB6D96461FB00FD4913177", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706136, "uuid": "c3ef8c1d-3d46-4336-b094-c893138b6e40", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706136, "uuid": "cd3aa6be-f169-4b10-bfd0-fbaffa475289", "value": "1572864:pyIq81FUXfxiPYmVXa5SXuDjUNZTYyrNdJXUrXRTb9oXSZnnNyBVVxodi82a:pznIfxiPYIXESXNZTvrjyd9oiZnnNyBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706136, "uuid": "f1ae2ac2-8787-431a-9b7d-cf0748b9d701", "value": 87870201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706136, "uuid": "9e0b8b08-02a4-4071-8f78-75496a7f2900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706136, "uuid": "6d35b588-3d99-4c3a-81eb-cb08acfa83d9", "value": "75129373C27FF1D441F75533181BE9E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3e157c-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777744019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744019, "uuid": "74bfce2c-887d-4b38-88f2-1c365ad03277", "comment": "Malware payload (Gafgyt)", "value": "5b5e3dd78f78367f45d1e2091f06377c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744019, "uuid": "b61b21f2-9d8a-4b45-b78e-c382cf3bc38c", "comment": "Malware payload (Gafgyt)", "value": "d6d5b8d6d7ab38db9f4291ef854a0abd45dd3369d4c320efb0c946748cf77e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744019, "uuid": "090d6857-cf02-4f94-8e86-8fb9c7bda320", "comment": "Malware payload (Gafgyt)", "value": "211a7581f90d42a0c801282d76cffd00f1301f9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744019, "uuid": "1f549337-bf30-424f-b729-d2b6d2ab6059", "comment": "Malware payload (Gafgyt)", "value": "90810a61962867d184e4c2b4f03461a228b224ca6d92db43d8fcd6de4f42c92cde89b9ea6cee9f2648cdb1107637fe1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744019, "uuid": "4d5b96a6-1f3c-402c-a309-096d22697fd1", "value": "T17833E8566E218FEDF66C823047F74B21A76D63E523E1D685E29CC5001F7038E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744019, "uuid": "20ae5e5b-551d-4e7b-b5d9-8073c2b044a5", "value": "768:TpARDhDH+mS4qnsjiyZ+REe0R/QWmqH6RdMsIWNAs:T2nDH1QYe0R5wdL3ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744019, "uuid": "ffe4380d-c566-42e7-82ba-873ffe4991b8", "value": 53160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744019, "uuid": "e5e38927-5675-45be-928e-739ab4873393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744019, "uuid": "b7ea96b4-0c1d-44a4-8808-d543f3dd5c04", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c22e44e-45e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777699916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699916, "uuid": "668cf4c5-4c5c-400a-b96e-bad931dec172", "comment": "Malware payload (Mirai)", "value": "912f2d189938bf1d5e6d571e400d69d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699916, "uuid": "56fbfe53-d622-4ef2-9472-6a19b31bd0ca", "comment": "Malware payload (Mirai)", "value": "d6d6f00258a6a2871ec636a6bcfd0e25851ee9d6b48c87947a709dbc1c059926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699916, "uuid": "f7c64331-baf8-42de-ab02-c42f70e2d228", "comment": "Malware payload (Mirai)", "value": "8908f1f34c752b3307f585e31118e043f9031c81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699916, "uuid": "975e126e-9e01-4b3a-b604-e3abc46c67ef", "comment": "Malware payload (Mirai)", "value": "560495ff4c9261df8b2a74b81fa3f9f918713d227c1b9530664dc156dda206ec482a8d92504e5fc56dcbe7243844674b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699916, "uuid": "b86f585c-7138-4e93-bddf-0b37c06d57f1", "value": "T10A63510ABF611EF7F86FCD3706E42B49308C641A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699916, "uuid": "1ef06c68-5359-49a5-9649-cca79085a587", "value": "1536:k986lZoTAtqVclf2VNufYuI0Kck6n2MFKwbZn:k9jETAt8c92hulKV6nUwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777699916, "uuid": "f3e779d3-a917-4776-8514-e0a316c3144b", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777699916, "uuid": "9f6a736b-1e27-4d88-a78a-258154e2ed1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699916, "uuid": "b59dfd82-a7af-41c3-91b7-2458f60ccc56", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bea5c0-4609-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777714235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777714235, "uuid": "59497796-b619-4aff-9fba-e497ed3d9c82", "comment": "Malware payload", "value": "1b53430c38d6c8fb271ff3503f206184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777714235, "uuid": "3ae856cc-1447-4d2b-a936-9ff9972ec3d4", "comment": "Malware payload", "value": "d73f0d9625436ae89c4639ff7e4ff0dd42fae970b5e3562e79fd4bfd90b0b7b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777714235, "uuid": "cee4ee20-b9d3-4d93-9870-b66dac703f32", "comment": "Malware payload", "value": "180997293551e5154f39b7997ace268ca8ddc914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777714235, "uuid": "f97bcc93-7a14-497c-8138-2081d76a3d9d", "comment": "Malware payload", "value": "6606b76a3110d6145d95790f99b10f1230ab6e7de1fe87e6000faaa15e0641f2546fc33ff4cc534d8b4406a9d2bce71e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777714235, "uuid": "6288be99-9c5f-4dfe-b46b-31b40a6de6ea", "value": "T1E2665B73905614D8D1ADD974D5152213BEA8388B273873DBBBC076F11BBABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777714235, "uuid": "db055d9b-3e03-4587-a608-df5011b272b9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777714235, "uuid": "ba5d5e1f-f2f3-493c-b69b-455dfd2f1eaf", "value": 6717440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777714235, "uuid": "4d43d958-4148-4833-869e-af41e7672e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777714235, "uuid": "ad8c1b48-045e-47ff-9ac6-7fd105f5df65", "value": "d73f0d9625436ae89c4639ff7e4ff0dd42fae970b5e3562e79fd4bfd90b0b7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b74ce10-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741657, "uuid": "dff3c13c-8be4-4b46-a77c-e77ab973ab06", "comment": "Malware payload (ConnectWise)", "value": "9d1d824f2f32b13babe6124e8ff5f5c3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741657, "uuid": "aae2956c-24fb-43c8-aa79-efb704b99eb7", "comment": "Malware payload (ConnectWise)", "value": "d763126ad50e8d7bec7c88d8f5700f3fda49742aa8a413573f16f6a5cc916375", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741657, "uuid": "0bf4f7cf-2c42-4f96-89bb-0356b3d62d38", "comment": "Malware payload (ConnectWise)", "value": "57c65163a42d586806fa6cb6038f09b41efbeb29", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741657, "uuid": "9d068463-17fa-4c91-ac4b-0d93ce75299d", "comment": "Malware payload (ConnectWise)", "value": "6d155613446cff18b5e9cc8a41a003f1c2fe8b406f4aa74ebfd73956622434458add09f87a9c65dc22041aecb8d188d4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741657, "uuid": "d22cf4ec-fbd4-4722-a12f-d879b2829fb7", "value": "T1A346E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741657, "uuid": "08b44a3b-c30b-4a7a-a316-61a99b208fa0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741657, "uuid": "2c4063c1-56a4-4229-b426-2ee701109b78", "value": "98304:tzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:thfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741657, "uuid": "ef46afef-4fd0-4f19-a6e8-5c990efa3b17", "value": 5642400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741657, "uuid": "705debb6-758b-4b00-a5e1-057067170fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741657, "uuid": "131c4334-352d-45a4-9007-1a76c2436f30", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2ef236-4626-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777726542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726542, "uuid": "131047c2-2d2e-48da-985c-bbe41feee1ff", "comment": "Malware payload", "value": "101f98e092e4fd6bfc56d91d0ec3c31d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726542, "uuid": "beecf882-4b8b-46e6-aba3-19a6645e0b58", "comment": "Malware payload", "value": "d91b809569b907d26762192ec5aec28eaaafa57d73227d4e188a24dab5586b14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726542, "uuid": "b3de342a-f888-46c2-bf6d-c1075d1d36ea", "comment": "Malware payload", "value": "fddc1f57fa91e8c2f51fa8bed9cb089c4986b544", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726542, "uuid": "aaf1f490-a68f-4b51-a72e-d86d365b7d55", "comment": "Malware payload", "value": "fc85a7533f78bf1cd61c5fe525f3a9ca64709d396c32076091102ec046b3f57ae42e513e8c3fcfbdc2f49445f6bdaef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726542, "uuid": "755b8968-e389-4b86-8ca5-c4d5a758fe63", "value": "T17FF19FD5A599D342CFF47DB584620E81BFE458D100AB6D0970C1BDD1B4F8AB583862BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726542, "uuid": "c186dbee-83f3-490c-af7c-e01d32079e24", "value": "192:VGGWTeUSc7obqMMX9rI0FrhkGauma+XBZUmmnDCvszz:VW0+B+0pe5BvEDgsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777726542, "uuid": "648e0c38-d79e-4b88-8a86-e6c56467bd41", "value": 7560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777726542, "uuid": "f8fc2342-eb67-4936-8d5a-237802f7b59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726542, "uuid": "0d1b3160-7d12-475e-bfb0-ff5419b4e039", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c668efa4-464d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777743528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743528, "uuid": "ea943451-1f1a-4db6-b099-bf283a91ac26", "comment": "Malware payload", "value": "768242a6644340b26edfb44474e31b44", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743528, "uuid": "aec07f72-2572-4ec4-9a54-380daa4174a1", "comment": "Malware payload", "value": "d95892efd6bd584a51fac278d544b71d3b6c26788b6ca4580b188df602f96b1a", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743528, "uuid": "449216b4-c61a-4ec5-bb57-d75068ce183f", "comment": "Malware payload", "value": "ec02e558c46f55a9320e85fea31b59a897b1004e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743528, "uuid": "cd0f7fbc-7851-4abd-853d-ac5a0d1db521", "comment": "Malware payload", "value": "7c884bb8e06798ef190e3d2b28e01729931065e7c6cb0551446279127d5ced40b495ca956bb7196806a932b17ae00b18", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743528, "uuid": "a0b14b48-01c2-4e21-a06d-5f41ff66745b", "value": "T19E46F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743528, "uuid": "ca58f9eb-f981-4529-a6e0-b2f5e5af8760", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743528, "uuid": "992b0775-6e27-46ee-8f4d-6afe3339ed80", "value": "49152:ofmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:vrs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743528, "uuid": "9a64d91f-fcbd-4d3b-99aa-476590fbd71c", "value": 5648368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743528, "uuid": "51c21973-30a5-419b-81e2-97d34fd74fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743528, "uuid": "bdc9d9c8-fcfa-4089-875b-17d8600964cd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10376ad1-45c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1777684810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684810, "uuid": "749d2ba9-ad10-4eb6-be1d-026ae2ceb6f6", "comment": "Malware payload (DiscordRAT)", "value": "810302ee96fcbc77f5803402642b1d56", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684810, "uuid": "cf2dbd28-8246-4363-b20e-cf270aee0ff8", "comment": "Malware payload (DiscordRAT)", "value": "d95a81d0680c55f5a6fbdafc6aee33ee81ff03bc28dbfc5ebec5c4d484733cb2", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684810, "uuid": "629c829f-9e09-4c93-a52a-74dc556ffabb", "comment": "Malware payload (DiscordRAT)", "value": "a84a651faa56e44201cff7a5c0eff1d3ccecf073", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777684810, "uuid": "a78ae856-324b-4b83-baba-d816c8b0b76d", "comment": "Malware payload (DiscordRAT)", "value": "db844a465613037eb4f0af35550913e55561aa46992d406ef71285bef8f7a5d02f9e0e09f80e7d138ff97878fbfd4c7c", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684810, "uuid": "e285f976-01af-4073-8ca8-c7d592ab76a5", "value": "T17073B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684810, "uuid": "5a708b21-97a2-492e-ad8b-a0d233827568", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+qPIC:5Zv5PDwbjNrmAE+2IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777684810, "uuid": "c71751fb-6fd8-429b-a727-52e6335907c9", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777684810, "uuid": "d0eef811-df98-424a-905f-23fb1e714611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777684810, "uuid": "88844e5d-0d6c-464f-bc5c-f1eecb040484", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc42cc4-45ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777702795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702795, "uuid": "cfa50045-ae91-4484-9ce2-04f1175646ec", "comment": "Malware payload", "value": "21286d4d38ff710b8865cd0562bd38b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702795, "uuid": "f5fc4793-1539-4ad6-a8fe-c8ac717e7b47", "comment": "Malware payload", "value": "d9d42059791eed7076b650b83fdf5613f56d292df4245a6ccad5a1e42ecac698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702795, "uuid": "61c5a97b-df12-4eef-b7a0-47f5abb56e99", "comment": "Malware payload", "value": "2106e76c1101c51b7794a45ed02b90546d75fdb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777702795, "uuid": "6b668996-728e-4057-9417-ed372d9d2b14", "comment": "Malware payload", "value": "e4ad6a3c0279b1649aab19bb11841bc9f208c424bd406ff579fd132cb900f5e3746f844860c0388474421de61bfa3f90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702795, "uuid": "59a47f52-14d1-4b68-a120-3bd280c2e225", "value": "T11933F985BD829916CAD80377FA1E42CD331173C8E2ED7223CD257F51B6CA52B0EAB061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702795, "uuid": "f101d6ab-7186-4f10-b12c-01ca731aa906", "value": "1536:MYFWtRPT3f1qgM4hUGLh1n544D0bwbZn:BWtRPL1ptmGLj56bwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777702795, "uuid": "20d267f5-71e7-4aa2-9b9e-f55bc36f550b", "value": 51624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777702795, "uuid": "8e6dcac4-8ed6-4784-9d64-0f61a31e1ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777702795, "uuid": "3d2f02cd-a394-4676-a0e1-b24251ce8d9b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fa9ce7-45f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777704958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704958, "uuid": "b078ab3d-e22d-4b74-9002-7a2f7b64d92f", "comment": "Malware payload (Gafgyt)", "value": "8533ae56c0e40689ae530e8cc3d94d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704958, "uuid": "9a318dae-5c06-4502-9914-bf1de404abff", "comment": "Malware payload (Gafgyt)", "value": "da95a37de0ac511327feb0adb71835e802f34e3b224f0464d82e9a5bc083225f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704958, "uuid": "4e958896-ecd5-41c4-929d-a1ea48533e3f", "comment": "Malware payload (Gafgyt)", "value": "56d7c9109069f20c7503d51ced160e05d5f621fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777704958, "uuid": "22e5d2a9-5b04-4702-85d0-7989dff46015", "comment": "Malware payload (Gafgyt)", "value": "0491f082ac8c5c81bb39622b09a4ad3cc0f2afd6e1a8c489013f47db08bb580c2d7e9b137d77e20772e98d48d00a9efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704958, "uuid": "22c966ad-447a-45a1-9427-61e6b3edc4bb", "value": "T1E9A34B03B6D18DFAC08BD1F047DE6A259D32F4FE176371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704958, "uuid": "099bfad7-296d-458d-b903-7033c9ec8855", "value": "3072:9DO69ISyGiQwIc2BkhP9HJkVnlH9wJ3r93MZdV:9DO4XfA2BkTpCHuJ3r930V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777704958, "uuid": "cfce7359-e7a0-455a-9734-3b50e0eb6734", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777704958, "uuid": "fb8bb41e-be83-41b0-934c-58332dd208d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777704958, "uuid": "1bbf1b21-cc3f-4c9e-897b-ca2a2c929d1d", "value": "x8664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c751cf-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719282, "uuid": "f2ea7780-2517-4b0d-989a-ac0c6447b294", "comment": "Malware payload (Mirai)", "value": "a0f8f5e227f946f6d7284042a8ce519e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719282, "uuid": "aa4e7bfc-6cd7-49bf-875f-36c7342e3f9c", "comment": "Malware payload (Mirai)", "value": "daa9c5c7bed07c6e6b377b300c02101f83863f9c4c1f5e920c9276dd53663f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719282, "uuid": "65bc16b5-6448-4f48-a39f-4f9fea85db97", "comment": "Malware payload (Mirai)", "value": "e2d4c14ca8214b284f15ba19986be1b3e2923a60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719282, "uuid": "849a3d6a-addb-4e6d-9688-939691abce9c", "comment": "Malware payload (Mirai)", "value": "ec33ce6db55a4ed435d4bb8510a8c80b361c4f629a09f7e8d3fd6e181d80cf41d9556f2d2eb92922230a31fe24b62558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719282, "uuid": "14a69031-bf1b-4ebe-8ae9-051c30d2233e", "value": "T1B3948413DA214DA6E465CCB312673341688F82BB48E636E3E9768960FF2551F42FBDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719282, "uuid": "d3899cef-9b13-45e7-8de8-f1806e3077b1", "value": "3072:6Yuvu7uDyvoj/d9fqxOX+eUxmphRVp3ULmkgCbp4PIz+joCFG1:6D2yDyvoj/d9qA+enhTp3ULJbibjo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719282, "uuid": "ec7975b1-4f53-4a33-836a-492665e7c163", "value": 423716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719282, "uuid": "7c424149-9986-474c-bbf4-94b755304294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719282, "uuid": "e43f509a-7cfc-4ead-ba41-9fc748242093", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba093ae-4656-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777747375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747375, "uuid": "b7a4a3e7-55fc-451f-a9cc-91c75981d82f", "comment": "Malware payload", "value": "69342c34f20be2868d0514496f2f20c2", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747375, "uuid": "4afc7b16-5d8e-4cda-a30e-5eac10ea85fa", "comment": "Malware payload", "value": "dab67a8d54e0055221590937ac08ccff71c72e1b0e528e000c31310089d0a738", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747375, "uuid": "24ca406c-f83d-45bd-8965-ee09c6812087", "comment": "Malware payload", "value": "01aa303baf961170db4f73f9aa98f18cc1910ac8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777747375, "uuid": "f0452bf0-a5a1-4efc-95d5-ac30b9763cfe", "comment": "Malware payload", "value": "9b9bb62af13efcb0a10a4b5db0ff024883c137ac9ca38290a3dbab6c94853e54a5c6138b48f2cf48e03fc0ab6232ce1b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747375, "uuid": "8360c467-bbcc-4ccf-ab31-5d1de0675d9d", "value": "T15A676198F4E994B5E36983567652CD7F0DC8E7C10A802CFADD00DEB2759CD1DA01BCAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747375, "uuid": "8bb51753-6dc2-434b-a23c-01477230aa24", "value": "fe3e8941d8705fdd6223e1f726e3284b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747375, "uuid": "a3f8a2dd-6dd3-4728-9a7c-dd029460b608", "value": "786432:urnFX9A/e+EQls22A1jscEzBWqjBKhbEm:yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777747375, "uuid": "cd21ab24-66cc-4a8a-ab70-978d4bb22b45", "value": 31590999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777747375, "uuid": "0af85e17-a3b6-49c9-b967-3d1f1493da7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777747375, "uuid": "2f5c7f05-a143-4d41-b0c3-a4e4bc364eff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d641582-45f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777705072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705072, "uuid": "7f0aefb8-5d86-4447-b6b5-e7c5f401f4c2", "comment": "Malware payload (Gafgyt)", "value": "801e4c95b558edabb6c810f2358f0f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705072, "uuid": "19f80c8d-7c30-4e80-9a27-b6bc3388bb6c", "comment": "Malware payload (Gafgyt)", "value": "dafb6c066b82157fab686559da2af3fdea7db026611ee6c843c886710d46d6e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705072, "uuid": "3f56e41d-59c3-45c9-a7f1-e462fcb42bc5", "comment": "Malware payload (Gafgyt)", "value": "a59f08a5fa579205b365f4acc9a01181d8b223f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777705072, "uuid": "7a4e9276-6aab-4c86-b4ee-ac5eb6042c1f", "comment": "Malware payload (Gafgyt)", "value": "840516be7861227fd3d5262743b8345d4fbbf63eb5c5039689f3fee6dff797e155897f9118d2e478e11028bc68705701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705072, "uuid": "c320e59a-3b8b-4508-ac02-680ef62fd2f3", "value": "T1A4B33956BD018F53C2C315B3FB9F47887B2667F8D2EF3203D925AFA1278A4D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705072, "uuid": "bcfdabad-fea6-4957-b818-0e0ce0810d30", "value": "1536:VFL4kuUU3i9NwlyE8r47XGF2r4aYBCmerwO0J23+ZbvRdQr19xvT5hOpSXq:VF0TS9SUaGQkameT073AXT5hOpSXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777705072, "uuid": "6a0eeb85-979a-48ac-b5a2-8bb82f9b60f9", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777705072, "uuid": "50831cc8-b4a2-4017-b866-bb846dcfa9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777705072, "uuid": "b3fa0f35-e58b-448a-b985-9c8ff1dba0cb", "value": "ar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99804c59-467e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777764498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764498, "uuid": "ff8ba8ae-2f43-48a2-a84e-9284b37ab055", "comment": "Malware payload (Mirai)", "value": "6731e0e273e021a229b11481f782f60a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764498, "uuid": "6ebaae2d-562e-4fd2-b1ef-7f5d97ecd26d", "comment": "Malware payload (Mirai)", "value": "dafc5322de2542d327656373333afb07baf4cd5dd21b83362da13a3d9fe1859d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764498, "uuid": "33b2fe4a-8618-48aa-a332-dba3bd60d612", "comment": "Malware payload (Mirai)", "value": "d85ff40ba1a30c96bda60958e6b97cc16c82e2ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764498, "uuid": "94d10b9a-e2b2-467b-919d-8aec8dda746f", "comment": "Malware payload (Mirai)", "value": "835a360c2ac3e9ba3d4fb3fce301514b063def54df523189f6d256f206a0a2f08469c1101f216ed05024f6874432f611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764498, "uuid": "a171672b-877e-43de-a75d-434ebaa0bcf3", "value": "T174E5F95B5E319F2CF7B487344BF34A34E76A62D617A1CA80E1ACD1045F6025E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764498, "uuid": "45977ae0-723e-45fd-9547-9806ccb9ee79", "value": "24576:Aa+Q0D+6H3gtxg5fHQdPWm2EX+iKAIQZCkUOAjGBq1NYJiUsHOkgtFICA1vPfbqz:ofv6OmT+iPCkUDK9F61vPfKJff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777764498, "uuid": "62175449-be85-456f-8734-af3378bd3785", "value": 3152136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777764498, "uuid": "18c205b9-fa11-43ef-98a2-0cc016f4a571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764498, "uuid": "795473d5-80fd-4bf1-87bb-af30ff439c0d", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d92fef7-45fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777708885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708885, "uuid": "d4000f1a-76c9-41d5-a24b-1b40682a9373", "comment": "Malware payload", "value": "236f7323bfdc8fda49bd31a84d73ff0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708885, "uuid": "4722e5bc-84d0-430e-9a85-2c3596ce0a1f", "comment": "Malware payload", "value": "db5bf3ebbccc6259fd489e64476260adfcd159d7618847ff5e7729603ca796c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708885, "uuid": "40bbcc38-bd20-4d14-af96-4595fa05b7a6", "comment": "Malware payload", "value": "5f88020b08d2ee1483037d15748ffa54c4f67776", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708885, "uuid": "42ef0485-1164-4a32-bfe9-ef2db6d6bd43", "comment": "Malware payload", "value": "c3bcdda43a59620cf7632b20e3c6fb5d0e59a1c2484d67095dcb4a10eb58bc31890cf7aae3445621313ca42b7295789b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708885, "uuid": "ad4d84e4-f4c8-4c03-8aa0-fb4983b3cdf2", "value": "T155358D5BF2B370BEC167C031479BCB635936F46A01226D7B71C49A342DA2EA41B16F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708885, "uuid": "5712f0a9-6d58-4e52-8605-7442a08bb502", "value": "24576:8iwj1EBnp7VqHuXPAUMZ4mMESHk+814UF8NIfd:8hj1yp7VOuXPAUcZSEUU8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777708885, "uuid": "564696a3-a624-44d9-88a3-a8ed1be4222c", "value": 1113432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777708885, "uuid": "38285d6e-2dee-4bb6-8c2b-f2d3d73346fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708885, "uuid": "7567c278-c407-4949-835c-8e73808531ff", "value": "LinuxsystemANR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2605a84f-45fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777708469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708469, "uuid": "5a37d7f7-df01-4bbf-8723-2c0d98bf5012", "comment": "Malware payload (Gafgyt)", "value": "878125d98ee0e0d2cc57954292fe9d46", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708469, "uuid": "d0c5bd40-4287-4ce5-93e2-c88f66ac3b91", "comment": "Malware payload (Gafgyt)", "value": "dbf0d9aaad982c00ed0314754078b2c67b30d79ee3f7ee8362359faaee3eaaa7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708469, "uuid": "eb5796a6-1b9c-4295-8160-5c47f85f12c4", "comment": "Malware payload (Gafgyt)", "value": "6ebb500d67dc5c1cf187b6db9300461565449140", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777708469, "uuid": "16924114-2444-4fa2-babe-55c200cd6fdb", "comment": "Malware payload (Gafgyt)", "value": "ec4bb6be4bdba4ee1ba68a4ba9dc6060c9e9a10388ed6376ec9658a4ed9bd3dadb1e5674e326f9044f4ddd87428aa6f4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708469, "uuid": "87bb3029-996a-42c2-bc10-b6be4ecf8014", "value": "T187E31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708469, "uuid": "dc1233a9-44ca-4ea8-ad98-2538b4d929e7", "value": "3072:NhIpLBHaO0PXKczy9wqel5hVjeKFmzZQQAhtRq6AAe:Raczyhel5hVjeKFmzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777708469, "uuid": "98cfff44-af46-4ac2-8a95-2f9ac373df93", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777708469, "uuid": "8a523a47-0fb4-4112-9854-9968d7c17a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777708469, "uuid": "c8182d05-e117-4808-b513-c2714f8f876d", "value": "Okami.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47fa74f-4655-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777746960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746960, "uuid": "9f05a838-373f-49b2-af68-e954f4e51d08", "comment": "Malware payload (Mirai)", "value": "c014bf05cb887e1f551889e1d66fa14e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746960, "uuid": "e03bbc6d-dfd8-4c51-b0c2-cbe66c938de8", "comment": "Malware payload (Mirai)", "value": "ddf2834469b3f8ba1468947d124f31cbb39e9a239a4e9c950460f258acda4bb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746960, "uuid": "89a9f39e-509a-4d30-b13d-f535a2753fd9", "comment": "Malware payload (Mirai)", "value": "d79526be4a58a3b54351fd4c4e23ff7a62956c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777746960, "uuid": "170ce73d-b9c0-41e4-b5d1-ee8abc56d441", "comment": "Malware payload (Mirai)", "value": "5839dda4db8e29f80bda80f4ca3fa9643d767f55c2d82858911a3eea45f1c39c6e061a23504c1847b2cc19188e5683bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746960, "uuid": "a608a2d3-d48b-4798-bc1d-7091a628e89b", "value": "T111C32946E7808B03C496277AFADF42553323DB64D3EB63069928BBF43F837994E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746960, "uuid": "9adac317-2160-43fa-a7e0-30928db9951f", "value": "3072:XVj8a8SNFkcQkpOGBugZMZiYyyM/9bW/u:Xl8a8SNFkcQ1G4gCZiY/M/9bWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777746960, "uuid": "9101116b-75cb-4016-8206-612efc8e64c7", "value": 124183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777746960, "uuid": "b051917c-41f2-4d54-bc47-51d352705a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777746960, "uuid": "38c09fa5-fce9-4290-a57c-4b834f089adb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae06c11-464c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777743106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743106, "uuid": "d0ff17e8-33b1-40a3-84b1-bc7d8737f066", "comment": "Malware payload", "value": "afb658b12feba02137f05e159b0e6607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743106, "uuid": "a3dddd04-3072-42c2-bc2f-1dcd9b1206cc", "comment": "Malware payload", "value": "def7668fb946eabf1e9123dbe2566c9d30074bdccecf4cfeabe68425fa54bf20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743106, "uuid": "11635ffd-d568-469d-acae-636c2a30cd5f", "comment": "Malware payload", "value": "7db2a9bc3667b28c903796163a82dd8d912dda40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743106, "uuid": "1e51a8ba-3388-4072-b855-ec2dd136d42c", "comment": "Malware payload", "value": "f048c9ea359d01c7a95959aad5ef6d1e7616df421ab136a2d01b39ba49cbebb2cebece8915cab0f5085a9f7caffec0c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743106, "uuid": "a21849e5-8bdf-4ccc-8659-2f9044bb7072", "value": "T110233C4CF7C3E4F0E94E0A71115BF7BE96344E025018DE6EDB94FEA6ED32A12605B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743106, "uuid": "9ed01200-90d9-4035-a5f5-8ca65882785a", "value": "768:wUM3RCjT9mdgFxDg4+go3ozKF4+T+2DRyRqDWbTnVTJUW131cXjAzKpyEr:BT+Rg4oKT+RhFTJUK31cXjA2nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743106, "uuid": "fb240e05-cce8-460b-86f9-f7d4bcae69c9", "value": 45680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743106, "uuid": "54440e61-56dd-4d8e-ba6a-1463b3886b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743106, "uuid": "4c5cdb89-1807-42c5-b4a0-0fa10b305c5a", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0399e14-465c-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749906, "uuid": "958ee1f6-fd8a-4261-aaac-61a9db75bc8c", "comment": "Malware payload (ConnectWise)", "value": "316a4d3ae3e986afc83c94bef212553b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749906, "uuid": "b5a40b13-a6eb-4281-884e-74bd12a7e7b7", "comment": "Malware payload (ConnectWise)", "value": "df0a07dd29ea4f469c2a59f2b196f6e88d9ea6f591c172b271f02113c30112f1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749906, "uuid": "5d9430d5-3f1d-4f74-b32f-9417794e1779", "comment": "Malware payload (ConnectWise)", "value": "eb1701bbb4370aa1ea3205e3070bd15571610ce2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749906, "uuid": "84b3b1a3-95bb-4b46-9030-4474bb04300b", "comment": "Malware payload (ConnectWise)", "value": "24af7d7934aadaf14219e601bc86d5a4958bcb1b0f9ab515fc38b86c72e813d586075315072f34ca6db76a9dc41d6083", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749906, "uuid": "3f552d12-e8bc-4b1e-a54b-7a96ee26f326", "value": "T1D246E111B3D995B9D4BF063CD87A82A99A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749906, "uuid": "a45c30d1-7c5f-4e51-9d76-bf5a2c634ee5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749906, "uuid": "72652abd-811d-44a2-bf3b-f98e3437b27a", "value": "49152:REEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:mEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749906, "uuid": "955c9be4-ea06-4144-85c8-c402df6885cd", "value": 5622424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749906, "uuid": "16f5822e-e0f4-4dd7-90bd-2cae76db77e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749906, "uuid": "7e8748f5-0749-4f22-910d-b4c93dabea72", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0fe4ee-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694628, "uuid": "3e825cb2-b061-4622-b5cb-789e22bd4e15", "comment": "Malware payload (Mirai)", "value": "a23c590791861bfa16ac8acc56039f2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694628, "uuid": "39ecc9a9-a030-42c6-82ad-d783a947f02d", "comment": "Malware payload (Mirai)", "value": "df9d27a5a8220ecc54aded353b12db4b57f712d5598d60b0c5a0f47817f42340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694628, "uuid": "ea7f5215-7bd3-4f67-a34d-e5faec9c2d2b", "comment": "Malware payload (Mirai)", "value": "4864873fef5b3a32a9481a5fa425306643cf2a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694628, "uuid": "3cc57762-8aa7-4d5d-a83d-08ddf1aebc92", "comment": "Malware payload (Mirai)", "value": "09fc7af04b014c9b9f34c7386905c8fa7d69cab8b465ed4441ea813f227b3c785c84039a163a7cfc9674552a69304c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694628, "uuid": "6848b6cd-33d9-46c1-b39a-205cf268248b", "value": "T1EEA3D606BF110FB7D86BDD7746FA0B0128CCB81B26B52B757534EC58B60A18B2AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694628, "uuid": "1b874879-0885-44c9-9858-6aee499ec196", "value": "1536:V/gvTPVziuECckYJ5N3Gdu57d7gBZZGcmNcq9IOXm:V/qPpiuEPJUBaJCOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694628, "uuid": "b03c416a-b5a1-4cca-af95-f513b6160893", "value": 105492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694628, "uuid": "9187d49d-2743-472e-bc41-9ee6af2f4197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694628, "uuid": "cab4395b-50b8-4bdf-84a5-c2fed7f832a4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c74b8c-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777743547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743547, "uuid": "a9a0d14e-bc0a-4e22-8b39-2d8e56e5b02c", "comment": "Malware payload (Mirai)", "value": "3923a4a8886d6ecbe62cd025eb92f2da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743547, "uuid": "aa320b8a-8a92-49df-a447-6a5df239c838", "comment": "Malware payload (Mirai)", "value": "dfdfdbb87c9c66ae5862275085ea2dc39bddf533ed9012b8bfa751f046147d18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743547, "uuid": "1bc2472c-8f43-4c2e-80f5-1b4050e4f96c", "comment": "Malware payload (Mirai)", "value": "7ce287db78cfe064c10ec878f84509d10b099fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743547, "uuid": "1f5f8a74-43a7-471b-8060-dab982e4ef38", "comment": "Malware payload (Mirai)", "value": "9ec959c83ffadbab5d07cba64712170592bd0c23f390fbeb4fb62b7d9f3ab2d8d1e20f9f0e2b1b86b2f9508973f35b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743547, "uuid": "aef464ab-ef05-4761-b910-a7c5c4075d6b", "value": "T1D8762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743547, "uuid": "a13ef9df-62c3-4aec-a945-badb1d90c77a", "value": "49152:eDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJNWUhHEvmCLpR5ELf:6+4vq3QbRSP9ODiDoEv3mZbsELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743547, "uuid": "aa1de51b-1cae-4f19-9553-823cdc393ebf", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743547, "uuid": "8fedeb94-67e9-4e90-8ab0-b7814d4bc7f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743547, "uuid": "e2ebe17a-2085-4738-9c4b-7b3bd6e17b91", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acda920-4647-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777740636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740636, "uuid": "7947017f-90dd-4158-bbf1-2ef399269dd4", "comment": "Malware payload", "value": "8f116ef3c8d1c02333c08b237fdcd593", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740636, "uuid": "3495aad9-43f1-4ab6-95d6-324112fbe94e", "comment": "Malware payload", "value": "e018a8af063c3fcbcf2f223fb3357e811ae379107fcc6d6642e370f0864d9a48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740636, "uuid": "2a4de2ca-9600-4a8d-8ec1-15db25c075a3", "comment": "Malware payload", "value": "d8e1d13185bcc3dde0c213b1485233e49cbb8c77", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777740636, "uuid": "3388f348-07b9-429f-a637-89f20bfaa032", "comment": "Malware payload", "value": "485d4c813bcb134258c16308cea7ecf919a2f20d2988bf43d4aaa9f73d862d7c5ef4fbc939a1fdf4c7d70789109004a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740636, "uuid": "c2aeef01-7fe2-46fa-aae2-fa65871539f6", "value": "T14BE17117E2E2CD32D8D4137E45930A1A223DC8659E83DF132E0C896D2E537DCBA72B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740636, "uuid": "dc08fb04-96a2-4a40-9db3-85847403a7a9", "value": "96:f6u6TiUBOUw38Jheuhih5Zz/cq/BK+M3mh/W785/f7kbalBgBi5pzBIQ:fEcbMJhA/Zz/cl+M2x/fLbpziQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777740636, "uuid": "d58c6b2b-a2f6-419d-9fcd-ce2232ae3162", "value": 6968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777740636, "uuid": "96c95746-2e59-4d7d-9ffb-efc06b7d2788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777740636, "uuid": "79fb80d1-5242-42c5-8087-b5bab4d16138", "value": "e018a8af063c3fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5e9020-4649-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777741548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741548, "uuid": "ef5dada8-118f-4949-9211-1861b2894b0a", "comment": "Malware payload (ConnectWise)", "value": "9177b5220ce28b2dfb0e41c7abf5d1f4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741548, "uuid": "68277610-ff14-4216-81cf-c0b9b74ad5d4", "comment": "Malware payload (ConnectWise)", "value": "e0e21f3356135549c8f4017b16bd740bcdb5c130292cbd870f0ab73cbae19634", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741548, "uuid": "e654b3aa-b073-40c8-88c0-190008265311", "comment": "Malware payload (ConnectWise)", "value": "c919075e767f0b75d5fdfc5364563e1f267ef1b4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741548, "uuid": "79860f24-7d3f-4216-b7fd-e3eaa42b6da5", "comment": "Malware payload (ConnectWise)", "value": "c12a521870d22f5a24752a2a416645c164074103a48b0dc866446cd926d7b87dae74fdfb48ec490c7cd63c3d089f7b42", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741548, "uuid": "18246b6c-7f8c-4dc5-bfe3-b26ce5c8a561", "value": "T1B8836C43B5D18876E9720E3118B1D9B4593F7E110E648EAF3398826E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741548, "uuid": "dd707a5d-5c75-4448-8079-c91b21412115", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741548, "uuid": "92ee373f-4907-4db5-b24c-671ab701f35b", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYv73J:IenkyfPAwiMq0RqRfbaWZJYYv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741548, "uuid": "a71b1e81-b331-4dcb-8569-29c1a88b52b6", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741548, "uuid": "f65800ba-422d-4774-aa2f-267fe681d621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741548, "uuid": "0194c5a8-a313-4552-86d7-fd54bd355413", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade8f08f-45f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777706120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706120, "uuid": "31de15e4-1eee-41c7-8383-bc5fe83287c8", "comment": "Malware payload (NanoCore)", "value": "64b30a08952474cf8363b0ecce250495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706120, "uuid": "c06fb8cc-be4a-43bc-b203-f4746d127e60", "comment": "Malware payload (NanoCore)", "value": "e34aeaa18d65d4dd32a9b958c28ad11dba2802b39f05529e8f89e6691d6ad954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706120, "uuid": "4ed2b13e-32fb-4870-89ab-ad8712487af2", "comment": "Malware payload (NanoCore)", "value": "85f4673bf0b16b933bde285d80df060c0f55da3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777706120, "uuid": "20cd7e73-1e42-4fb5-a568-ada083d4bc14", "comment": "Malware payload (NanoCore)", "value": "caa48c640801ae24d3f91a8df577ebada110c286b4a1c7e95d3a6143153ea8978120788da7675e989ef3df4199a85f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706120, "uuid": "3a74cd9f-a5f4-4395-98ae-1841ad6c0fe3", "value": "T13C14C0563BA84A2FD2DF86B9711216138378C2E398C3F3DE28D451B39B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706120, "uuid": "f1e6425b-f841-47f2-a8fa-97854e3cfe45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706120, "uuid": "81e45038-1318-4758-b312-63eb83984b37", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIY+XzMrrC/Y6jmdzBb6KaGaOCc:sLV6Bta6dtJmakIM5ikC/nqzp6jGaO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777706120, "uuid": "18395171-0b10-42d4-ac1c-72c725648d07", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777706120, "uuid": "bfd14be9-60aa-4c8d-b911-e6de0d0b0eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777706120, "uuid": "cb9c1049-3cc2-4836-9351-4d2652b041df", "value": "support.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a18177-45bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777681066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681066, "uuid": "5ae2b0f0-6627-4b79-8c03-fde7754253cb", "comment": "Malware payload (Mirai)", "value": "73ea0368f21ff715a4f70b9773f4e353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681066, "uuid": "197460fb-a2aa-4ee9-9b86-30db47bc2178", "comment": "Malware payload (Mirai)", "value": "e3b8fc53f4ccef366b98ca030566c430f6acb45e569b273f46105a27a56ae26b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681066, "uuid": "bc0b3a61-1b8d-406e-8408-6b38e56f3c34", "comment": "Malware payload (Mirai)", "value": "ec0d85dbb180dd009116e770bb09d726e34eddde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777681066, "uuid": "2a686469-9d05-4b44-98d9-391828fc8ef7", "comment": "Malware payload (Mirai)", "value": "47a6ff585bc7cfaab0b965271f25a6b219f824e6a81b32bdc4deb9ab82724cdc80bf24bdbbd7f80aa1596b9fecd0f400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681066, "uuid": "a9806fba-5967-4625-b4ef-30f2f831a14e", "value": "T192142A45EA414B13C0D727BAF69F424533339BA493E7730699286BB43FC679E4F22906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681066, "uuid": "ae40874d-fec1-4c8a-be34-088286878f04", "value": "6144:SwmkfZqd5MZPawb8duN3kspG9LeqPJiM/RaT/F:SwmI6MZPawb8duNUzxJr/id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777681066, "uuid": "3587951f-5327-4e3b-8080-6861cae5d407", "value": 200408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777681066, "uuid": "470d2d5d-8073-4176-8ee9-c3ee70cc9d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777681066, "uuid": "36dd985e-c47a-4712-a162-4c6c3a7b3ea5", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf1a1e5-45fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777709632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777709632, "uuid": "20e3f24b-80be-44fa-b236-ee97d46fdd35", "comment": "Malware payload", "value": "97d13101e8393980b7ff8fc9545be91b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777709632, "uuid": "b4c0d159-0a5e-4ebd-8e17-83b89da3bc48", "comment": "Malware payload", "value": "e5679d5ea636abe657e0d6a73847579919960500431b4e3de5f6a85b2e0959af", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777709632, "uuid": "7140c0e6-14d1-4a83-9484-3d77423b685f", "comment": "Malware payload", "value": "95eb2338c2dec355cc20b45c2f8b7743908a62da", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777709632, "uuid": "2f1e4f34-86e0-44a0-8b57-d11ccb4c7375", "comment": "Malware payload", "value": "ff59b63cf04e7fe198995483d03d6545b04d57161e931992282b9bbdeb0f604f7678899fff633d3e6ba133ff13a460ed", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777709632, "uuid": "d38d3c93-326f-4e8e-8c67-e34c3b25f269", "value": "T163253A57E76344FDCA7BC170877B9672BA70F81542306A2E1B95CB352F21E604A2EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777709632, "uuid": "49e9a567-5a72-4d2e-8659-73ccfbe9e198", "value": "d81431e2c62d449262cbdabb3df3ac68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777709632, "uuid": "38d42e90-2b28-41d0-af18-47045e6f1ea5", "value": "12288:WYF6+aqtxGi/tWvT0RNg1LBhh9bqDm2sg7QtQ:C+aqrGi/tqT0RNGLBhhNqRke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777709632, "uuid": "b075184f-234f-4b7a-9c3e-cea74775fd16", "value": 1057523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777709632, "uuid": "e475c872-e871-4474-87d3-322294ccd1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777709632, "uuid": "567a7fee-d175-49ae-be9d-a8f378f548a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7826fa-45e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777699915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699915, "uuid": "bfb46f58-b23b-4b1a-8d45-7e3041edde7e", "comment": "Malware payload (Mirai)", "value": "df4d10d3b3fa80ba91822f05f4f4f341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699915, "uuid": "e107a88d-3ad6-46dc-838a-5876a1c36f96", "comment": "Malware payload (Mirai)", "value": "e7b03eac9a64ffac4f84c6ab08c0b3372ed527a2f9cdd78a53a0cbe2ca2f325d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699915, "uuid": "6cb0c61c-ffa3-44d4-a9c2-bca8fd70722c", "comment": "Malware payload (Mirai)", "value": "07dab955542df672a17eebdce9f564c94484fd61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777699915, "uuid": "1f54c03d-a847-4ee3-b37d-1b98abaa3a57", "comment": "Malware payload (Mirai)", "value": "f94c1b8731f67d6e7a94d0a2389ce28fc7d7c44256f395e52fea77abd3d6f5651854d10fbb9859d26cac391c9be64acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699915, "uuid": "a35e9abe-5e77-47b2-81a5-5e047eafbfa5", "value": "T16653E846B9829E11C5C8077BFE1E118D331377A8E3DE7222DE116F11BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699915, "uuid": "8416f28b-74c8-4c9e-b13a-fe69dbb9b06d", "value": "1536:wRnv4wzuC+eysWYG6fRBscC6bBrqrrYmPOIRiM/3qFsIwbZnE:84GuDeyJY/Tsc/rs/3qFsIwbZnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777699915, "uuid": "65e41d60-36ad-4793-8d38-c988c3744bc2", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777699915, "uuid": "b5266801-6d17-46d6-93e2-a53f1e92f308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777699915, "uuid": "06d1d7de-0db8-4afe-8203-746b0ad5d29c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b578dfd3-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734909, "uuid": "45817c62-71a4-467d-b8ba-589f89ba5ebf", "comment": "Malware payload (Mirai)", "value": "0f64ceff67c28e38e9e477a7f9ebf8dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734909, "uuid": "10d88ef2-5b13-44d4-9fee-e7412acc24e2", "comment": "Malware payload (Mirai)", "value": "e847359e257c57cc8b6d5adbddb7a817561852af45996ea41bc7a39fe3cde33d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734909, "uuid": "08d5b5ed-013c-4017-9fae-6c05dcf262e3", "comment": "Malware payload (Mirai)", "value": "b13ae5ef99b16d4df4401f54aa1a27cd151dee97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734909, "uuid": "a22b51f1-79fa-408f-81d5-bf525fe7e14d", "comment": "Malware payload (Mirai)", "value": "8e54de4e4d383b33b3ad8c2aad41dbcc82761a7903cdfadf9b06bb58a996680ce545796a7b18eb0a10a325d4fd1e37d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734909, "uuid": "377258f8-c0ad-49eb-b575-6d69f5545607", "value": "T1E2B56B43E683C0F1EA1206B11117E3779A399A154136C9A3EF98ED39AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734909, "uuid": "38600645-c6cb-4469-a809-7e6927753505", "value": "49152:4J/+RFqNvMa533ehQx1Krb7cI5UHpQkVju:dRQvgG11IUpQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734909, "uuid": "65f4d82b-fb9d-4b25-a6b9-5a811652be0c", "value": 2411388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734909, "uuid": "2076a25e-4346-4fe2-97df-d3b26d68ca54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734909, "uuid": "e1f89bc6-7959-40db-a48c-e057a91553dd", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f3cfec-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719284, "uuid": "74686c57-e74c-41bd-80b9-6bfe9d7a7d3b", "comment": "Malware payload (Mirai)", "value": "bc3bcf78438577b34defd6af3dfeed3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719284, "uuid": "b657f11e-3e70-4d5e-84a5-f1051b571e80", "comment": "Malware payload (Mirai)", "value": "e85701f015fc168deb7ae4d7dd5a4379ac1f90a4c8322091574c80e39a93e130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719284, "uuid": "d8917e98-2dce-4525-830e-3dc03550b20c", "comment": "Malware payload (Mirai)", "value": "42b176a1fadf798d2240b58a886713fd8afdbf9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719284, "uuid": "07006110-6ee4-48da-acb1-d73259260fa4", "comment": "Malware payload (Mirai)", "value": "965050f5342d46308fcb9556124e7ea6ef0c322b0525948bc15d4b4d2c9d531167779a0e0fdcb1f7c0dfef32ca67cb43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719284, "uuid": "478f277e-9a7b-4371-b805-4ec062e3a9a3", "value": "T1A4646653D91684A1E5248CF322777346AC4783BF88E726D3EE5A49A1FF2141B41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719284, "uuid": "1600d899-069a-42b0-b14b-59a870f5fae8", "value": "1536:EkSdGmeGOZurNxEttBr3zWQ3zO8zIa5DrA/M9pS51JH/jTstmGbLAZNHh:7uuwzEjBDxz7zpDc8gBfjoyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719284, "uuid": "50508db7-67cc-48b4-bbd3-28057959ee20", "value": 326380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719284, "uuid": "3cc3e6dc-e10d-4cce-9c7c-79ed77f594c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719284, "uuid": "ba018dab-febc-450c-99a1-6bd5ba42c180", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e7920f-464e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777744028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744028, "uuid": "58d674c0-11c8-4401-917d-fe6cdaf67495", "comment": "Malware payload (Mirai)", "value": "53d329c33998a72b788227c0f6e14a90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744028, "uuid": "db42f850-4bfd-47b4-879f-022a54e1da97", "comment": "Malware payload (Mirai)", "value": "e86e0cf4cc4a11eba51e60a8771a0c26535cbb44615aa1f048144a722ea00c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744028, "uuid": "f886ee64-42c4-4a9c-a02f-61e4dbaadd03", "comment": "Malware payload (Mirai)", "value": "f54fb6a5063e04339a041f178f467ab5d703fc6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744028, "uuid": "360ed4d3-f4fc-48dd-be41-1bf32a9636c9", "comment": "Malware payload (Mirai)", "value": "e7c5aa3a19771560224152a43c476e9b163bab6570c1bf728fd125325e1e72fc4d98e7175720c23def06bf8598de228a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744028, "uuid": "884979f6-26d0-4770-9f84-02c224f98a7d", "value": "T1977409013B4BEC6FFD6903740AF78A7477D965B22572859AE26EBF4D0F210D14E08AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744028, "uuid": "94c07f09-bf30-4ede-b0de-8a96cb4ea6d2", "value": "3072:kdcaEKs9ULpElvAugHaqMX4GsKwAfEio2c6guBAsWya0s4CHMaJGmI2g1VptHyvl:Ks9ULpfusalfKwa0WHcVpK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744028, "uuid": "f96c92e7-3db3-4036-8c76-bb98edaa78cf", "value": 342040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744028, "uuid": "40d31113-9d28-4ed5-8c99-8038acace606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744028, "uuid": "160b47b9-035a-4e9e-91f5-1dd7643bf036", "value": "bin.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d23586b-4618-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777720561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720561, "uuid": "7e9433c9-b43a-4061-af6e-86ffe259bdf2", "comment": "Malware payload (AsyncRAT)", "value": "d7ad356527a7279f1ea4aed8848c624a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720561, "uuid": "73d8bfad-c0b7-4626-8101-d94c843a9b6b", "comment": "Malware payload (AsyncRAT)", "value": "e8aeef930fc9dc8b44df1147e3ccd1ed5e9d414eaf378befa1266709295766cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720561, "uuid": "f4ec6907-7fea-49ee-90c8-497257c8c943", "comment": "Malware payload (AsyncRAT)", "value": "1d00a8b1d50ec4b670485920beae34c247dd2ab7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720561, "uuid": "04de07ca-13bb-41be-9197-55aebde8b244", "comment": "Malware payload (AsyncRAT)", "value": "cca02f92f2281a784136d6be9d658784422855ddaaeda7afadda61991e1e4c3609259853b8e72f01c5ec5d079f4ef514", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720561, "uuid": "1932e352-0c6a-47d2-9a31-6799d04f471d", "value": "T112231B007BE8812BF2BE4F789CF26245867AF2732603D5491CC451D75723BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720561, "uuid": "0ebacbf1-d638-47a0-94f8-c0a2bafd7cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720561, "uuid": "f4c9c105-af6f-46b6-a8b4-da75bc81df2f", "value": "768:5uAtPTgoRzbWUnd9rmo2qrMlsHoPEaMPIGSjbLgX3idd3EMOzWKBDZ/x:5uAtPTgG/2PuuEaxG+b0XSz3VOzTd/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777720561, "uuid": "d3cd9b7e-ccc8-434d-941f-81b1763769ae", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777720561, "uuid": "b861d1d7-5237-4b92-b01f-cb34a200f160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720561, "uuid": "2bc4993e-cb0e-4cff-a7d3-b913e82de866", "value": "gstub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4950b4-462d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777729500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729500, "uuid": "e50eeda8-69e6-4998-9e14-7f8db9b14bba", "comment": "Malware payload", "value": "bf1d4adcfe4aa0b89ce05009dcae5eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729500, "uuid": "f62cc5ae-79ff-42da-834b-58e93c97bf47", "comment": "Malware payload", "value": "e8eb0541c9f492b2f32f80f3e244fe07ac1bd31ccde9e51e7de90568b258c66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729500, "uuid": "43c3e208-9ad2-4807-97f6-d23fc682392e", "comment": "Malware payload", "value": "95d7e827ba51db1b69ec64546dca7ac1a22df983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729500, "uuid": "fcff4b6c-6f9c-4600-b4f2-d40b0c884e49", "comment": "Malware payload", "value": "36f95e67463d71b3762bf09d030f4a10e6557eee7974193b0f6f051e73dce3edac3fa0f0300963428b2592f7e44b0011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729500, "uuid": "c873a096-e8aa-4294-8235-b0966e4bf8d5", "value": "T1E3D72321369EC43BE16A04B1592CAEAA913C7E350FB154D7B3ECBD5E17754C20632E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729500, "uuid": "87afd681-66a6-4540-b782-e3c30f3d6c9f", "value": "6d5e13c0269946a5a10390c178d8e9a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729500, "uuid": "6776fddc-b5f0-42fc-a0a8-f21342bf3904", "value": "1572864:gJqHlyDSsLDq9IDZ5DY3Ye2b3CqYfInWvsQXizQgGTzAInhnC6se:aKIVXe2bvLnWEQXizQgGTc0C6se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777729500, "uuid": "b04de4e6-9796-4d81-848c-ca41b841f5d7", "value": 60193770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777729500, "uuid": "d01bb8da-5fd5-44eb-abf4-b8a91f1a622d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729500, "uuid": "a3f3e798-16f3-4415-bd37-e6e63f1a1858", "value": "Potato Desktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7dd35c-4681-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777765870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765870, "uuid": "d00ab46b-1905-4f79-bed4-9a8c8c1f4ee6", "comment": "Malware payload (Mirai)", "value": "9b9e72e97b6cf696661bc22d325471e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765870, "uuid": "2f28638f-0681-462e-b8b3-cee0eceb50bb", "comment": "Malware payload (Mirai)", "value": "e97e7480f33159a968b94f9ec03bafd0f3c4a648f2e0aa2838befd105413acda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765870, "uuid": "81878405-d790-43f8-b90e-60f251b99574", "comment": "Malware payload (Mirai)", "value": "118d97407ac76ffaf7315d0dc5ad104b14a1cc98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765870, "uuid": "2c7159a4-d845-4f7a-9bdf-1e665ea03dad", "comment": "Malware payload (Mirai)", "value": "a9831be671aee189e0b3be08502317867d11c99bcf62292ba39db4b2f250336d9bc54d2b029820000f33290aac77d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765870, "uuid": "087b6075-4e06-4b5f-8c90-2c87757e910e", "value": "T1A3C56D027B1E09C7F1A71DB0263F17E9C7AE8AD631F8F146254EA9CA1375E3012467DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765870, "uuid": "a94818fa-a1f2-4a7e-b146-f346fb9c0dc0", "value": "49152:akLAlaVrwTj/tB6jhTZ8LJfbvBBhfW5uGuJHrigzaT1GfvP/0UT:akLKaVkTj/76jhTZIJrBPfW5uGuJHriC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777765870, "uuid": "5718a56b-8a81-4d5c-b95a-c33d221672e0", "value": 2716012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777765870, "uuid": "07b05b40-f8f9-4889-b2aa-61d20448b8e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765870, "uuid": "5e13694b-577a-4beb-bae7-993078c032dd", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83b22d4-4633-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777732417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732417, "uuid": "158bb1c0-e0eb-48ca-808c-e71c0e34d980", "comment": "Malware payload", "value": "46c4e2b28ad07c7a2101548cd6954607", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732417, "uuid": "c49dcca3-29fc-4088-9f94-43b7565f1441", "comment": "Malware payload", "value": "e985a9c2fb6d9c5d14f1d3ba920efadd5482768810f0523b07ca5235878a6b36", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732417, "uuid": "493157b4-b87e-40e6-baf1-d53748202a60", "comment": "Malware payload", "value": "6c5e25696174afc955fa88894138d3b495265063", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732417, "uuid": "028a6ff8-eb26-45ba-a4d2-74359ee0d45f", "comment": "Malware payload", "value": "f0a98e46129fe7b62542918d8fcdc0886e0b58583a8598d8636d967631aa4ebf9cf52f37bb173eb25740e913cb070adf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732417, "uuid": "7de792e4-e97f-494e-8e0e-1a283ddd2b36", "value": "T16FF6AE1BB381407BC4630A754C3BA7A5993BBA3039229D4BABE44D5C5F37A817D2E317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732417, "uuid": "0bb6aa83-2b67-4e04-a94e-24a6deef80d7", "value": "393216:s+XbThZVdcqMLtGa0ARZ9NmBXKNQpkQsk9jKH5:skJW0uZ9NmXpkQs9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732417, "uuid": "b9278e11-6347-4229-839a-c531838c882a", "value": 15550709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732417, "uuid": "2cf75ae0-eada-4705-927d-4e504f8b068e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732417, "uuid": "968472d6-0662-4828-97bb-018c8e8b0368", "value": "0Dbr6466IVIKZYRZGE75628P1D72.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7210d5-462c-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777729039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729039, "uuid": "67efaf82-ff90-4124-8612-c8bff76dba9d", "comment": "Malware payload (Prometei)", "value": "b0c59deb0e345da2655b786e8e730d3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729039, "uuid": "9dec6f05-11f9-4f7c-9211-2f0ff22710bb", "comment": "Malware payload (Prometei)", "value": "e9a91b0e83aa94fcd3d6d2ab58c062deda95252f4cc0d92dcab4b4b4c016679f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729039, "uuid": "1eb4ea5e-a380-4185-9213-acd04c0ad5a6", "comment": "Malware payload (Prometei)", "value": "8d14377d08d63a845e052e53e741b8a45a5a2af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777729039, "uuid": "6849534f-3f76-4e22-8552-a2f14bd0b7a0", "comment": "Malware payload (Prometei)", "value": "b4ccf8f5c7e8ca3ddcab88d990be76507f5db31e2dea5d68a879563246e41fbb4911e0a9cf436775dd0ebb0b50037fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729039, "uuid": "8451d8a8-4a49-45ea-96d7-d97847176c3e", "value": "T149A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729039, "uuid": "db00c47c-8462-4911-a150-48354b332333", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd+:Fs6pyCC/Ya2hpi6T6N4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777729039, "uuid": "e91fe146-0e1b-4fd6-921d-3ad47a7bb94d", "value": 449080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777729039, "uuid": "42fd7e2d-8ef3-4b47-ad5d-17d4a99180aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777729039, "uuid": "b615eb81-9029-4d23-87d5-b5ffd470b7d6", "value": "e9a91b0e83aa94fcd3d6d2ab58c062deda95252f4cc0d92dcab4b4b4c016679f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2e5e48-4620-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777724265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724265, "uuid": "42175b91-9719-4b97-8ffd-a528796ef280", "comment": "Malware payload", "value": "8a6f31cb4fc8a4e629b079f9499eed98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724265, "uuid": "fe53a6e7-fdec-47de-9352-6ac26822bac2", "comment": "Malware payload", "value": "e9aa103a68f101c68157d3086949fed936d78ff50760f377e43c222aa8b286d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724265, "uuid": "956b4c93-5378-4f5d-8888-cfc5d9385385", "comment": "Malware payload", "value": "cb849cf689e0cbabad63a45edbad47849154ce88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724265, "uuid": "1649c083-4e6d-45b9-80d4-7763f520cff9", "comment": "Malware payload", "value": "3a465955cd8a32df4a68b2282272b2324a34c4e6ee759d6f0950b204dfee281ae7fe1ef57af41db4f133d69b74cc22e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724265, "uuid": "4ae5437b-044e-4bcc-b7e5-c59bf5c57858", "value": "T18FF19D6657F5C206D0E3CC38AF2731FE7463EDB15BD7A579B6889C841D420A9A824783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724265, "uuid": "50950d6f-950b-4ffb-b3b9-c34a294720d1", "value": "192:GBzQViEBm9aen1iXbQSKdOc+se/FqcJPH/aOhS:AzQViLa41iLZcViFqcJPH/pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724265, "uuid": "afd6aaab-57de-4250-950f-0dcb522a037f", "value": 7492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724265, "uuid": "df98dfed-1943-4616-a23e-1b23d90a719d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724265, "uuid": "d9579593-a154-429f-bf61-fd982e55f989", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c1ae9f-4644-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777739478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739478, "uuid": "d0ac1c20-7f74-4cd8-9481-75188869982d", "comment": "Malware payload (ConnectWise)", "value": "93d4e0a1921da70b3acec07a14501036", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739478, "uuid": "227f498e-0d29-4b6e-b289-1a03ac9f9ff4", "comment": "Malware payload (ConnectWise)", "value": "e9f9f4577c614ede1c77b359afef44afb83ceac8ac986d9101596d047a33d7ad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739478, "uuid": "7c302d7b-bb67-49c4-af92-261fd7f25c10", "comment": "Malware payload (ConnectWise)", "value": "70870ec95bc3799e9f6a3b4ad8f8dae89ae124cd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777739478, "uuid": "f4ffcdb3-eef2-4dec-b491-b827593a2d10", "comment": "Malware payload (ConnectWise)", "value": "c3fb7c2e9e3805cfd66fc1551115b177e8468c414a826e9cf07b2ebc60219e857823ce5746a9b0f75cacc8be257fae3b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739478, "uuid": "a303a805-6eda-4d73-aff6-7dedc540515e", "value": "T13B646C11B9C48432C673383107B8E2B28DBDB8301D655B9F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739478, "uuid": "423af6cc-c8db-4b03-b1a4-918b5d976cd3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739478, "uuid": "364cf9b4-a747-4489-b758-6c2af6458efa", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti98H:A1iw7gryNkSV1hy1Z1u2JLI9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777739478, "uuid": "49f942e1-4cac-4bf6-960c-9671c739c722", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777739478, "uuid": "72df7da3-b3c8-4602-abb0-bb59a8b7759d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777739478, "uuid": "c0b23a5e-6933-46f6-bf69-3fb188246280", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d0e930-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719262, "uuid": "47771dd2-384f-4a3a-90d7-cd63149ff3b5", "comment": "Malware payload (Mirai)", "value": "b8c8b5d2c8db9cfe284b62761f1fffed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719262, "uuid": "3de41027-52eb-4cbb-bb48-57fc90e9a819", "comment": "Malware payload (Mirai)", "value": "eab1e6d87c6301d9eb32b072d0a237ab3885b295fa83780e7b9129d0b1485c6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719262, "uuid": "d35477b7-ecd1-4f28-aa61-10a70cf7f24c", "comment": "Malware payload (Mirai)", "value": "2613096498ebe18faa3898c24dfe8cbddfde159f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719262, "uuid": "03dd210f-abc1-4efe-859a-3661f3c31dce", "comment": "Malware payload (Mirai)", "value": "29801baed18727b4b92930d8b24f840f9024045e757f8a51477d7027f305b163ec748b8e9860a290264d8228fa91b419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719262, "uuid": "b8a1c07e-ca23-4637-935b-3896e45f59f8", "value": "T1D8847813D9154492E1255CF2223733C5A94B87BB88E636D3ED5B4991FF3182B42BEEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719262, "uuid": "a69b79d5-d1a0-46f8-9d0b-f58f877ef2e5", "value": "1536:fAUKRj/0EAYW6x8Hc+2Lfgd6kCKnBrzBKWADvAfgGwyjde5szqyEI1jHejTstmG1:oUiDHAsxE2kuKBrzW0ff+joCBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719262, "uuid": "ab191573-a5b6-45a5-9914-f995f9e4eea8", "value": 375028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719262, "uuid": "53559480-5ec3-41cf-a33c-1c3852b2949b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719262, "uuid": "c45cb303-a7b4-4189-9f4d-4c4ee45c1e53", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f437b1b1-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736303, "uuid": "2cafa770-6e8d-4645-bd9c-792f4b3f16c7", "comment": "Malware payload (Mirai)", "value": "26de744358e6f3f3de4ef5c6295483fd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736303, "uuid": "8687faf2-4214-4528-9eb7-4042a0a8582d", "comment": "Malware payload (Mirai)", "value": "eb14b2bbde777cbc61c7ed9cac30eaa54394f5e08cd9142071ab96f829ec01b0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736303, "uuid": "1418d8f4-1c20-4690-87ac-dd1a64a445e1", "comment": "Malware payload (Mirai)", "value": "e5b0a691be848ff38be87c0c2a1c3af596a23b13", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736303, "uuid": "9655bdbf-7ecf-447b-a176-0c355a2d49b4", "comment": "Malware payload (Mirai)", "value": "e13323c977f917438ac93e001297d525858229a02b91d433cc1d64fa998b9a9ec1fc35b6cbf384ef2d48b730cc3e9ccd", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736303, "uuid": "df97b82b-936b-48c6-9f46-37b4e9afd782", "value": "T14AC3B81E6E21CFBEF65A827407F78E31965877D72AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736303, "uuid": "ed8871c2-e4de-4c1d-9828-dd15b60987c4", "value": "1536:Nw4lPfv7d7Y/YL8dM416VcwS4ziMN/DIs1ISWlaH6efNHDh1A:blPfDdM3dM4qcwS4vN/DIsC8HDh1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736303, "uuid": "7f234025-72cd-41cc-85f5-eaae3c103f9e", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736303, "uuid": "ca56e5d9-2d16-413b-944c-a8d9e247bfb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736303, "uuid": "9611d203-ab67-4de1-b61b-d6e906036c05", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1613b5c-463d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736647, "uuid": "7b9322a3-a9c6-4d32-8022-9e79493ba46f", "comment": "Malware payload", "value": "7333cabdf6b671f4281197421355dad8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736647, "uuid": "571957b0-4102-4c6b-befb-7ec45d4c9093", "comment": "Malware payload", "value": "eb535afb4cddcb1ed15909bc78cd2da719c588f0e77f8da35d6b326ebe484bbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736647, "uuid": "36c1bd59-85f3-4715-8567-fb766edab1b7", "comment": "Malware payload", "value": "6d416dbf19f37473a1b47d32a05311fe7cf50eb7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736647, "uuid": "ee555e61-de82-4deb-81ba-388e8b158c23", "comment": "Malware payload", "value": "ccec97cafa7291b273c3a5371cf13a652b0964a24d75c626bb6569aad6126c7ae381c70e49865abd1cf81a9ce9481459", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736647, "uuid": "89fb5cb9-3800-4a28-b84e-cd2ce5f5f368", "value": "T18D3139C5135145F92DEAADEBB9A5860873A07095ACC2BECCACD83CF9808DE1D3445E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736647, "uuid": "9b69e21c-2600-479c-b311-52f4ae875b0d", "value": "12:z0FV3+L3KV0FV3JL3Y9V0FV39iL3+a6V0FV3jexL3jed7/V0FV3nLL3DWV0FV3LY:wykwDNYNM67WxVzyfdFnzKzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736647, "uuid": "48dcc567-161a-441d-91ee-7bb56e6185be", "value": 1794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736647, "uuid": "951179a4-6ae6-4012-b506-866c9c0ccda0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736647, "uuid": "8229085f-e8d1-47ec-99b5-4a671f72474e", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c82e25b-45c0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777682871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682871, "uuid": "eb708166-fc33-40f4-aadc-650e4e763469", "comment": "Malware payload (Mirai)", "value": "6a5bbfd8bbaa25e471fb63f65e0ede23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682871, "uuid": "8fe677fc-d66a-476d-a5b6-c2539083fad6", "comment": "Malware payload (Mirai)", "value": "eb9ac1a0fb591d21188f52914e46b05f9c17ade3e8a5de8782ff19939e92875c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682871, "uuid": "22d8ea24-597e-47ea-949e-18f56bf45d32", "comment": "Malware payload (Mirai)", "value": "939ad2683061acb8b8289755e5fc488cd4c26f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777682871, "uuid": "4582740c-a282-42ac-b8aa-d6fe58381ce3", "comment": "Malware payload (Mirai)", "value": "9170bead37747fb831f6a538478227b4c9ae898050d04e2f162f5d01860c2e59a14099a7ad443c8ef7835743d751235c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682871, "uuid": "07eb2989-10e0-4e55-8e7c-a88460192414", "value": "T1E0A37EC9F143D0F5E84705712137EF379B72E1BE201AEA43D3A89A36AC91541DA0AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682871, "uuid": "ff3b9efc-2b7f-4986-a6a0-43d95b8bf111", "value": "3072:x31t+nLmOtWN6Ctxu9Ni1hBurU52WySi:x31t+nLmOcN6eo6mSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777682871, "uuid": "43bed7c8-62ee-4332-97f7-244ac45edace", "value": 106216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777682871, "uuid": "47cb7d63-c1b3-4c31-8ac3-06878050c4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777682871, "uuid": "adfb8d89-f26e-413b-810e-35fcad7d4b3c", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba51472a-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736635, "uuid": "0b2569a3-be1a-4fa0-ba99-915bfd527173", "comment": "Malware payload (Mirai)", "value": "4089758a3b4e0c10e8ae28a239b3d314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736635, "uuid": "306e20d5-0697-474c-9cef-5dd6b53a12ad", "comment": "Malware payload (Mirai)", "value": "ec1f7f42a7a4634251b22b1b681a798386295a44cab22792d6ba5bc2bb3cb966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736635, "uuid": "56047530-dec7-4a66-b937-3e0982c95337", "comment": "Malware payload (Mirai)", "value": "40e2139747385a2e605e4dedbb2983d4966f614a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736635, "uuid": "203404e6-024b-4bf5-9640-8a04dfecd20b", "comment": "Malware payload (Mirai)", "value": "0f5ac62471f099288d5377e7d3c825fc989fa2c1120acc873ee04997cd237d8b7a2f653ec2aa0faa94614786a16a6834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736635, "uuid": "08d3d177-9bf8-4739-afc3-b780390ad88c", "value": "T179433B03322C0E17D9A21EB0353F06E093BFF95126E1B68A254FDB664639E7615C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736635, "uuid": "448d3f8f-3ba4-48bd-9c18-a4cd8628c671", "value": "1536:1t1JILhthQ+1r4aoGKmifAKWNGaOd42+8/:1ufh/t4AK+G1P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736635, "uuid": "59212516-2eb6-4b15-964b-06a813885d48", "value": 60040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736635, "uuid": "e3327aa4-76f0-48e2-a197-a3186bc36170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736635, "uuid": "72fcfb19-d44c-4d6a-be5b-906431b30f61", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9de83e5-4617-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777720421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720421, "uuid": "20c2e2ba-e363-47d6-a566-0c33e44844b2", "comment": "Malware payload (AsyncRAT)", "value": "7b36746b6841ecb98c5433619cee4a10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720421, "uuid": "561a1718-7008-4492-92ba-bca1709d0d71", "comment": "Malware payload (AsyncRAT)", "value": "ec668067e68618c55d191c0784eb4bffd37f74d35627962c284a50fb36b8a18e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720421, "uuid": "026939c6-6edb-4c0c-b855-5585f6c50713", "comment": "Malware payload (AsyncRAT)", "value": "11208ffce0d68912fcb7600a6315718d55211c69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777720421, "uuid": "7462a597-2862-4e3e-abac-5809c578a355", "comment": "Malware payload (AsyncRAT)", "value": "87d76cb343d403daac68b669816ba2024d3593fff568cc2e0526f07527019d02fe2f0d4513eddd6346da71d3c8dc8961", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720421, "uuid": "73c571c4-7df5-4857-ac88-8ce078551285", "value": "T112332A003BF9826AF27E5F7899F22246457AF2676603D54D2CC402D65B23FC28A525FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720421, "uuid": "6bfb5778-bc7f-4d85-9f97-2a5873c58fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720421, "uuid": "3cd66fcc-f83b-4132-9392-27e7e0fc71f3", "value": "1536:XuGzRTPE4/2QC1EZebRu29btSOQpcQMMrdVx:XuG1TPH/2QaEZeu29btSHrvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777720421, "uuid": "6c533bb1-9f5f-4063-bd4f-7a7621f85647", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777720421, "uuid": "63f3e3a3-a064-46e9-a7f6-1a13e1d89df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777720421, "uuid": "3cc18540-81ac-44c8-ac3a-3dfef0a20585", "value": "tiktok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bc9f26-4673-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777759582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759582, "uuid": "7e38b0c7-6a98-4b8b-990e-cbb1e50e16ab", "comment": "Malware payload", "value": "6b79aec4d300c37e3ad053b220ca5f49", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759582, "uuid": "e0f32cd3-91d0-44fd-9242-609a516fd9c4", "comment": "Malware payload", "value": "ecda4913a8aa1bd525d207abc40aa84e46f77c02f7d6fe8710353f191f7ca6df", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759582, "uuid": "77e6d7ab-4c35-4977-baca-f52eb3daed96", "comment": "Malware payload", "value": "5c5216aeb3ac805836d9323a2b100c2d4262915a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777759582, "uuid": "6a250b90-e13b-4bc9-8816-4a34ab25999a", "comment": "Malware payload", "value": "45689676af2cda4963a5ee0aa9de239ffcd5305a1d9ba5a56c51c089ced5da2200ba83ec139463ec24a9a1d12e67f216", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759582, "uuid": "9a917b2f-0921-4c49-a90c-6fe264229e73", "value": "T19C94028BB3A538F9F0B6867844594605E776BC3203E09BEF076842565F326E04DBEB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759582, "uuid": "5bee792f-478b-4f71-85ea-8d1dac5cf5f5", "value": "52e22ea505f6969a3016234a59104c9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759582, "uuid": "aadbe6e4-80e5-4ae6-93eb-5c46868b4836", "value": "12288:PVFVWG0MNgOes+5xoJYCE+1aoqSaRVQRC:PViOes+5gWapq3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777759582, "uuid": "b17a4ab3-7e6e-48c6-8bdd-0b7666c834c7", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777759582, "uuid": "77745e25-9f25-451a-895b-8f8897a1bf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777759582, "uuid": "3fdfee56-cb79-4821-a7fb-978ba5f68120", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35014905-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719232, "uuid": "555770e0-0606-43ab-9ca1-c8007640e04f", "comment": "Malware payload (Mirai)", "value": "7662dcd2c974dfbea1a34bcee1fb1ec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719232, "uuid": "7492862b-15b0-4e98-ad76-607896afc8f2", "comment": "Malware payload (Mirai)", "value": "ed7f37d5d06ab7b09ee62d107309c347fd6e1de29114f1c3e5ac9d11ff3c8fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719232, "uuid": "512196fe-3cb5-4dc5-887c-85c807b13e91", "comment": "Malware payload (Mirai)", "value": "580eaa836ff9b9a1e3a3b645bc0bbc1c336448b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719232, "uuid": "1f971d67-8a9c-4465-afdf-01d3b46aca97", "comment": "Malware payload (Mirai)", "value": "d3768b98147faa098f9f5ee1731eabec59de530567d064949fab33f4b323a3555e5d63830b22a58793d2eb22caa4840f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719232, "uuid": "926cb33f-bb16-4d6b-b185-f070fc839be7", "value": "T1008302CE746467EAF24D6B7D5384A1B4A9802590E62B0D6B632EA8DDF701543F944CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719232, "uuid": "90372c88-3f7f-4fed-bc40-7b0686e667ef", "value": "1536:IwkAU7aTDEEdsGcltia+e3IdwDCdS03Mo3RPtaXmh:Iwk7aXCG6d+EIalYMo35twmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719232, "uuid": "79d8fd7e-3894-4353-a009-832fc620bc46", "value": 81468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719232, "uuid": "ecbba059-26d9-4211-87b7-c2620985cdaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719232, "uuid": "3a48e2a3-eca5-4e29-a580-f4c480ed5b40", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f71065-4651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745245, "uuid": "66af4f0c-a13c-4422-9d9c-7b5e924b5d53", "comment": "Malware payload", "value": "95ba9bee062be8d76d93e607d778e9ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745245, "uuid": "be9b705e-e6b5-4c76-acd4-f10874995100", "comment": "Malware payload", "value": "edbfe2509023b1a4b422e69ca30e889be38d3e08765e8c3c25139e0908df1f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745245, "uuid": "772096cf-4323-4521-a7af-ad14ee5ddfd7", "comment": "Malware payload", "value": "da631523e02d09038724f178a5d7f7d00f5ea487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745245, "uuid": "cb3fb5d3-01f6-4869-a32f-7f29a8edca9b", "comment": "Malware payload", "value": "b9418170357962fc79c6330df924d8c3fea0ea3442e80419f5722fc74412f4067e1514c162fc863ba5929965cd2e44a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745245, "uuid": "24b7f558-041d-4e29-9f06-f49d0f6bc9e0", "value": "T131233A36BA720C2BC5C5957A62E30735F2FA839A24BC4B1B3DA10D8C7F64A4072577E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745245, "uuid": "8d84d264-8682-4213-8d00-8e6ab7aab9d9", "value": "768:8fj6NeFTO+Nk5Vb798xlDjsx/LKEvtgcUaFIY:8wKNk52js1L9tVFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745245, "uuid": "ffb3a99d-52d6-4581-8b16-088169026986", "value": 48456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745245, "uuid": "2f8e9fc8-42c4-4ba8-9d82-613f52dfda8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745245, "uuid": "fe3cd0fd-3271-415e-b5f9-9f7c3452d70b", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9665f8-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719219, "uuid": "68c2fb9c-7b13-4fdd-bc56-da015f4d610e", "comment": "Malware payload (Mirai)", "value": "ae88b13e9f769b9989f8e40e161192a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719219, "uuid": "386bec65-2fc5-4088-a5a6-11c16f1704a2", "comment": "Malware payload (Mirai)", "value": "ef7ddf9a8c0b76d3527035f58161c50acceeb4cd88ea0deba3b30c819990ec95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719219, "uuid": "0044e335-49e9-48b2-9992-ba8fa6694889", "comment": "Malware payload (Mirai)", "value": "f73647405f761661d7956919edde739be413de91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719219, "uuid": "5d6168f9-7cd2-463c-9851-03fcf87e669a", "comment": "Malware payload (Mirai)", "value": "1ed6b2ddf1c911d3961e9e756527543266c3603aa1ee8b38f4a35e3124647b6c7847c239eebf828cbea460f7731e1657", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719219, "uuid": "4bf986c3-468b-42e5-9a5b-985687074cca", "value": "T1B37302ECD248F8B8DDDE0CB39D208E88F6F40B1835796D4970A4AF95774AC697742AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719219, "uuid": "8157d17d-d81b-4055-a949-95f0483be214", "value": "1536:coVzyx1jSexGN97Tb5LSoWSkNCFbSx9L3EORm5e566tx7EmxAfgxqPj4u+qgw0zT:72btwn5+6bMLvRm5kfXO4x84u+qgwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719219, "uuid": "46410f89-8638-44ed-a7db-c6eb4fd7fe89", "value": 74092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719219, "uuid": "a6481cb7-2da3-4f3b-8cda-299abd3a35a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719219, "uuid": "e892533a-f619-4aeb-b885-5c1d26c67cac", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1a342d-467f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777764743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764743, "uuid": "fcc7d03a-14bc-4a1f-a014-9e46c823e4e9", "comment": "Malware payload (Mirai)", "value": "3d17321955a6ce4ff8895b4578c67ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764743, "uuid": "6e179f79-1c31-4478-9c3c-a5ad4807dc69", "comment": "Malware payload (Mirai)", "value": "f08e0cb0cc13b4006757161a36538de50335dd1e792c527d3ae00c21d57e96d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764743, "uuid": "16a6aa5e-24c7-4f27-b253-7f35793699eb", "comment": "Malware payload (Mirai)", "value": "bc3cf52dc8e1563e92fc89dea6f386a07fc6542f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777764743, "uuid": "841ee689-0efc-4914-adfe-bb75f9b02096", "comment": "Malware payload (Mirai)", "value": "46f3e4e3bdecb13a5f9e95dccbd826dab7d34425d3f0c6d1a7bb67900c8a989d0ad94fdba57f1874dffbc533f6a13418", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764743, "uuid": "c101d780-87a8-4a9b-aae6-d1426a3263e3", "value": "T182B55B41FC51AA56C6E066BAFB7EC28833272BB9C3EE30175D04473477AA95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764743, "uuid": "821dcdfc-cd3b-48e7-87ae-75b8a575cce4", "value": "24576:omuYNFqJi+1987Zl4mOQoQ+nzm1bFCs+u8gDguOfyvd/ux3sBqSjaQmCUTolJ4vW:omU91mnovn8GDgn7uFssOlJ4vPle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777764743, "uuid": "5f884659-5e16-4151-b9ed-bc4dbbffed04", "value": 2478620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777764743, "uuid": "4b9b24a4-bb45-43f7-80a9-d8ef59368318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777764743, "uuid": "76b00d20-adbd-4456-86aa-0bdfc18c6a36", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd0109b-45e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777697695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697695, "uuid": "ab6d6e01-20cd-4555-85f9-f142d3192244", "comment": "Malware payload (Smoke Loader)", "value": "f482dd98b7b2182e08cf400370aa20cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697695, "uuid": "bc9dfcbe-f0d5-48a0-a8bf-012f90aa13c6", "comment": "Malware payload (Smoke Loader)", "value": "f1025f62299900f6d79868a33d033fd897a14c15bd25a48db614126e4a79aee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697695, "uuid": "f8e09bb3-06a5-4501-9e60-94cad375a67c", "comment": "Malware payload (Smoke Loader)", "value": "09dd686582f8de58acdcfdad877a1504f0b5be0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777697695, "uuid": "0f07ec22-8ebc-44bf-b3c9-9eb70859822c", "comment": "Malware payload (Smoke Loader)", "value": "a5bd5bd5ffac32e7fdb0941895503a98b70f2391f54fe8febd3b0138b5bb1d061428230586412e0f6d8b2e08697a6c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697695, "uuid": "ab6be18e-6da5-4000-b8b5-29aeddb744f1", "value": "T1D6147C4373E925E5F5738674C5A58A57E771B82213209FEF07A0861A1F237C2AD39F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697695, "uuid": "ba34b99c-75c8-44df-8341-2ebbb3168888", "value": "0be878847a955d68de7730bad92f9303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697695, "uuid": "140adaff-9df4-4820-ae39-62b4736f913b", "value": "3072:jerKPXpRlvxYC6kHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:jeGfblvxYSyrWpAKhhvORHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777697695, "uuid": "f998848f-682e-4527-ab5f-501f36d0c8a2", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777697695, "uuid": "ad309231-70e9-412a-a372-368e8e813a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777697695, "uuid": "3d215d5e-dd63-4025-9d36-381f9e2a8eed", "value": "crkhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a1999f-4615-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777719229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719229, "uuid": "bb12ac07-b66b-4138-af50-02fefd9fe085", "comment": "Malware payload (Mirai)", "value": "f7793b5033c0cab2a2e68ed26107a791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719229, "uuid": "2b76a338-3d02-474b-ae23-bf539c87b09e", "comment": "Malware payload (Mirai)", "value": "f126379d2e93c6d56591301eab93a8026478e54c86a8a21f189e9da2dbc577ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719229, "uuid": "38cceae2-9a1f-46f4-8df4-92afea35a498", "comment": "Malware payload (Mirai)", "value": "62149e55a363f75502c662eb2144fe050642e422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777719229, "uuid": "689d8073-4c17-4bf4-bceb-67b1a2a1e4ed", "comment": "Malware payload (Mirai)", "value": "7dbd277f03249e587374c40801d2fb9c9967cbbc5635dcbd968d627c99a97071e9f71090421638b4b552b989f37fa142", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719229, "uuid": "a5b511bd-4298-4a35-99c7-e8053dfc6a33", "value": "T125731220570549F5E2A6D27BBAF95FD1DE484EAF6806AEC7110CD1AD8C1C4F724873C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719229, "uuid": "47c1d129-6228-4f61-a7ab-63b2d7ff76b8", "value": "1536:hHBG7Ba5LKW14QPFUB1Qip12/AD0fv6NTwvXW32Nt1VJuy:hI7BatKWSQaeM24IneTwvCmt1VQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777719229, "uuid": "43cb7cae-5d50-49c4-a1e8-889f46dbaa15", "value": 79432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777719229, "uuid": "e08f4dc4-ad24-42cf-8c08-ebddf06d79ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777719229, "uuid": "b8363f77-2577-4b35-ae7b-48e2438720dc", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8baab8-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694626, "uuid": "0c4faf59-d891-497d-a953-2848dd07e3a3", "comment": "Malware payload (Mirai)", "value": "ac0853c8cc0c22166e622862b96a02bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694626, "uuid": "60bcf168-4cd1-495e-a350-99aedefc3694", "comment": "Malware payload (Mirai)", "value": "f1b7e0a54802d2456b4e5525341c09e9f496ab8db367b7a679023241a02d7cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694626, "uuid": "720fa69d-6c8a-45af-ba84-8e9052c8baf9", "comment": "Malware payload (Mirai)", "value": "0c1b11bd40a6f01490ba8e5c50be1e3f5de4f535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694626, "uuid": "8dd0d4d6-8b7c-45df-b0a5-0108499ba6de", "comment": "Malware payload (Mirai)", "value": "246ce23329c4399ae9edcc09e009210fe1ef5ae44c4ac400a432c334e60a1080aea74e344fdd5c6e095732813404d7fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694626, "uuid": "1aaaaf27-63d7-426e-92ef-a5c713dcc9ab", "value": "T1636319C16A43CEF7E81311F112F7AB324A32FD3E0866DA86D364FDA25A515C1B51636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694626, "uuid": "07f116c8-cc2b-4b3d-89c6-779aeaabefcd", "value": "1536:K33Ah4QkZOoLs7BX2ReUByBHVg9QBwUQI5yuY0YPxOIH8rx:Mg4QkQoEBivyBKGBwUl59vwEEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694626, "uuid": "c1f8e101-4663-4b67-8d6f-b621135195f6", "value": 70352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694626, "uuid": "a2fb0335-b0e8-4f66-9380-945abb390461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694626, "uuid": "e12b786f-5b78-4560-9352-fca0e0793c1f", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96aeef59-4622-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777724979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724979, "uuid": "7f869fce-6586-462a-a91d-912c56d6b569", "comment": "Malware payload (Mirai)", "value": "548c7134685c7d52f313667989e85c9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724979, "uuid": "5e59756d-0e32-4683-b597-f3146d84325b", "comment": "Malware payload (Mirai)", "value": "f1e2fc261ccf023df85bb2448e0c01af4450f378b0b17cc363b17c23fd1bdd40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724979, "uuid": "16a05a1d-1b9c-4431-94ff-8bae420248f4", "comment": "Malware payload (Mirai)", "value": "6a38510e6c76443cd215446e4b342a63f4ad8882", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777724979, "uuid": "55e12c22-30d0-49fd-894e-554fc1b95329", "comment": "Malware payload (Mirai)", "value": "42c98647c204f4ae1b1c1b009027e0a6b4d943752ff9023281f79546ffbb368b978052617f6d203a3ac50229505151ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724979, "uuid": "97e93736-c09b-4b45-a0a2-b67061149839", "value": "T1EB533B03AC8250FDC44DC1B48A7BA536DA66BABC133439587794FF26BF56A211F7C608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724979, "uuid": "0c7d5195-bd24-42ca-9bfc-91e513e8fabf", "value": "768:EPBw5NBhfUz4FSXOBVGbRl/W8QeUnI9elu7KKsMJmUn9LcSGVIiN5Y0iagNSMKNk:iohfKvNCeyIKVuJV9hGX5Y0SSNNOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777724979, "uuid": "3c201b05-4d35-4536-ad35-454b800ba4d4", "value": 62816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777724979, "uuid": "8b351f0b-be3b-4317-9a10-06ec9b1aa1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777724979, "uuid": "02e6d9ef-819e-46de-a8c3-a79f5f481ec1", "value": "cube", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b077bd-4682-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777765991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765991, "uuid": "aa592eaa-7f6a-42cd-bbc0-bdf0593b44d4", "comment": "Malware payload (Mirai)", "value": "408b6dd1a3c695ac574dc1a044ff97cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765991, "uuid": "13ad5197-15cb-43d9-9f1d-b1be798c7685", "comment": "Malware payload (Mirai)", "value": "f261dc446b5ae9717cbc4da485b5d3e8e02171e2d4cdecee76653e377dcf93a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765991, "uuid": "bdf83d54-6b63-4cd5-99b2-3d32b9c35036", "comment": "Malware payload (Mirai)", "value": "734c379b25287ea0ed4c6dce7e6ce21e0b180a65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777765991, "uuid": "1c1a7957-e1df-4c8c-a19f-2ba0895b3aae", "comment": "Malware payload (Mirai)", "value": "59c6104b43323924a0df41b79eae90191f311e62321d89b52206fbf322659a82c3c9ba6b6cf20723dcdfc589418ab9c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765991, "uuid": "7700ee5f-6fe4-4deb-b431-3800d1e0f2ca", "value": "T163B56A55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765991, "uuid": "d132d294-b498-42ab-841c-e9a3bc845e1f", "value": "49152:L9fZNE8mNz/I5S/AwGW9UI8wI4nwQnVJIvPla:L9vE8C/0oAwcXwIuJIla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777765991, "uuid": "d246f040-4ca0-4955-bb59-700bde21d81b", "value": 2486164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777765991, "uuid": "09d02ad3-4524-412e-87bb-4730aa79505e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777765991, "uuid": "6d602a38-5fa8-40aa-8648-2e4a9a496354", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cadbbf-4648-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777741273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741273, "uuid": "8191d65c-9a87-43b9-bb5b-2ddc77a586d2", "comment": "Malware payload (RustyStealer)", "value": "3487c549c1a8f38026850cb603c6d0d8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741273, "uuid": "479851ad-fd9a-4d16-a9d3-f1f82e52616d", "comment": "Malware payload (RustyStealer)", "value": "f388cba812789d4bcc44fd3cb9e7440436108186ba47c47e69aca64a47ce8809", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741273, "uuid": "f125c1e0-00fc-4081-8138-49f0b05cf8dc", "comment": "Malware payload (RustyStealer)", "value": "d0a50ad60df74dd94baa0e566974974a57a5b5b0", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777741273, "uuid": "c2b27e1b-654f-41ac-be94-247f921161b5", "comment": "Malware payload (RustyStealer)", "value": "ed57a2c84b008aedf0c3354fef79e0dde07f6d415954cd66e5915d3d7cc29173600fd91b48df9311b7c5947d95711360", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741273, "uuid": "e511111e-4e77-4de6-aa82-f660fcd25949", "value": "T1AB672314E08E73F7F6958F496669ECC7575DD17DAC2A0BDA84B8B40B0ACA1B074E384C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741273, "uuid": "796dcb46-df7a-4e65-b793-7f710ca1d69a", "value": "8ec6648fe811daebc87fa652b39f1657", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741273, "uuid": "135a7ff6-d9e4-4fb8-ad62-9eff7012a73e", "value": "393216:jiBmXquDtN/9ZAkTSZPOUIBHCzpwfxKLT0mliPUNHJHu1gbt/3dVOIdxJIbdpRa:mYPZCJZmN8SfxKLNliX0/yIdia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777741273, "uuid": "1f12ab3d-ffb3-467e-b316-4c89f6d81c6a", "value": 30544878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777741273, "uuid": "63e54b2d-182f-4e90-83e3-23567b8b9735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777741273, "uuid": "c40ecc52-d9fa-46f7-b2ff-1b4a76f0880e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece7f52a-465b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749605, "uuid": "2c916426-d287-41e0-ab88-e304b59e60d5", "comment": "Malware payload (ConnectWise)", "value": "d8412ddeae141566982cbf54f99f7b77", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749605, "uuid": "608b3313-6497-4a83-87a3-a39279448d23", "comment": "Malware payload (ConnectWise)", "value": "f41ead1b95d44e460c0d8851cef3a1f13775d42dd6c797ff73ae7428b3106695", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749605, "uuid": "63bfaa94-ba49-495f-b34f-7c0e735ae1ad", "comment": "Malware payload (ConnectWise)", "value": "6e055285c1cf068c2bbfee0daa4b35b2674415d7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749605, "uuid": "ea7d23b6-877d-46af-a99d-6f4796c12cd1", "comment": "Malware payload (ConnectWise)", "value": "e7fb37a91090efd37c79555194add200ac524d8941ab72f7d84b6b95d6aac8f9e53c4d94702e1c0383d0d9b2f9610db4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749605, "uuid": "eb2a8d38-556b-4351-9aa3-06127dcc3691", "value": "T19F646C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749605, "uuid": "7519e111-dadd-4f58-820b-8e2dfd38e37c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749605, "uuid": "15b36a10-9ee0-40e3-a910-0586b507a574", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji90:h1iw7gryNkSV1hy1Z1u2JLu90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749605, "uuid": "12e70df8-b3c2-4ab1-a418-69ea370daafa", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749605, "uuid": "ee9f4958-02a8-47f5-9744-e5400bf870e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749605, "uuid": "06702564-74d5-4382-bbde-16a204698db4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5545ac47-463e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736895, "uuid": "ec5fe396-10f2-45ff-ae3f-7ba7a145184c", "comment": "Malware payload", "value": "a6d8c0daa130eae1bd052d4cab664ed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736895, "uuid": "777c3764-52a0-49ce-8125-ba0a6046bfd2", "comment": "Malware payload", "value": "f431f9bbe9ab6f9d5cf44171143ed11f6a07b46ca4cd78d387c81b165286c3b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736895, "uuid": "2b2f7e7a-608f-4fab-a1cc-8f3225ce8e9d", "comment": "Malware payload", "value": "7507427f76b46422e3970e96b157d776085d1125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736895, "uuid": "bd061f98-9862-4f38-b2af-0ad8f0dfa384", "comment": "Malware payload", "value": "1cb74a82908abc0fc7f221c16a75ef08d627a59d509ddde3a80efd915c4a881b4dadb84dffe3e1a4071e8afb50f49368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736895, "uuid": "3041da05-499f-46e6-813b-bd680ac2b9f2", "value": "T1D157DF77814638E9E9B98CB4D01025416DAC788B5778A3C7BAC871E667EB7E08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736895, "uuid": "0e71d372-8c1d-4f90-b0b0-7a35f0196da9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQF:cqYUQuVDt0TZEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736895, "uuid": "1b2cab9f-6750-4ce2-bd42-0279268b262d", "value": 27459584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736895, "uuid": "b762ad23-3e09-4c69-9da0-ab6cd023212e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736895, "uuid": "a356b187-275a-4785-b473-5553fc70a12f", "value": "f431f9bbe9ab6f9d5cf44171143ed11f6a07b46ca4cd78d387c81b165286c3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e1c50d-464d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777743319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743319, "uuid": "04b1f925-7bf7-4422-87a8-eb35ca52569d", "comment": "Malware payload (ConnectWise)", "value": "1f4f7b60334d947bd8061b34c358a23d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743319, "uuid": "b77d37ff-bb3e-41bc-9931-e38bfbea0c19", "comment": "Malware payload (ConnectWise)", "value": "f49f4f98fdb7ae040a0437bed6387817a7c86b9e94f8bf4f3555fe239ab8a55e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743319, "uuid": "b28b30e6-2351-45d5-93bb-6c679fac3e5b", "comment": "Malware payload (ConnectWise)", "value": "76df7e0a3a1565201021f25761126c170007a3f1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777743319, "uuid": "9976746c-20eb-4219-9d87-a427cebc1aac", "comment": "Malware payload (ConnectWise)", "value": "b0954c07c3cd15d0225cd3cd3070584e5ee08056037e03a31b55262a74f567e7cf1fb99f5ad0015a5fc90215faaa6d23", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743319, "uuid": "e689688c-1eaf-4557-aa9a-ec1580ba91a9", "value": "T148646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743319, "uuid": "b7a6be55-7887-45db-bba7-eca3883450c0", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743319, "uuid": "93a1a8c0-bdde-4069-aa08-ded77ff1da90", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti95H:R1iw7gryNkSV1hy1Z1u2JLI9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777743319, "uuid": "e3fec836-bb42-4ae6-a2aa-14e98c4a158e", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777743319, "uuid": "99721493-a6f8-4892-afca-e9af0ff2e3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777743319, "uuid": "ca3b6db0-ae74-406e-942f-a79cf34eed07", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb20826-4625-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777726170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726170, "uuid": "d8dbb1f6-1080-4d05-8612-28ab0b6c429e", "comment": "Malware payload", "value": "6cb528506b48f798da865cd9a8c027b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726170, "uuid": "45d99fc5-248c-4865-939c-6e191390daf6", "comment": "Malware payload", "value": "f58e7088a1e52153e1b3b675f530396fe56f54b15da20e8bf40fa709e1dc2f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726170, "uuid": "6b923a4c-1fda-4b73-b002-a146793d6ad9", "comment": "Malware payload", "value": "2a64095fadd41f88e35b043056d043b061c65aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777726170, "uuid": "fc42ea0a-c7e9-40a3-9094-9cb4f4602856", "comment": "Malware payload", "value": "6f1adb6166b9973370c760896551ef6fbe56ac5f1fb9d898d89d21e629e943e23a1763ba52cabd10c8d1b093ae36b129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726170, "uuid": "668f8f67-a9e8-453f-9e23-ddcdafd1aec6", "value": "T183B65B57ECA551E5C0AED175CA269262BB713C885B3063D36B90F7282F37BD0ADB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726170, "uuid": "71abab33-9999-4e71-b1f1-9021f4ea3df0", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726170, "uuid": "978c4e6b-1551-4250-85e6-e03fd07ab9b4", "value": "98304:DHogH+d3jLvJ1Hiobx28BvlSs2AZq9307A+50sRruQvBhih8bGEJ8:DRevXBvlP2Ac937ds/J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777726170, "uuid": "a45706d8-218a-4098-b104-b388226b66c5", "value": 11121152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777726170, "uuid": "0251017a-b862-40c8-8971-6ac158e01dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777726170, "uuid": "0c89b3f9-fd92-4d24-b978-329cdad4b27a", "value": "skuld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f669475a-45e0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777696793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696793, "uuid": "4cdb6ac8-7e60-4499-ae6e-056dc25b8c6b", "comment": "Malware payload (AsyncRAT)", "value": "25304cba1af5d7a626c29a9c74b01cfe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696793, "uuid": "1e028d1b-680d-4e05-9167-c329f371a1d4", "comment": "Malware payload (AsyncRAT)", "value": "f78f28bed3f3bde52820f679af796dc98eeb25067bcff76a4935d8712e80d5e8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696793, "uuid": "0d9295d6-1e2d-4158-a1ac-479be185a788", "comment": "Malware payload (AsyncRAT)", "value": "5ba7133848ae4019ba9a76083e5064912b15a0c6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777696793, "uuid": "683fabe8-2f88-4a5d-bc97-3c23241b7d5e", "comment": "Malware payload (AsyncRAT)", "value": "754eaadaaed0702a7b11e801b4fe21a843238eabe282f1ceea39f938f0ef82e371e8263f104fe7b45f7e176492f5af9d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696793, "uuid": "2dc0cdee-8429-4f91-a680-e5cb5d5386be", "value": "T1BA23E988B3D90131C8BF27B16873121982F476A34916DA1F7CC852DE7B27B998641EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696793, "uuid": "f891f38a-1a71-47bf-a9fd-bfdc796fb903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696793, "uuid": "0efa1d9c-01de-4440-85b9-5620b998f913", "value": "768:ibPBxIruUlWgB3y3g8KEzDcwbtKNmRhJMehLOzWUpn9uSx:ibPBxIHlWkGkwbtKy1OJuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777696793, "uuid": "bd640146-c7c3-4e4d-a68a-083bb952f9b7", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777696793, "uuid": "1f559ee5-48ff-4656-9ff2-3e867c72f5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777696793, "uuid": "4c69f7a5-4abf-4550-8fcd-8e1e7a1312e0", "value": "DeadCl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff95dd8-461f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777723760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723760, "uuid": "8534a817-44f6-4d39-b22a-c5e9172fd104", "comment": "Malware payload", "value": "b7476812248be874309354a96b46438b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723760, "uuid": "df2d5e39-d633-4480-9ba4-751ca87ba3e1", "comment": "Malware payload", "value": "f7988b9738e1a15fcff47517167404f2322994c5b4bd77f67cec856413f559d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723760, "uuid": "43d1e4e6-0c49-4667-8981-48a6c3ab0265", "comment": "Malware payload", "value": "5a67c5fe488c2a59903bee023d0570088878f83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777723760, "uuid": "2501373e-160e-4858-a3a5-f3c863af0fff", "comment": "Malware payload", "value": "2b78fe2d6591193454c67c742538908f4ea805b6f3718e2ae6768062b2bf2680f3cc5b56e942f0ba779d80f152f0feee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723760, "uuid": "d42b2bc0-3685-4a42-8136-c0660df1dbe9", "value": "T1E555A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723760, "uuid": "6567b975-adaa-49b0-aa09-4c68798a1f0d", "value": "0a98343311b070c6ce1a4debb2e92254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723760, "uuid": "cc186add-a58b-421a-8710-028e0700a475", "value": "12288:T+HUnzT9inzIo+094ht5m/nylAx4M3FuiXh066XwThxoSvw9E8:VT9inzI9BM3Fa66XwTVI9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777723760, "uuid": "78ef8669-4de8-4370-893a-dc4456664ba7", "value": 1298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777723760, "uuid": "534f8518-d484-404c-9e22-cead21a84f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777723760, "uuid": "3e7f6b35-f1d9-4068-a35d-7ea10285d56e", "value": "e1bqi8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63315731-464f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777744220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744220, "uuid": "98b12466-40fa-4867-863d-4d2b4b0bf998", "comment": "Malware payload", "value": "86e5d9737a1a7e61fac8cb90881e4ad6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744220, "uuid": "85118306-3386-43ad-b8f5-9b7ef1075b64", "comment": "Malware payload", "value": "f81e5c01c658b8cdf98f043411c76e5d15f838c2dd960ee957aa03bb7d35d308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744220, "uuid": "dec559e6-79c8-41a6-bc96-e40be400028b", "comment": "Malware payload", "value": "0a56c9a2188c2a472f6d572e9a3c2c0bb26587d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777744220, "uuid": "c76bf996-c905-4e8b-9c62-ededab2c2a3b", "comment": "Malware payload", "value": "ac8b577c4806da6338a52668853f870d3770bc88574a6d6bfb70b7ed91c578f09abb6190b12711957d059feea506b6d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744220, "uuid": "45d2597c-be80-42d9-8052-121aea4ca4f8", "value": "T135134C01B30C0D43D1776EF03A3F27E5D3EFE59121E4EB85661E9A85A272E325582EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744220, "uuid": "1742e322-d577-463c-bec0-7585729e319a", "value": "768:XsIhgAgAgAN9LmbPiKumdLFVctIxmEMNKQP2BVlvIH:ThgAgAgAzLWaHmhcKxmE+P2xvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777744220, "uuid": "eb508f8e-a51e-4900-bade-9dbafa3f6e82", "value": 42380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777744220, "uuid": "5831dcd0-fcd8-4d31-85bc-25f151f23e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777744220, "uuid": "838e569e-738d-425f-b2c5-6f849ed9ee06", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cb52e1-463d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736650, "uuid": "5bab28a6-3e4c-47f1-a74a-5652000f73c5", "comment": "Malware payload (Mirai)", "value": "0435942428372f8f0191188564a0e83c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736650, "uuid": "e457b5cb-0f5d-4f90-a43f-f3e91080215f", "comment": "Malware payload (Mirai)", "value": "f86ac036c6088bee14d1c2cde5362d2d9316ed79a5f25fa3364806825f86da53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736650, "uuid": "13ce910a-c373-4cd1-8dde-fa7aa482adf7", "comment": "Malware payload (Mirai)", "value": "55e55daa249772986b95baf27a884b594443bf0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736650, "uuid": "fceb6aa4-ad0f-4fd7-bff0-39b9aff9809b", "comment": "Malware payload (Mirai)", "value": "f8d253484789ba960a3e5ea6d7d6a13f18b86c1b19c66d16830bfe62d9d101fe5f0dc7b65c42e38a043046d48d06590b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736650, "uuid": "e12b882e-fbbc-49e6-9b22-0bd635aa64b5", "value": "T1EB53E58178919A17C5E422BBFA6E018D373563F8D1DF3216CD226F2476C982F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736650, "uuid": "f363f22e-9551-48c3-b869-b245470af90e", "value": "1536:gP1IwP44TCRfNdbYakabDrznQlG9Wcq8JJTnd42+:gP7V4saznUG9bqAJTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736650, "uuid": "ef4fa1d5-20b8-4cb7-9307-fd12ff0f3f4b", "value": 64460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736650, "uuid": "9894462e-eda8-4a88-bd2b-fecdfc8ac471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736650, "uuid": "853b73b9-3368-407e-9bf1-fe3f578ce6c2", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358b04a-463c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777736221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736221, "uuid": "c60561e3-4f51-4202-8cf3-43490ba1c83d", "comment": "Malware payload", "value": "cb9dc8e64c586c22c7250a0ac94aa63d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736221, "uuid": "e00e1061-e0bf-4d4f-89c3-935f656219e7", "comment": "Malware payload", "value": "f95b5445eff32c2d2ee41a40907d6cde8cf7385b07ad81e9f1a368610d39b26a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736221, "uuid": "c3a8c65d-bcaa-48b8-978b-0a598b21e289", "comment": "Malware payload", "value": "66bfd821cf859dab2e809cba8710b1efb86debbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736221, "uuid": "10177f86-f1c7-4cba-9ff9-c8f67efc642f", "comment": "Malware payload", "value": "7a95427c89943b22acb6ff2ccd7a7f001bec949967c553041ffe740cb9beca1f9f1a9a5c80b1e353cd6ad53ccaf5c0fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736221, "uuid": "19c20a64-b5e9-4f4e-a0d2-3ff078e161df", "value": "T1CB31118E60F96042C6DECF0070E28DD86785959371DA3F3ADC892E66C4C9D547099BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736221, "uuid": "358a263f-d0f0-4b79-a5aa-5df3836422ae", "value": "48:s2a4qXrqwM1lPk5LTa8y4K7GMuo789bq++Lykf:Og1uhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736221, "uuid": "768fcc98-3331-47b6-b27f-5209ef228cbc", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736221, "uuid": "d2010ca0-63b5-4f97-84ed-ce133509be5f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736221, "uuid": "d138b170-15bd-48e0-8318-05e6508f4173", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee27f274-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694632, "uuid": "4940c0d2-f18e-4e1b-bf8b-a6ec1350a12b", "comment": "Malware payload (Mirai)", "value": "d4535b9eb6db8c68db6e75c0cf761194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694632, "uuid": "95da9e08-bb43-4d9b-868e-67e905d63a69", "comment": "Malware payload (Mirai)", "value": "fa10cba464cdf5f841df764e96a1907e1aa13bae24c931c2fedde6e1e8888e62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694632, "uuid": "a5cfd32c-f60f-4d0d-b9e1-0903d301eed1", "comment": "Malware payload (Mirai)", "value": "de049c4269626c44c348cdd320e3269b512b5c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694632, "uuid": "f3e1fce2-805f-476b-881b-bf382bef8060", "comment": "Malware payload (Mirai)", "value": "b03dad1d277a9f8bebcda0707c9a27f100febbde373d01693ecce417ff27df6d62709cf96bdd2d4513d4b7461ad7ef9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694632, "uuid": "b9b3af2c-7fb6-4907-8010-e3b68bafd160", "value": "T1A1A3B90E7E228FBEF769827047F74E31965877962AE1D580E17CE6401F602CE641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694632, "uuid": "76e38259-c86f-4fb4-9be4-2f421a999a6e", "value": "1536:4mNy66cHOBORmiFMUhWohWnbhWcDsOqqxGGIfX77eTEJjQ6G:np6cHAORVyqqxFIP73JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694632, "uuid": "9759a079-3a79-441a-bdee-a9c38939d0b9", "value": 105076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694632, "uuid": "8a770467-4afc-4692-a12e-edb6ad1fcad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694632, "uuid": "081e934d-dd6a-4d64-b85c-ae469c0ed851", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8205a80-4639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777734914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734914, "uuid": "ed1dca8e-72e3-4233-9275-d99f0dec0d2d", "comment": "Malware payload (Mirai)", "value": "4f8e73ba823ace0774cd3ac900155b97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734914, "uuid": "db0e61f7-edac-467e-a02c-c6ec16391dd6", "comment": "Malware payload (Mirai)", "value": "fb73900701f334470ac2169e019a2b5bef8b324c3e9e291abbc8e6902956c172", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734914, "uuid": "6ebdbbb6-45e8-4baf-a909-3309c4951a1b", "comment": "Malware payload (Mirai)", "value": "ca5f96217407278940120395cd1c1d33731abfa3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777734914, "uuid": "79ab99ce-140f-4d56-9498-8af720ab2e65", "comment": "Malware payload (Mirai)", "value": "40a55828f4704e997ef55c114ee0acdb01ff08ae62bda2ddad76edde40d3dcd099e24ea66c4fb47fbbeff7f5cacd149b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734914, "uuid": "a1daa2e7-5777-4f42-9d6f-703d64be86cf", "value": "T18BE5E85F5E319F6CF7B487344BF34B34D7AA22D617A1D980E1ACD1085E6024E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734914, "uuid": "bbbb8cbe-c973-4838-9827-55875c88c7c9", "value": "24576:aZb3qtpuYu2MN0zGoYx4ONoeR3dL6G0REujkGRwPtxyn8PXOJV9H8tifQIzAv/vc:o3AVGw9uh6G0YGRwbYbQXv/vPMEg7YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777734914, "uuid": "a31d7d42-e2fc-4e36-a3e4-53be409e2005", "value": 3168544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777734914, "uuid": "0498a1ca-5af7-4314-85e3-c1343b6aebf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777734914, "uuid": "d4aa72e9-e951-40b4-a286-e0746f7cfb11", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfe88c2-465a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777749176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749176, "uuid": "b6026d5e-f3d5-4f2d-b147-e0da242c4a36", "comment": "Malware payload (ConnectWise)", "value": "4fbcd82d533f3b95a9a5685af06d093d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749176, "uuid": "4948cbba-5661-428f-959b-d96a31be0942", "comment": "Malware payload (ConnectWise)", "value": "fc818b4b9a887e394f8ec3ca4aaf508be710a5f8c1b623e4ab4ce05deb93a6eb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749176, "uuid": "15a9ffcb-826d-4567-8ca2-d7dff6caf94a", "comment": "Malware payload (ConnectWise)", "value": "e007817d2a052917c1deb61bbcbc5999e5da41a8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777749176, "uuid": "43622336-0a73-48c9-81f0-9cee7e9efbb5", "comment": "Malware payload (ConnectWise)", "value": "6abfb93931f88e37cc305827956e2238f96b3dc7b3b3c5908d7923778a12cd9387c00aa4b0e5be53a9f1a049cd3ddcec", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749176, "uuid": "d433b6f0-82cb-40d2-977f-fb5fab0fde78", "value": "T1FB837C43B5D19871E9721D3118B1C9A15E3FB9211E348EBB239802AE5F741D0AE35F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749176, "uuid": "33d416df-95d0-429f-a7c8-872593b51584", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749176, "uuid": "9e4b458e-94c7-4c62-8c56-d3182db4fab5", "value": "1536:VXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWeuHid:lE3x5KBDYiKWm/iSw0fRMvyge7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777749176, "uuid": "049d57cd-a798-496a-9caf-4e4924316c96", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777749176, "uuid": "8e499025-1f08-49f6-a91e-bbb2fe64b1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777749176, "uuid": "c57a0f44-1a2c-4646-a0f8-4c182478b3aa", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef84724b-45db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777694634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694634, "uuid": "05e30b6e-23ba-434f-bf77-df6ad7a4cd8f", "comment": "Malware payload (Mirai)", "value": "e0887b76114634fdcca4dca9253a058a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694634, "uuid": "0a133322-65de-46b5-9a46-433e0f4500ef", "comment": "Malware payload (Mirai)", "value": "fcc3d6ee0e9a1da7575449d5c023f1b9689d0b3aed156e28ebc995d31ae604d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694634, "uuid": "64d997b4-5e39-4021-bdd1-ade807569c77", "comment": "Malware payload (Mirai)", "value": "e3dc38c4a777243d473e85c74180cc827f619dba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777694634, "uuid": "fae9dbbb-b503-4f2b-a697-e2f9965b4c9b", "comment": "Malware payload (Mirai)", "value": "707e8f92d2478c5581a5cedfe222d61bdfadd809db03c8f5b19408ccf2fde76b3e41c27c585e92f68214ca4dddd5ad82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694634, "uuid": "b6af0d9e-f0b0-4f38-bf17-8e4ae0088d5b", "value": "T1EF730802770D0F43C1632AF0277B1BE197AABDA529F4A685742EFEC54274DF22185F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694634, "uuid": "fd4afc92-d678-419e-bc34-1887ade17594", "value": "1536:yr9d7WCG34X5L7r369Hd5Be0j0H1+7rRvQQLahYpytu:PgD+7pQQGhWytu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777694634, "uuid": "080785f4-1ffe-41e7-bdf1-532b59175ef0", "value": 80636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777694634, "uuid": "9dc317d8-bb9e-4542-8cd7-67a7233ddc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777694634, "uuid": "6e678355-81c8-4deb-aaf0-d9393495244a", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f766d0e-463a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777735248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777735248, "uuid": "4ce73e5d-0c97-4019-a283-c3959b478abd", "comment": "Malware payload", "value": "10b36a603c98760836702d731c7aa5db", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777735248, "uuid": "9cd023f2-3d93-4a5c-a6b4-c7420d85052d", "comment": "Malware payload", "value": "fd04f0366d78e4abb5d7c7c0d2a5bbb33a238bb7d3de4adcf9f2ad1e92eb235a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777735248, "uuid": "4ee6d4db-6489-4191-98b7-1880c388e784", "comment": "Malware payload", "value": "f09f90d048b68f6a68b71e02a38ea7e9b326bcda", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777735248, "uuid": "86f118c5-7dd6-4cd9-b300-ae6795178613", "comment": "Malware payload", "value": "165b4217c5dbef1a477a3299d889f364f7bd62c24faa008bfda826cf6da677180b8b68078feac44f341bb7d6f8c680a9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777735248, "uuid": "23e014f6-24a4-4c15-8ac1-f39c7d831f2f", "value": "T168C5E60D005487DCC97D823654CF269EA110332C62781FBEB2665EB18F79BD47EE5A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777735248, "uuid": "1a4bff7f-a39f-4fa8-8d7f-58329c0b8ebb", "value": "af9a47539f01e4b6a139b2f89653da6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777735248, "uuid": "ad9e91ef-cd69-4795-a7a5-0ece312f7f41", "value": "24576:43kTSjEtX0PJL+qkYr0haZKsJM/AnO9qHmkz+hzl4T+NLOinLS9A5/Kg6Q:XOItkGtqcANHmkz+hR4T+N6isq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777735248, "uuid": "4b064969-e2c3-4c8f-82be-74380d6031c7", "value": 2560512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777735248, "uuid": "2f0286e1-afff-4c41-86d5-b0ea9c55da2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777735248, "uuid": "f5815b26-9dc7-45f0-b565-b181d920391a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0102dd1-45bb-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1777680864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680864, "uuid": "cd5f8999-1281-41a9-8965-17121d2fb728", "comment": "Malware payload (SheetRAT)", "value": "bdb4bceeae01c6587338cba58401a996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680864, "uuid": "dbb2b413-cf24-428b-9e55-72d79c0f367e", "comment": "Malware payload (SheetRAT)", "value": "fd86114e7b9f78a8ec58374a6a3dc901300ebceb7261694430cdbd2ddfec93b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680864, "uuid": "4ec0a677-ba1d-43d1-b5c8-09616f4435fc", "comment": "Malware payload (SheetRAT)", "value": "754c7ce7048562fac166a93d0f7e7cf4fd092c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777680864, "uuid": "cd2d5790-aba4-4505-be6d-1870c18b504b", "comment": "Malware payload (SheetRAT)", "value": "2297bca4efcf4a34db26f25add764539d5e52eabc0bce466e5b1527207b02da7b5da2bb03dfc11bdc023a2017f9fa545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680864, "uuid": "9b45445f-e357-4f3f-83d5-27bcc5409ae3", "value": "T18166336536DDD5F5CB9307BC2DD9CAA14AB3D0611F1293C72BA00702AA51EE1377A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680864, "uuid": "ba48cbbe-733d-46e7-a835-b9e82ee668a7", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680864, "uuid": "d0a6cc1b-8033-4d0f-ad86-732dfb6707f4", "value": "98304:/B5Y8GxiuoaN5zNpYU+XNSY4/3pAePUN9tk:/BHGtt5zNaUyM/3KNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777680864, "uuid": "763a0d6f-9aee-4439-a68a-d21a2867977e", "value": 6601845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777680864, "uuid": "c0859d75-7b17-48fc-af9c-68b9834a34d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777680864, "uuid": "e571277e-6e93-4d9c-91a2-3efe56227072", "value": "jevj6a0s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453fd8f5-4653-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777745888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745888, "uuid": "2fba1943-d298-470b-a886-7d0a3f64a690", "comment": "Malware payload", "value": "fa530a47ba952742488fe7fb594f6b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745888, "uuid": "6dc8695c-937f-43af-8ea4-2775617c0c53", "comment": "Malware payload", "value": "feac8e4eeb08378b0bcddd5813b8ca3e34fde1279a028d83525c8e70c4fc9c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745888, "uuid": "509fa66d-78a2-429f-8488-41d884b0f910", "comment": "Malware payload", "value": "4eb82dd765ff440e2fc788f8879037100d1381be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777745888, "uuid": "950e8ffe-074e-4ce1-a99a-004832b07396", "comment": "Malware payload", "value": "9d46ccdfa2521b46772207c5a4104b042f5de9569d42fe5db13d1c3a7b1bbf04bd90fd9ea1d82593b84b2e0bc5e9708e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745888, "uuid": "7fcc09ad-33ca-4c44-a6df-d7e489008b2c", "value": "T1D7864B137A28E70FC62821300CB2CA94276A1C9682D7915BB745F309F9F61BD5DAECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745888, "uuid": "285ef974-1624-48a9-b9f8-33cf038c6d5f", "value": "49152:LNu7vyafxvoTeM3bZN8lMCtlb5KoOVvtUzAbGHHR/9rgHo2+LE4lvzmrljwia5pl:GtQ4NcjwiQ0TJVCBknUjE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777745888, "uuid": "32c5df95-2410-489a-bc85-ec59f311f3f5", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777745888, "uuid": "16881214-0991-4879-9c3f-7e51eed997b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777745888, "uuid": "52a2f342-7ccd-4285-991d-85ee4fc90b02", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd096bfa-463c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777736318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736318, "uuid": "ecde7e13-95ea-4517-93bd-2251b77e80d9", "comment": "Malware payload (Mirai)", "value": "5a183b64bb7d5eade1235599c82d1fe0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736318, "uuid": "fc806b43-88b3-4f80-afa5-fa45e9a7c7db", "comment": "Malware payload (Mirai)", "value": "ff6172940531a28f63a08a423b4ef7091023e0f8fe1a636769fe8ba3a3f02e10", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736318, "uuid": "f24c51fa-0993-4610-a8c0-e267841b5f1a", "comment": "Malware payload (Mirai)", "value": "fc6c23a140ce7b4d66ddbd100bbb5d0931063ed7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777736318, "uuid": "20dbaae2-46dc-4c96-bdd2-82ce85558a4e", "comment": "Malware payload (Mirai)", "value": "028915378c0b81978b9234cebd524f41000ef8f494ef8574784717a097fe762363f6195b3ee37373098b7ca7d60b1484", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736318, "uuid": "b0aaef17-1191-4cb4-b40f-113cf851cce3", "value": "T1CB762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736318, "uuid": "b3742efb-a264-4205-8d5f-fa46ac743a9a", "value": "49152:oDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJ9WUhHEvmCLpR5ELf:U+4vq3QbRSP9ODiDoEv3mpbsELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777736318, "uuid": "10572f25-a11a-49bf-97d1-fb51239b9d74", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777736318, "uuid": "03c6624f-8951-4413-bc68-96fb0fbc2217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777736318, "uuid": "3ffd3cab-8b7a-4fe1-a4a5-85ab0d8ae942", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e038929e-4633-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777732404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732404, "uuid": "d1340020-5914-4e6a-bdf6-5d630fe341cc", "comment": "Malware payload", "value": "8e7c6a75405fb3a5836f6d9a0a969490", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732404, "uuid": "6a33a9d2-9311-41a9-b964-78aa4e5bdc27", "comment": "Malware payload", "value": "ffdd5650f21f1b8df076cf52606ff5e4248758a2fd34596fb89b0c084a8743b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732404, "uuid": "6cd20538-8920-4f37-a0f4-dc73acd7152c", "comment": "Malware payload", "value": "845aefd67b5405ed8ae055de7ce6986fd504f6eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777732404, "uuid": "60e3ddd0-9b7e-4a8c-815e-6ae57e144553", "comment": "Malware payload", "value": "b0c8b23172c3faa3f9da26ba8bc90dfc7b8e501f63e86e422e43332c49a9e664869a9ede444ad48bb72723bfe3edb514", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732404, "uuid": "6f356c56-180b-424d-8dc5-4f287c8aecec", "value": "T18F468E1BBCB95859C099A13484736607FAB6BC055F2217C75AB0F7282F3B7F05AB9B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732404, "uuid": "e3282688-bac4-4489-864b-385b981defea", "value": "3bf0a1d8a035e80b12d367bef5922e69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732404, "uuid": "10ec1436-54ef-4bc2-abca-d016d85f093a", "value": "49152:ILOrhOO0TWRV78ukN4gewPXTCkLBRZBK35SNx8TKh5SoixDd/1fOqjNe98DdUoLT:ILmqkg1zHBsS4VJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777732404, "uuid": "2da0ad68-75bb-405f-9da7-f5a618d65a7b", "value": 5401600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777732404, "uuid": "3990628c-170c-41e6-83a6-5a315452ec14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777732404, "uuid": "e969676a-1564-4889-9c3e-18a19f02c19f", "value": "user_6747_google.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }