{ "Event": { "published": true, "date": "2026-08-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-07", "timestamp": 1786147381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "21254f05-6789-4eb8-a60b-33b99ba057fc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b69c7e-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786133019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133019, "uuid": "6738a587-a7de-4fd5-b850-fd5dc9e3339b", "comment": "Malware payload (Mirai)", "value": "fe26ed1c99da5ef20a762d68b769aa54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133019, "uuid": "6437ff0e-d4d5-4d22-9776-dcd10cfbe06d", "comment": "Malware payload (Mirai)", "value": "003924f140e5ce4ec27ffed10e9927c3a361786a19982dfe538e68dee3e194fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133019, "uuid": "b3f6862e-e72d-4bec-9f16-75fa479089a3", "comment": "Malware payload (Mirai)", "value": "578b0464975e0a183e4db76cd4e88994aab32301", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133019, "uuid": "5f2f5ae4-aa29-4d93-a94e-61cc4a61bcf4", "comment": "Malware payload (Mirai)", "value": "3aee603ec1bc40fe29323df63ab6f057abcc2fa158b8c5ff88c0f3976dfcf7ccd6329bc1d1e6fba5ddbd90337c035a0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133019, "uuid": "10e9d8ab-0825-458d-bfbd-55fb3ef1688c", "value": "T141C32A0275A154FCC156C074C77FE927EA31785D13343AAF7B84BA31AE22E365B0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133019, "uuid": "96e8442c-bcbb-4a4b-b8c8-4100d1a2bb36", "value": "3072:KVSRi5S54Aie1G2OAuAfQLuKoshRzLIK7XG4f+m:KVI54uGCQ6KRzt7Xx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133019, "uuid": "9c60b62e-20ad-4fc7-89e5-7e9c64599423", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133019, "uuid": "62fcffaf-8c1d-4741-a227-583fbdfaca72", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133019, "uuid": "92ea0dce-2e62-4b95-aeaa-37e67297b15d", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fec49f-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129645, "uuid": "bfc958f3-c61d-4e47-a6ec-1e2f3004d628", "comment": "Malware payload", "value": "48c190c586353263c1e5b8a4e6ed5333", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129645, "uuid": "838b1e0c-a52c-424c-bb05-e802313b26f3", "comment": "Malware payload", "value": "01f4fb77ac1d7551b003c910a0991ae5af4ed50a3d5259adb668d4c06eb540cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129645, "uuid": "f6ad021c-bedd-4855-82b6-1fd46496108a", "comment": "Malware payload", "value": "2fddb20d40d3836bbae5a7157267c14f7fa77f7c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129645, "uuid": "5ef9a65b-46ea-4024-8cae-056d24b88043", "comment": "Malware payload", "value": "ca7ae8892399e49615d311c828f40cd9ad845eb9e9e7e23ecadd49ea747ede9726790b25379c4d2832fbe47cb7f96948", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129645, "uuid": "da59cfec-11c6-44ff-bf9a-465c747cab6a", "value": "T1D411C4D5A8D64C327F095C2B75184DC7F281182B00F51DD5B15DA9236F0C5B566B5F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129645, "uuid": "7134c62a-3e70-4ed5-823e-eef331ee3adb", "value": "24:slZxmtD9jWijWr5jW2Fr7jN/F5haHifMDsxVexUQjjJjCmYDYXmYRYU:slGd9jpjY5jPnjN/zACfMDqe6g1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129645, "uuid": "5552ec50-c52b-4797-8361-0a6d946b4328", "value": 859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129645, "uuid": "8577b377-a1f4-4dcb-be95-2cc115963a03", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129645, "uuid": "01e236b8-04d2-488d-b890-cfdccfd34895", "value": "sensi_tp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fa1b73-922b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786084967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084967, "uuid": "fe920d37-620f-4770-bf0c-677ed802cea5", "comment": "Malware payload (ConnectWise)", "value": "91ca1348736c8b8e8845aea6bf944845", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084967, "uuid": "85277d61-9908-4362-9bbc-964adfd24c70", "comment": "Malware payload (ConnectWise)", "value": "025d859dbc0b8811ed5e8590ea238cce6a932166eee0b6eb3a6744941c6fccfc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084967, "uuid": "abe71f3d-a362-4d46-b855-3da402e1bd44", "comment": "Malware payload (ConnectWise)", "value": "69cb29c1673b641688c94545956d42d4331f8c1b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084967, "uuid": "277b9736-e9aa-415d-8af3-ab6c61c15bde", "comment": "Malware payload (ConnectWise)", "value": "652d3a8526275922c02832750d4f85e7aeb5d36cad69ec3e399c01ad751b6c65e1d1b1b9af36a21f67cc6d860621e1a4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084967, "uuid": "8ea5f7b0-5b71-411f-b004-c331d599c586", "value": "T19C646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084967, "uuid": "529a712d-1c7c-404b-84f1-bbfed32fcbe1", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084967, "uuid": "2b3c3ada-f5d7-47d0-ac63-65aa90a7e1d9", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786084967, "uuid": "03398457-082d-4288-9204-46ae3e50206e", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786084967, "uuid": "1ccb8ab1-7c29-4313-85c7-b87e2a4274f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084967, "uuid": "5fb43940-a18b-49a1-a062-98ebc316071d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b61e25-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099526, "uuid": "f5a0ff3e-f11d-40ac-bcd9-fccfd0bb3484", "comment": "Malware payload (Mirai)", "value": "3f2914082c2347d528f70cfcdd6beedd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099526, "uuid": "c4f50c45-e24d-44fb-8581-d392e20020b8", "comment": "Malware payload (Mirai)", "value": "026017f60aa1b4e6d0fee1e464baf77bf34d0c9f4e1008371804ee4d7d891c92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099526, "uuid": "47d331ed-1448-45e5-acfb-f21cde24ef6c", "comment": "Malware payload (Mirai)", "value": "9ae0b71daa18f623f7a65cfcae32362419467b16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099526, "uuid": "435d6aba-7c95-461a-b2ee-f968763895e7", "comment": "Malware payload (Mirai)", "value": "b10751cfe2ca2704b7cdf60a882b64d38536ac8bdb63facea3b5de9251c6c95f07892a24bdb07496c513b9ff9130c728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099526, "uuid": "f0dfd78b-9890-4557-996a-32d7ce5c9f30", "value": "T14D23E67727630D23C0D6517592E34336B6FAEB4628B88A577960AED81F485E032632FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099526, "uuid": "f15944bf-112a-4908-b843-a30dabeb2948", "value": "768:SxutEJ4tFhMPbQ4pqQ1O+C0lOF3atwl6BO3S:18Q4pqIFe3atw4BOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099526, "uuid": "b37d15a8-38f0-43ce-82e6-06caac10a348", "value": 48616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099526, "uuid": "9bf7326f-fe6b-4cec-843b-08c63b2094bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099526, "uuid": "4e056a27-5d36-4d7b-b635-397c5b04f2de", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487411.3497.9337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e6f589-9221-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080947, "uuid": "e86bab8c-2729-4595-a7c9-de140b18a2cd", "comment": "Malware payload (Mirai)", "value": "1a63e31f0d5d082849bafbbb0a806bdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080947, "uuid": "7ade3b4d-1be9-44a5-87c3-7020c8c1f69d", "comment": "Malware payload (Mirai)", "value": "03384c34ed84ca6ee0f31f83492dac221b27ba8cb625fff122e9ee4d19cf8b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080947, "uuid": "659d3516-538b-4379-80e9-9917a41be84d", "comment": "Malware payload (Mirai)", "value": "5df8d07f6075ac21889ea5c62cad43a1b060d1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080947, "uuid": "6dc4d5bc-7c41-4d56-9955-733101339361", "comment": "Malware payload (Mirai)", "value": "62e5f0ac5bdcf245c4527d9417f6881e59ad504e5f959bfb1d9d286356c0f19e2ef076bca9fb3596b3322c4904da413f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080947, "uuid": "94fecbca-eceb-49a7-b42c-a14f0e08972d", "value": "T1F7C34C0675A144FCC156C074C77FA927EA31785D13343AAF7B84BA31AE22E365F0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080947, "uuid": "1d07a2e3-e199-4854-8ff8-60f989a01ab4", "value": "3072:dV8eOTl5PL/4G29A6AeyNi1s+eIgh/nG48GU:dV8/5PLAG4yNi1re3/nyGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080947, "uuid": "79e1d24f-06e1-42a0-9674-1e2deaddcd13", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080947, "uuid": "9861e525-80c4-44aa-bbf8-a13180631d14", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080947, "uuid": "d33b8304-6c8d-445a-8b40-3030bc960e53", "value": "9b2f44e712a494e1b28f3046e8c79031dd87ea92d6ed69c59aeea2bc4b566589.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c82de9-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097751, "uuid": "f51edf18-ed29-49d4-8a25-76f33f5c17f5", "comment": "Malware payload (XWorm)", "value": "d73404e2e685dd1878d060eea02de8f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097751, "uuid": "6ba24a1e-3454-4653-b09d-58be142df02b", "comment": "Malware payload (XWorm)", "value": "03c07c02503cd44bb8119b9e2f74111cb8c75685b67a2744af27c7b9f62febc1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097751, "uuid": "3cbe138d-ea16-4a72-b83e-5bf9eaf73889", "comment": "Malware payload (XWorm)", "value": "8552ac00bd7d56539753a323427602d993655297", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097751, "uuid": "f0b8f584-e321-4193-931c-eea83f96a6b8", "comment": "Malware payload (XWorm)", "value": "db44d271c582142e3114c6b0c14a86f5dd5b7d5d97b70cc0d4c29b58d44e8fe36150b235a0e2abe0f02070eb9ad30fcd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097751, "uuid": "c2aefd9d-e4bd-48a4-97bb-d98c5646f7bd", "value": "T1914316168AF92247C7441D1E98FDB5A07815AFD40F28E418F1BCAFF2B62145DCA2BD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097751, "uuid": "07d23eba-160b-498c-9865-1f2758bfc981", "value": "96:xLIWaE8f9ZAcDQzd6NdGua7x85M3xtp6Eul3Sm:uMkdGF02Ph+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097751, "uuid": "8df735f9-5444-4491-8517-aa4516425c7e", "value": 56472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097751, "uuid": "1eaff988-6342-4e8a-b02f-b8549f92997e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097751, "uuid": "b5914525-6c23-49bc-b96a-16db1db0b9b9", "value": "scan_20261112154840204.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60df0a49-928c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786126704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126704, "uuid": "67588869-04b5-4f4d-a6c4-541c6c460719", "comment": "Malware payload (Mirai)", "value": "34bd284268883c9986aff191ac87e51b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126704, "uuid": "d7fa2773-b20d-4956-bde9-eaf59d5c2971", "comment": "Malware payload (Mirai)", "value": "05beff2b13239247c7259e5d438be37b8f1acd377e2d966a3d305416fc600109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126704, "uuid": "73dde933-d0c4-4c10-84e9-a8a663e35276", "comment": "Malware payload (Mirai)", "value": "ea5ef3a64bdb562429fab0877d8ec779746e44f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126704, "uuid": "392c6803-1cca-41ba-8a4c-6799d0a6754b", "comment": "Malware payload (Mirai)", "value": "708c1364d936522234e7611877ffa3f6cd22f4ebfeea9142898d5a0762555041d68fa67fdf2aafc68a040a867f8c38aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126704, "uuid": "62310c41-b463-4b08-adfa-58232976d480", "value": "T16E4302510445FC74F9F12FF8C8344740690B9EB8EA3EB861441F5D6AAE822D777F86A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126704, "uuid": "d96a4737-e955-48c7-b21f-fbb7c37ab913", "value": "1536:rvSjITxfWMovH0oZpsaaaZa7H3K/MlP/s4fP:7SjmOMQ0oZp4aZaH6EB04n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126704, "uuid": "4c18d597-15eb-4c83-8304-196f8d3ddbd9", "value": 56560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126704, "uuid": "2f91711a-dded-4c77-92d2-e21cf922257f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126704, "uuid": "807afcb6-f7b4-4f86-a4ac-1976655d4650", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49869ae4-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786133107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133107, "uuid": "0817b64b-9428-4dc5-bdfb-7941d474128a", "comment": "Malware payload (RemcosRAT)", "value": "2d4fe10deb30092875ad0e5327904cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133107, "uuid": "a24d8eea-8d22-4957-b8e6-6b152c117c5e", "comment": "Malware payload (RemcosRAT)", "value": "07b1a32c53c1efab24f54151b1158bad7404374f0dfdee558e7ad80ad278575a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133107, "uuid": "edffdf11-73ba-491c-ae72-76c14d69bf99", "comment": "Malware payload (RemcosRAT)", "value": "bbdbbbaa2596aa7a8a85fa4d4090c4a0387d7d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133107, "uuid": "eea7136c-2c3d-4d4f-a046-e65cf1f0769c", "comment": "Malware payload (RemcosRAT)", "value": "1225d045f7cc75d19063a53d139d8b94ef251a784284500058caee89a3664b0a6cf068923865ee864d0563eeaae18151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133107, "uuid": "73eb7bd5-68b2-4317-ae63-ef305d53cc6f", "value": "T127D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133107, "uuid": "46078aac-4ada-4a95-9433-0688924ef2ba", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133107, "uuid": "edfa7000-58b9-4744-8d1d-504fff2e9334", "value": "12288:YZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:eQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133107, "uuid": "1e7b18e8-919c-411b-acc5-3292435aace5", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133107, "uuid": "3543820d-75f3-4a35-92af-566708e566ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133107, "uuid": "e544fa73-fd27-40d1-9b45-f32050ad7949", "value": "rcx1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c2c7b2-929f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786134794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134794, "uuid": "5f8f2605-d553-40f7-b8e0-f6c35a92d352", "comment": "Malware payload", "value": "7b9b86a4c08823ad5e23145ab0f8be11", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134794, "uuid": "3e8d0307-cc69-41c9-941a-71ccd043849a", "comment": "Malware payload", "value": "08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134794, "uuid": "253edf18-bb6e-43c9-bce0-08b5dce97a39", "comment": "Malware payload", "value": "18f5534aa9bd8c62272c5fa600e97f9b56ab8aca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134794, "uuid": "d612cfeb-5062-43dd-aae5-ba562064278f", "comment": "Malware payload", "value": "4c8fb362c1319e60712061b3b5fc68d2db188665fb390ba026d1b0b15542dfa5502e9a374010023ac7a3068d94ef4c3c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134794, "uuid": "4c5a7a1d-cdf4-4fe4-9dc5-ea61ee43a5a6", "value": "T1FE51748E14A0563DA4BFDD9C76F74600E84887E135B23B289EB41C639CC7A34B369E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134794, "uuid": "a85c6ae6-bee0-4faf-98c6-4a35c48837c0", "value": "48:7aDU1aT8GWAxqcF6EFGOe9GGGVUBSA65Xr8DYXO8GmIHbQjfZbMPf9JSXLcTYleN:7aDU1aAyxpF6EFGOe9GGGVUBSAyr84Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786134794, "uuid": "9cb8d407-ecdd-4224-b9b7-0bf93c87b305", "value": 2726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786134794, "uuid": "5d8474c7-7697-4a3c-a214-c42519d92152", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134794, "uuid": "725dd216-78e8-4cf2-948a-89088b814101", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67aa06b-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786096004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096004, "uuid": "e1a7b3d8-cd18-4c8c-a678-3b552912e083", "comment": "Malware payload (RemcosRAT)", "value": "db9ff235eae552276b12622ae9105f1c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096004, "uuid": "cbce8205-2ab7-4460-af1c-12d6785b0e54", "comment": "Malware payload (RemcosRAT)", "value": "08d96f4f4e6bd0e23f5374936d2afe823cb5f3d7e6a1b064308038becfdcf25d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096004, "uuid": "c2627fce-e2d4-41b1-83c9-c7e999cd066d", "comment": "Malware payload (RemcosRAT)", "value": "f0e45e139ddddfb654f645c935e8e84f7812ae2b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096004, "uuid": "0fb3bd0a-8075-4d52-a2bb-efeb571a5215", "comment": "Malware payload (RemcosRAT)", "value": "687314b5637878d49f32198e41bd95d2b71d0ad01373f9f3c2ca87ad6b6327f3e0922d2f4d83c94035fc5c0507313616", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096004, "uuid": "de5891c9-5cd4-41f3-9e62-8225a03ef0f4", "value": "T1C525F112EF415976C94243310BA772C1E21CEC7BAE2A4D0E2749733A6D776E4E973D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096004, "uuid": "a1357bb0-773a-4771-90a5-e0bc6e34ab82", "value": "24576:kfMMUKNioqK7t1QRT/64rmBVJjkaQt7ffZ+sfBkqS:0eKN2K7tmB6j7jkaYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096004, "uuid": "56350b4c-d1c7-4768-8d3d-46f3360ae2eb", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096004, "uuid": "ee839067-ed2f-4347-a8c5-b441af0563b4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096004, "uuid": "9fa92cce-edae-4356-bea5-e37b2d238ef1", "value": "PO0002938113_\uc544\ubd80\ub2e4\ube44_\uac00\uc2a4 \ud50c\ub79c\ud2b8_\uc8fc\ubb38\uc11c - Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f18c7d9-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135613, "uuid": "fe3d3472-b3d5-433d-b061-73a6133d7651", "comment": "Malware payload", "value": "0d754e8b6d7442121afc23e25e6d4e87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135613, "uuid": "48a1ca9c-e67c-4fb1-8ec3-69db9e739099", "comment": "Malware payload", "value": "09868f351219ae109efb1b40104f888990961a31d63ce88e11f0f976a4220b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135613, "uuid": "e06e6d6c-029b-4983-98c7-d8d19f3aed65", "comment": "Malware payload", "value": "9b00ccc0f9ef21b7ebab78ca96ce8ce260e6ea02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135613, "uuid": "d346999b-8660-413c-834b-4dec7c32b247", "comment": "Malware payload", "value": "a69c7ad3b79363cc268ed4637e514ddfaa836cfee9ef06943973af1f6e4f9e1f6582f015849925717294553c853dbf7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135613, "uuid": "5fe9095f-be29-4209-a870-2ea6069347a5", "value": "T1DA23E67727630D23C0D6517592E34336B6FAEB4628B88A577960AED81F485E032633FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135613, "uuid": "5dd2d0fb-a87f-4469-95c6-187c54068f6c", "value": "768:SxudEJ4tFhMPbQ4pqQ1O+C0lOF3atwl6BO3S:1sQ4pqIFe3atw4BOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135613, "uuid": "71e6f163-9f68-4e4c-b075-00bc692386ea", "value": 48616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135613, "uuid": "b6ef23e2-320a-45cf-9d86-f155bf73ab19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135613, "uuid": "e9154bcd-9928-4944-a4ae-1d53cef40a98", "value": "main.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e680f64-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097923, "uuid": "f47d39ad-46e7-4d18-9291-38378e2a94f8", "comment": "Malware payload (XWorm)", "value": "2040eb8c29ad3b929f3db450a3134ebc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097923, "uuid": "c641f906-8c3a-4f99-b0c7-74210cb79517", "comment": "Malware payload (XWorm)", "value": "0b7c5c8f57b22190bcf2b9948b2316d5bfcdb2e8c6b542489a8b29fecda6ac48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097923, "uuid": "c7790f1b-6ca6-47f7-ba84-ad344a44a5a5", "comment": "Malware payload (XWorm)", "value": "4ee92a7e47f6931cb323d4300ed647eb1ff83f11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097923, "uuid": "25e11de0-046a-4f89-95de-fd9bffe59900", "comment": "Malware payload (XWorm)", "value": "8111e77d60a19f6987a2b558527f1185617dbb99c17e12b4dbea39ae4da7db29d93fbdbcf17e198ec438360344bcbcdf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097923, "uuid": "f512fef7-9950-4ef9-884c-908e65e82b48", "value": "T137354F5202F3A292A13FE3D9DA81A368F72A813F64961D47743E46DC87D35C60E3BD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097923, "uuid": "8ebb7ba4-65b1-40c0-8cd9-cf9224e0a325", "value": "384:V+UWPoB4IpaBBRvIpN+U+WQRhaa4IpN+U+hN+Wf+UWGIp4Ip4IpN+oBatQBBBB4K:1cEIqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097923, "uuid": "f24571fb-ac3a-4f50-9c82-2ba13f1a6d15", "value": 1092098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097923, "uuid": "a054d181-86e9-4d2c-aafe-7d0bc0dcde9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097923, "uuid": "ce97de64-e7f7-4c46-a8ba-bd55397df0f6", "value": "documento...06082026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e18c309-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137920, "uuid": "207048d2-4145-45b9-a60a-7e163d3bc843", "comment": "Malware payload", "value": "4158820ddb64db53ad3c18f9e5616234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137920, "uuid": "d7294fe9-251a-4210-a4c1-3695f0318cfa", "comment": "Malware payload", "value": "0f70f67227bd3fe8f54711e10bb622384b3d4b5df5069ce24e160dddfd235ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137920, "uuid": "c76f2521-fd8b-43ca-8527-8109949bf5cf", "comment": "Malware payload", "value": "f4806a27af4af8cfdcbe573531d282cab7735078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137920, "uuid": "acf3bdf2-b5d2-4955-a897-5572e1595e70", "comment": "Malware payload", "value": "76a4f288333eea69490152b24eef0cee700c9c36982a1cc581b74b5b8deafc3983fc64c65a5b2a6a186ce3856e2e1c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137920, "uuid": "4228a151-0cb4-4be3-beeb-410b973fc02b", "value": "T12A537E6AF0DA9CF6DC5088F6E876A1340B013CB123D90C95B95DF2944B3F99A7D8DB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137920, "uuid": "391f20a4-8d4c-4248-8b04-434db093e0d2", "value": "768:vVbDl/r4xAYQDB5HZnWEbDGoUyIE/wIzmzicgc8QElQWalIteJ32CQjWt:ddUxeBWEbD1BIEpuictGaFlT2tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137920, "uuid": "0303921f-ad75-4e9e-8957-f321a995bc70", "value": 66336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137920, "uuid": "777529e7-98ec-49c1-8abe-ef1497c73364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137920, "uuid": "cd46e82a-b95d-43eb-89fc-e517cd50361b", "value": "main.sh4musl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227b6e71-92b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786145068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145068, "uuid": "224b0cae-92a1-4005-8a3c-3558e4317d59", "comment": "Malware payload (Prometei)", "value": "fde4bb9242202ad2ec42ab19a0fdd453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145068, "uuid": "39e1d5a4-4582-40c8-989c-5a71eb37e23a", "comment": "Malware payload (Prometei)", "value": "10505f035b1e6569cb22d42614829e85fd432e014418f457e2e1dfc31dcd505c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145068, "uuid": "69a5ced9-e584-4ea7-baed-43d6e8619985", "comment": "Malware payload (Prometei)", "value": "cd1378bb22fa98439afecc6cf3e657b3633ed37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145068, "uuid": "9a375757-95e3-4fa0-ac77-eb29b8bb2234", "comment": "Malware payload (Prometei)", "value": "bffdf21b0f8e361499c13f07787f06fde80c30c8ddf80c1aa5e3d46d8cae83760065d84307fd52ed2afb2105a5d3ed91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145068, "uuid": "eb1dfffe-fbaa-459d-b3e5-380ddcedb587", "value": "T17E34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145068, "uuid": "a4e53498-87a7-40c6-8dd3-5f10730d320e", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145068, "uuid": "1a447a31-4b99-4c90-a3d6-bc8db43b2d04", "value": "6144:2GxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOK:2G60BpL8jk1FGjDc8GVdOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786145068, "uuid": "8eb52d15-1941-47bf-8b05-ec84880e1bc4", "value": 245865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786145068, "uuid": "1f765d53-dfcb-4369-b2ed-467f7a3cabba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145068, "uuid": "c0ddf1b9-249c-4a5c-b16f-1dfde724a6ed", "value": "10505f035b1e6569cb22d42614829e85fd432e014418f457e2e1dfc31dcd505c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f0fede-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786097834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097834, "uuid": "72b9ebc2-0a9f-4bbd-8804-d5677bc91524", "comment": "Malware payload (VIPKeylogger)", "value": "a79fd8574b737da5aeee919f7fa327e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097834, "uuid": "7550562d-5996-4ca3-ab77-2f1a0758f56f", "comment": "Malware payload (VIPKeylogger)", "value": "1060e2c174b39c21614f8d8ad5ef0828905cb6102a7d5f6d6a1b2de44a32cf9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097834, "uuid": "920f1d00-515b-4491-bf90-852f7dfeda2a", "comment": "Malware payload (VIPKeylogger)", "value": "44e91d262aff3a01c20c4a66c5cebe0e9622e555", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097834, "uuid": "c93d7694-aa4e-4e96-bbd9-40f44b5ae602", "comment": "Malware payload (VIPKeylogger)", "value": "114ad9b3b7e98bd75d9450e05a40f277fbe09a8b06d59c7c53b1a030767cf05f959db7b0cb5cd6e3417a4e8f126cc4e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097834, "uuid": "52ccb2eb-5247-4214-b449-4def83def74e", "value": "T136059E0B8633224908029D7A5B179DE774F0F8FE5818DB946D4FAD32701AED9AAF74D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097834, "uuid": "6a96e6ae-7eb4-469b-8eed-c96f792fc70d", "value": "24576:lY+HHVPlHK6XbXfEi9x5xzRCn/B5CiEbAJ1zH9:l/Lb15lEXwEXH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097834, "uuid": "fdf36f41-b72b-40ca-b69b-381e778c0605", "value": 801164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097834, "uuid": "470c98c8-fd56-4a9f-a1d7-7467894256f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097834, "uuid": "c4bd9100-5471-420d-8f84-75db4c538b82", "value": "Tanda Terima Pengiriman_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270e3a1c-9295-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130472, "uuid": "172de1cf-0a79-4e9e-bcb7-68a7d8f9dd35", "comment": "Malware payload", "value": "5631e78db86803a95eac33e11d7b95c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130472, "uuid": "e543390d-1f2f-4633-8e23-4d12cf7a635f", "comment": "Malware payload", "value": "10c18454c12d4e9f87ce62b8a5762dcd8c2ba5080b9eecb9739521ea93bfa42e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130472, "uuid": "3a8875e8-488e-4e29-b5b6-a7d1cdcccbab", "comment": "Malware payload", "value": "1be918ae061e5e133aa8a22b7a1276c632c5ff17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130472, "uuid": "00c208a9-b760-4a31-9d34-70404c57427f", "comment": "Malware payload", "value": "17bec36aa38461b8cec6d7c811cf250f201096cbf3c4bf1116acd715a0d9b987bea7729d70ed2508bbcae80859d7a75c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130472, "uuid": "a1d51817-123b-45ec-b656-9b9782da8318", "value": "T146536F31F94267F1CC720A38979B2E496E3709655EEB16615E1B233EED76810CA30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130472, "uuid": "54955bc2-4585-4fbc-9e6e-8c1b11eb3073", "value": "1536:WBs1gmV6GGx9uuODuuuuuuuuu3GIoXuEnsbz13PHXLANj8pxVA:RSmVs4+oXnK/xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130472, "uuid": "07e2ade9-39fc-4598-922d-ad6c88259882", "value": 62120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130472, "uuid": "7995f8d6-87cf-4a8f-b3b3-b5c1f13cf3cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130472, "uuid": "b958fcfb-fd6c-4111-bd7b-f88cbb2af959", "value": "main.microblazebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c3d9ad-922f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786086821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086821, "uuid": "7829fa5a-d354-4ba2-8024-1064ef60fa54", "comment": "Malware payload (Mirai)", "value": "d24c669c36a5ca8bbcdd3cbcd30c094b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086821, "uuid": "7b4e16f2-4e05-4f5a-b3c7-49d880b16df3", "comment": "Malware payload (Mirai)", "value": "11b3f4067a423158786021eee5ba5baf69a97d9cde5974c401733a64113a897d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086821, "uuid": "447b4b99-4fa4-4bfa-9226-6978b788c5bb", "comment": "Malware payload (Mirai)", "value": "ce74b140b20e5edc6f0ef5846c57088c38c5f918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086821, "uuid": "e0ba1167-8340-4599-a643-330e19bb5e9a", "comment": "Malware payload (Mirai)", "value": "2f60757db1e4c6ff8dae9a2e379012cc3bcdd7101fa0fdc7944f547dc5be2bab8be058618959d9baad72fa7b5f018c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086821, "uuid": "92b52033-f5dd-4ead-8738-a10d506d9f01", "value": "T1D86302A7902F37B1CE2358B73B6D1B80DE78D014F01342CF4BA668E96CCB5C6AA55B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086821, "uuid": "fdea604e-5603-41f9-904c-4aea22adb35f", "value": "1536:7B4ZMfYcSNC5+qHWhO/SeF9odfRBRXnuMHPgcAyBHNOfbm4+H:CZ0YcS05rWM/SqeNXnn47yBHsm4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086821, "uuid": "7cea41ef-1e92-4337-a69c-66ba2d6f7005", "value": 71052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086821, "uuid": "07f94127-773e-434e-ab7e-0881dee27847", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086821, "uuid": "454452d2-ba5d-43d1-809e-3874c526a0e2", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4bfaff-928c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786126725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126725, "uuid": "3d50d186-f3de-4781-bed8-a5eb591a680a", "comment": "Malware payload (Mirai)", "value": "f8d9f01dfec3d36d70d09aad1faeebab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126725, "uuid": "6d113f37-fb29-4542-b7a0-e07ee35320ac", "comment": "Malware payload (Mirai)", "value": "1256605a138e967807b1cd6f0c051e35347ea17388fbc52e778ea30d789837db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126725, "uuid": "c7394e10-b796-4ec6-a1a6-8fdacbd42585", "comment": "Malware payload (Mirai)", "value": "9cd4314803354adff0064824181f81373d565c72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126725, "uuid": "86d698ac-2aea-4932-8b13-ae519399468b", "comment": "Malware payload (Mirai)", "value": "6d4fd5091a01903f184032e61ef08862e2ff217a44ab587ca39158446d10350f68fbe540f6b93f109450e5dad315b36f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126725, "uuid": "c1860ca9-5031-477f-8610-329198961a47", "value": "T127C329A9F890DE52C6C52676FB4E418C33231778D3DA7105CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126725, "uuid": "7106182e-8a70-4191-822e-7636efc5fad2", "value": "3072:Is3MwjVxhyC400VIUccYEEUQPOMWG6NwhQBmBkPLfHNwFCmlupf1Dl:I7K4VlccYEEUQPOMWGswwkkPLmV0p95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126725, "uuid": "1cc1fce9-a72e-40f0-95b7-f7d9e7678c3f", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126725, "uuid": "7e424ded-21e6-4391-a4ad-fbee2631e1ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126725, "uuid": "8678047b-6094-4ceb-a00c-74cb5179a6a0", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d212ef-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129930, "uuid": "8ab8c5d2-c1af-460e-a830-fb9dc2e61af0", "comment": "Malware payload", "value": "0c447bebcac72ca9a10b1e4fd9c5e5c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129930, "uuid": "3237c5d7-ca65-4c0d-ab64-1e87799b2caa", "comment": "Malware payload", "value": "146f815e0844f15f39ed6aebb1b3772c43abc52ff0e42e47bc9aded088cc9a80", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129930, "uuid": "c76d97cd-9547-4402-ac87-1373ea79da99", "comment": "Malware payload", "value": "3defd352aa1b89af9f6f22a337db9df1e6d01c73", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129930, "uuid": "7c75f138-e5cd-42d7-a708-ec687571a362", "comment": "Malware payload", "value": "124c26540a9e9bda7f3af88ed46331f4221f55c7e703a855b63bb4b052effb6d116df6370e33ae31a3988cab4086fe60", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129930, "uuid": "074b4bfd-56e0-4492-a3ab-1bdc120b22db", "value": "T17D235C5126857C14AA98C9371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129930, "uuid": "f372c108-9736-4cd8-ae1f-b20db075dd4f", "value": "768:ScFWzZx5i9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:RkzRcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129930, "uuid": "f01adce4-d597-4850-9aa8-bcd3af60445a", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129930, "uuid": "80e4e1af-1365-4127-a25f-f95d75cc029d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129930, "uuid": "1eaf19a9-56ab-4968-9bea-232dee254fde", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520803f0-9278-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786118089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118089, "uuid": "7987510d-eec5-4b7c-b6a5-f97e83e453f0", "comment": "Malware payload (ValleyRAT)", "value": "ce86bec69c0991c8cd99787e5f8a2c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118089, "uuid": "e487f3cd-0a84-41cd-acd3-8ac39214563e", "comment": "Malware payload (ValleyRAT)", "value": "14cfc813ef030e8b3f0e85fe8c140e1b746b52c76fff8352d0d92eb46f725470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118089, "uuid": "574d1558-5e49-48c0-92fa-5e9fdb083a32", "comment": "Malware payload (ValleyRAT)", "value": "41fdddf38a9b635306213d33d15ae2f6c6bde502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118089, "uuid": "7d996d26-f2ae-48e2-8753-fa2f5f4b7ae1", "comment": "Malware payload (ValleyRAT)", "value": "6b26dd1ea150ab629d69d0252fef85edde1db3a294d2274ca30f25ce4c8a759f1032c0b6afa04543bd8142b78f429aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118089, "uuid": "c3b64fa1-e60e-494c-910b-2c738b225ff5", "value": "T1AC5601BB7294D12BE22EC23AC5A29F54A53B78710333C5E7D5A432699A275C08F7F350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118089, "uuid": "bde083ca-b05e-4aac-a663-0857d3d45e77", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118089, "uuid": "96ca103d-b8f1-46bd-88d2-bad05931e948", "value": "98304:1lrNmuZwr9ehRQn2dgTQXJJZvtHbepO47i+quS4+FMuLoPmFnheo4n4T:1fmuurGjdg8DZvtHbepO47rs70Qnc4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118089, "uuid": "6d2d8f86-1dc4-40fc-9ca1-87a168526f95", "value": 5984577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118089, "uuid": "1f4ca595-6c03-4676-b743-17bf0db94eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118089, "uuid": "b81c6f8c-f179-4551-831b-c33c4eb3feec", "value": "1.chation_mscate..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f08ea-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130893, "uuid": "c52a9d61-83b1-4418-8805-43c5be259838", "comment": "Malware payload", "value": "0289cb4278dca26b6f88d15497ad2589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130893, "uuid": "9779e3c8-462e-4d46-82de-4a255bddf2b5", "comment": "Malware payload", "value": "15114c043849ca354b2aded20b59c0360ee0a1743eb64516041d8f6408b3eedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130893, "uuid": "cab668cd-04a5-4a1c-9f0c-f1539bae71fd", "comment": "Malware payload", "value": "7c4ad4148784de71875cf9236ca56ae9e080ca6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130893, "uuid": "5a2cc8e0-89ff-427f-8b66-e7f510ac1c53", "comment": "Malware payload", "value": "47ce955730764235efb33356b7452926401220f7cf3692408601e07f347785152afbf0903e9d5a588d10ce26dc0f6e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130893, "uuid": "acef8e68-5879-4056-a0a4-715e89f556ae", "value": "T1F6531A23FB0C0456D8D36EBC0E3B0BE68315AD5220FE9505750D6E9E1B36F315687BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130893, "uuid": "e37811e6-d3cd-4060-b70f-7b9824df687b", "value": "1536:o7kZyaGqiqufV3/7BNH0y58TReNgShHq7/7A3jT184DMTW:o7kZyaGtdv1NUHeNfH2/7A988Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130893, "uuid": "fdfb61c8-2048-47d4-a7f9-b53bebc7e253", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130893, "uuid": "7b0c1278-b769-4fb5-9887-3d54d5bfe54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130893, "uuid": "f494eb1e-6950-415c-bf22-06fc767fd5f9", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae7e767-9207-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786069571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069571, "uuid": "22799869-17bb-47b1-acc9-52a188fcd174", "comment": "Malware payload (Mirai)", "value": "70a541fe0683dee9e80979a2879fe366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069571, "uuid": "75ed9f4c-9788-4865-820a-74cb5d6ef71e", "comment": "Malware payload (Mirai)", "value": "17a7ad87346b0119caa7f638b3bea08aa14459b25e5150a8c9a0ef70bef719bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069571, "uuid": "ec8d8232-2eb4-4cc9-8f16-0ebc7342bc7c", "comment": "Malware payload (Mirai)", "value": "b883ee19ddc1d3303951224562b1c381716050b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069571, "uuid": "b5512291-78f8-44ba-91f5-f83c7feb86e3", "comment": "Malware payload (Mirai)", "value": "5bdd218ccd9b66a07ba8ca8a1ea75547c4d1a847650bcf661ceff3696ea39e9a78767d1a62010109ea9a64ee88fa1395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069571, "uuid": "bf48803c-bf18-4b64-9c81-a4d9987b6137", "value": "T174334C22C9BD9D86CAE0797E03E703E3C1CB4B1443A4DA1EEDD01EA9DF467505C66B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069571, "uuid": "10a88bdf-f0d1-442e-b43e-26deb60b882e", "value": "1536:4sr9n4n/W03r9n4nB9D20ei+I4RBZWBg3zLThiixiwf3N:4sr94/R3r94T9ei+I4R5Mw3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786069571, "uuid": "a9ccd236-e165-4668-8a87-e3827f7712ec", "value": 52536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786069571, "uuid": "688c10cb-50ef-4033-8f1d-ce98fa8e297a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069571, "uuid": "4a0deef4-6b44-422d-9c9d-03c7a64556ea", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0228de-929f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135126, "uuid": "3f4775a5-d31e-4f4e-9426-bb6d6133e6a6", "comment": "Malware payload", "value": "16c66bd6d43b9f74158f77d9744a2760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135126, "uuid": "54a92dd6-fb19-4d1d-b3c2-4c319fbf110a", "comment": "Malware payload", "value": "17d3d77a919c0f84bdbbb8c4796d0ef2169fc11511adf33a1e179b9a816769ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135126, "uuid": "018718f3-1ecf-4b58-a0e7-006525365260", "comment": "Malware payload", "value": "2c581ef08b6f160c7af7f9e55a6137e20cadb192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135126, "uuid": "422a4830-4f4d-4f80-bd89-dfa1659ffd46", "comment": "Malware payload", "value": "23a7fd44e98f2fb9def302ffd0594982f300b142e2a45be208916b9e3767c98a654715602eba4482c28c108b570f1e37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135126, "uuid": "385d8fa2-8946-4e73-af21-ecd9d946e0b7", "value": "T14333D645EA41AB05D5E232FAFB8E414D3317AFA8E3F9312199306F9013C6ADB0B76525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135126, "uuid": "dc64be79-71f8-4174-a8ce-96ba0a348ebb", "value": "1536:dNnv9qKqvYiSrdwotXAGfflUyGAig4zurEy:v9qhSrdwotXoq4zMEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135126, "uuid": "995b8a6a-62d2-446c-92ab-f24db5df04c7", "value": 53868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135126, "uuid": "e539382d-698b-4f7f-88c9-cc4bfc7efd4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135126, "uuid": "89520da2-3c68-4955-b1ce-1d4344132c6c", "value": "main.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f521d598-9219-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786077560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077560, "uuid": "61dd7b67-3b34-4c76-9e89-0bcf60cc88cf", "comment": "Malware payload (Mirai)", "value": "fd92c6d7e089cadb4159f6055ded0986", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077560, "uuid": "6ff4938c-8c0c-4d54-9a7c-05c4dcbd85d0", "comment": "Malware payload (Mirai)", "value": "17ef78b562169b88449396a87d732cae1f23d4fa98255c499a951e688642534e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077560, "uuid": "6c87b55c-99b9-4b02-83cb-8bf4ad0775bd", "comment": "Malware payload (Mirai)", "value": "fa7a3f0964ed4833bdcb7b9d8a31aead1f7a5876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077560, "uuid": "f236dafe-b1c1-4f2e-a066-96a162f8ae94", "comment": "Malware payload (Mirai)", "value": "3b3d12de8ebe9d9f1242344138cf3504a5c40658345104af36d37b7a62c702d77bb18d259334f6d59e82e47a73f601bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077560, "uuid": "b138dd44-6220-4bc3-a891-94f1f092fedd", "value": "T1B343F29517E41E56DAF339BD9EB9C2402FD7B3E9F17B7100890989637C42222339AAC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077560, "uuid": "65a03795-3403-4f63-b88f-6d5e60222e9e", "value": "768:BHAJStmAJgKqun9fggdcllI76uPaGanG9WkOQsOxwheCntKqAY3U03wfJw:RAJStmAJgKT9cjNG9WkOVhRwqA1fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786077560, "uuid": "d82c1b5b-d8d0-42ca-a7ae-be67b0564c32", "value": 56348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786077560, "uuid": "b01994cd-b9ca-4106-a804-b5b57f97cd5c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077560, "uuid": "1812f47c-82b0-4a45-8942-47337fb4c797", "value": "17ef78b562169b88449396a87d732cae1f23d4fa98255c499a951e688642534e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2b84fd-9201-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066947, "uuid": "86281552-942f-4a06-938e-90d12753f511", "comment": "Malware payload (Mirai)", "value": "867fbf5656b93ed7da17a6a224b887e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066947, "uuid": "e54dd4ae-467a-481e-9876-a3b38fceb9ec", "comment": "Malware payload (Mirai)", "value": "192ab4c313bdd769956ada60e82dbcb7d2f6c41efb520e213a647dcdf1077ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066947, "uuid": "40e7de14-c39e-4af3-a583-9e63cfd0fdc0", "comment": "Malware payload (Mirai)", "value": "bca9c05c79ba5cc824c1ff90661c73f19e9ca1e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066947, "uuid": "30999bc5-19fd-4da1-8665-c3d6d4d9ae9c", "comment": "Malware payload (Mirai)", "value": "c04a8239187df6cb93187b16a13abe3be7b7c3afbcdffc94bcd0fc00e4f0a2f1564924c21479831e72e1c0a3868ac053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066947, "uuid": "ef0edb85-0d92-45d0-af7c-6c0a4a63a98a", "value": "T1CC145BA5BA0F6C42F1C6D3F8DE8C83F17E1735E3C67689B1781213ACCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066947, "uuid": "0f404f6a-8dc6-4f0c-a84a-997a08f87a3c", "value": "6144:ti0Se0J/AAtLJbfO5EZn4o71E6awYnoq:tELhf+E5Yno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066947, "uuid": "df6eccc0-bfe4-4ca2-b213-9a52c9db701a", "value": 202736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066947, "uuid": "6162e8c0-57cb-4279-a0f0-3d2bcf0c1f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066947, "uuid": "26f8c152-262f-4593-9c33-9caec858d144", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64222c3c-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097933, "uuid": "00214534-4e85-42b1-a977-c02b0c3699dd", "comment": "Malware payload", "value": "3c4e841ff6c8d065874db1971f81db98", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097933, "uuid": "89d1f9f0-cdc2-40fa-9b39-eb3cdf007720", "comment": "Malware payload", "value": "19ed9a9a724758fb9cd41e3a0ae8ecf424ae62bbeae61272d6a9a9d31de350ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097933, "uuid": "f955c801-e528-4bec-95fc-e31641ea6f13", "comment": "Malware payload", "value": "b31f8eff831ae47a3c748c5f92ec33fbdcee4811", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097933, "uuid": "2ceb3291-f3f1-432f-ba88-c08979fe62c2", "comment": "Malware payload", "value": "e3ca7c4e20f26701ddf8855a8de822c52eb7ac16f4f7eedc4192116e162992cb3a8dbd04ca6db3fa9ee30b972cdfcc41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097933, "uuid": "c62be3c3-b60a-4757-b301-5ffe1df66009", "value": "T13243EBB9670D22A10F817C94D97E4EC1E0E23E88624F47EB775CEEA1914E784D211EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097933, "uuid": "669a0b5a-32df-41bb-9d59-b813af8fec01", "value": "384:MUe/oAohUyU1UtoWU1U2kUT3UrUezUeBoQUtkUvUezU16UPKkUt14kUgd3UCkUDH:q0n01Ldy92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097933, "uuid": "7b72de68-1079-423c-bb3b-9d9a8cb7abfe", "value": 60248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097933, "uuid": "d8bc6220-0459-438f-9ef8-d5a9075b82ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097933, "uuid": "24fef16f-fc58-44be-be8b-b131a5c524ba", "value": "booking.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad9402c-922b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786085194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085194, "uuid": "a2957537-dbdd-49eb-8e49-be022e4c848e", "comment": "Malware payload (ConnectWise)", "value": "5f63a87ae3e1594cb3bfac8e3c5729e8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085194, "uuid": "a5cb629b-ed9d-4932-aaab-4ae4e8eb861a", "comment": "Malware payload (ConnectWise)", "value": "1a191d57ec8e1268d084676a4ebfeaa19ff97e63ffae740dca6d0b041faf8740", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085194, "uuid": "23387348-9514-4188-acef-db459290628e", "comment": "Malware payload (ConnectWise)", "value": "e802460d89a7e607e70c051e24fd29b3a4b237d0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085194, "uuid": "cad9da1c-17dc-472f-bc10-c953cf55ab7a", "comment": "Malware payload (ConnectWise)", "value": "8c9ea78a6e6d15fa6713db9c29112af10c5d8e7f5b324de16d15bf519f7075dbd1fd66d1cbce20a23208a956ded2ea9f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085194, "uuid": "bb40947a-e92b-44e4-ba44-a0b610de9866", "value": "T1B546E101B3E695B6D1BF1638D87A56656734BC049312CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085194, "uuid": "f655208a-581d-44f1-be6b-315baa103f2b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085194, "uuid": "0dfa12dd-818a-4811-a167-09bfaacd08a8", "value": "98304:jzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:jhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786085194, "uuid": "fbdf8084-dda1-43c7-8818-c8477b752303", "value": 5734192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786085194, "uuid": "98a8c429-be41-4463-a024-3a0d28b0745f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085194, "uuid": "94a2dc85-3e65-4206-9cc5-1605ef90ad6f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded0fa53-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066786, "uuid": "9be0babc-3a71-408a-96bb-f41475ef65f9", "comment": "Malware payload (Mirai)", "value": "e81757b8c89cdc3233c0c8d9a73f0ce6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066786, "uuid": "f1a0e996-fe17-4681-a4ed-e918547338e1", "comment": "Malware payload (Mirai)", "value": "1ae01ac29110a83c78af2f046599bffd4212b5653d949074374a4f27a6d6aaef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066786, "uuid": "55e80265-be84-4ca1-9ce7-478bb6f51ba2", "comment": "Malware payload (Mirai)", "value": "e6f85a57c68aaffff0d6ffaeb43d46f41937e14f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066786, "uuid": "bbfb485a-1352-4f69-8c6c-4e74916e6011", "comment": "Malware payload (Mirai)", "value": "26c7c31d5f073f1e9d72d7541b547f3c28004a9a2b5cecb995c142db3c7d9399bc2d55f8ce6084d1269b648d649086cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066786, "uuid": "cb865b9d-720b-40dc-82eb-163375e62984", "value": "T13AE35B1775C1C0FDC8D9C2B84BAAE226DD72B4695138B25F37C4AE261E5DE206F6C710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066786, "uuid": "78169497-de48-49fc-be11-84598a4e1a1d", "value": "3072:y/SK3B33rTQ5YVs4P1jgEFbVcQ4h1V3Ki1qtJvV9b8:Z60DJHUb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066786, "uuid": "3f6acde8-1058-438d-98a7-db858eddd0a6", "value": 149992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066786, "uuid": "1c2c2590-c0b6-4e83-9cfb-22c9ed79bd61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066786, "uuid": "16b038c4-e2ac-471b-bc77-6c8716ab433a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d94474d-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133597, "uuid": "2b2f4d09-a64f-4f15-ba58-cf834ef4e4ed", "comment": "Malware payload", "value": "296ef28ce9fa00f6664939354da4d75e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133597, "uuid": "f12b4b92-bac3-499c-98ba-32e034fa9844", "comment": "Malware payload", "value": "1af80d8f770ff150a11955a217608d63a7078b5d9852a0929747109ad2cbfbb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133597, "uuid": "d6bf45d6-27c1-408e-b12f-bcbf53fcd55b", "comment": "Malware payload", "value": "4c4cda10c7eeb924adbb2b73f95e1c6d61ba1866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133597, "uuid": "4cb6199a-3c4d-463c-a35b-3614f6e30932", "comment": "Malware payload", "value": "984e1c0af3cb1f46385eacc3823a1e49d5637efc8c8ffed89416000a7ff5ac350d4c938ba0b5348ea0614075c0d1fe4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133597, "uuid": "df0ee1c0-bd2d-46f3-993a-53662f76e2b6", "value": "T1D4030A42EA519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133597, "uuid": "299d5339-473c-4f9a-ad1d-911d2a4b5697", "value": "768:yGntfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdz/2:yGntfD+gTFvhM74jMQ0MCiNB2YwDX/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133597, "uuid": "e9467fb6-f6dc-4b8c-8277-da172edaeda2", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133597, "uuid": "df431561-09ea-4d74-8501-ed5dba0a95e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133597, "uuid": "24870d7f-8e47-40a3-a1ce-ec19d0eb238f", "value": "main.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77c480d-9295-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130741, "uuid": "7b7e8e84-301d-4299-8d2c-5bc05b21bc7a", "comment": "Malware payload", "value": "f549af4faafff8f9f4b3896f1fd59db6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130741, "uuid": "0175bd6b-a1b0-46a2-860d-292a9015c95b", "comment": "Malware payload", "value": "1afef2d905da741371e6a23336d217ce35d0e4d06859007ed1c3b3ba0f0c6f4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130741, "uuid": "cb04bf95-38df-4fda-8c30-8c00c11861f2", "comment": "Malware payload", "value": "7664626fb9516fcb6d0fc614c1ac0e54e708651e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130741, "uuid": "06f2a047-afea-4464-ae23-955c68225dad", "comment": "Malware payload", "value": "00549c816c19d5218fd0db4fe00d0a0ef1e264bdc0880b0a3f8e09b7b2ee6795141122834e407cf12208331628c9655c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130741, "uuid": "cecb75cd-0f18-4914-836e-b67f3e3c98bd", "value": "T1E101CEDFD66099005419D92D62ABA690B861C3CB055B4FB87F9CA53DAF8CE14F027F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130741, "uuid": "af6b1b24-8b78-4b16-af2e-f40a2880301e", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaPCHlKZRCS6s1FCLQTW8C+3+aSC7q2eNaa:kXCKysE2hi0ziQvZohaPKlC1eym1d2k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130741, "uuid": "111a8174-1524-4415-88ad-0d0ab56623b1", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130741, "uuid": "a3fa45cd-5db2-4c32-89f2-cc06ed2985e8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130741, "uuid": "b323dc17-5bef-4bbe-be8c-a9548f7ba678", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d693f7-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126258, "uuid": "410fb217-50df-472d-8594-625eecf814ac", "comment": "Malware payload (SilentNet)", "value": "3642876d8602aa28deca107719fda6a7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126258, "uuid": "1a8c32e4-8330-4a2f-966f-582ce0fe8afe", "comment": "Malware payload (SilentNet)", "value": "1b30a8bad3f15b4770d748c20f0146e15b86a05572136aab459b01c3754b55b8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126258, "uuid": "7900cf1b-3f8e-4683-884e-298d7662be41", "comment": "Malware payload (SilentNet)", "value": "742fec4331c118eacb0c74b34e54cc55e169a73d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126258, "uuid": "c847a9e1-15b4-42b2-a888-e94fbf80713a", "comment": "Malware payload (SilentNet)", "value": "16cf09fbcf674a7a9169b34bac1a85a005a37dbbe8b5c23d89354dc5e68b0b53da8297a0ad5494415a646813043d1615", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126258, "uuid": "9275af60-6fb1-4184-8da4-250b14f8ba33", "value": "T1226412190208712CC527F1BB4423CAD3FE6A1EA2869176FC19B95682F057C97BB45EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126258, "uuid": "5f7068a0-f00a-4069-ac05-4bfc4415db7d", "value": "6144:hVcnmX9G3t61DjRCPrKfyTKdTqwQhlhhWs2xii5jhwtjAYqV2:h6nGqt+lKuqwQHi7xhwtjA58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126258, "uuid": "9678f774-866c-4d57-9337-f7a454ac0a5f", "value": 331620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126258, "uuid": "d1b866b0-06d9-42bf-aed2-b0bd92ab9ed1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126258, "uuid": "5ffd791c-7492-4a5c-976a-45779ca6abc1", "value": "5kkbhp1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37081efe-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786110742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110742, "uuid": "7009a1a6-dfae-407b-9195-c858989eb7da", "comment": "Malware payload (Mirai)", "value": "c227bcd3fb109592c52c501a97632311", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110742, "uuid": "6912c132-1841-4771-8c6c-cb7540a902b9", "comment": "Malware payload (Mirai)", "value": "1c4d4d85b7f4d784cc35509a65262f3d6a0467b3edd5f9528b3eb56ed9057b88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110742, "uuid": "c13dd0a0-c4da-424f-a9b5-1407022119de", "comment": "Malware payload (Mirai)", "value": "4a4982510e3f5fc0bfaac9c3e3d6e018241e3905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110742, "uuid": "b6b46a78-dd20-4f0d-a29c-00455989248f", "comment": "Malware payload (Mirai)", "value": "4e344e4cb0e4aaba8b012cf998c5cafde2cf0d46f1b43548edbca46dc41ba54d5d0371eebc2d997d81e07fb292aabb0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110742, "uuid": "4f66ee4c-34fa-4d3f-b741-937349b8ba9c", "value": "T1B0058DC6F6C3D0F1E86305F0105FAFEB0A34A1379057DAF6E6841A66B860B925B5732D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110742, "uuid": "345a451f-8c87-45d8-ae74-0a0b28ba4ee2", "value": "24576:aUAOgKSrk6lcOrOkA9Oh10hR4hGeB+iUJE6znFcGP0F8BKuC:al1KSA6frbA9Oh10hR4hVyEAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110742, "uuid": "79a06e5c-37e7-43c7-8bc9-a5ed699df7cd", "value": 796676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110742, "uuid": "e42c9753-112d-4e84-b96c-d0290d460d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110742, "uuid": "d80f885a-42de-4e62-83b5-b74e3d925214", "value": "xd.i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f09721-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099522, "uuid": "2d13a41e-6990-4adc-ae4e-ef21a752cc11", "comment": "Malware payload", "value": "a847e742daa670f4292feea1766d48e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099522, "uuid": "c78c04ab-5e0e-4e2e-8cbb-f3ac82593b7f", "comment": "Malware payload", "value": "1c59ea2d2816120feb4350e95d1f671f46c31929047ea2177a4df2ef6ef4372e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099522, "uuid": "94c84e99-ac2b-4fc5-80a8-34b64e3ed978", "comment": "Malware payload", "value": "1b656af57d1fb16d3b3b0306aff76b64884adc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099522, "uuid": "5ee67677-407a-49b2-af0c-44d857986d83", "comment": "Malware payload", "value": "82a553f81e0ebc880c7b9cabe9fa6ed4dfbd946cd0717c7d70983dbcd430364bd3855d1dafdc76f47852ebee1d817fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099522, "uuid": "12fdfbcd-1d52-4851-a815-50c3d1b3a16d", "value": "T15023F798F944D635CAE071BAF61E02DD33030FBCD2E631159E216A347BB79194E3BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099522, "uuid": "cd7e12a3-d7c5-428e-890d-b104812c6296", "value": "768:tFpy7bys3IJdXlxnCpA2J5Pjffwz3Pc8O5Q2Kv2a7vmUEbLQ32nRrMP3Sg9Qktlt:tFpy7bys4JdXlxnCpA2J9Df43tOm2Kv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099522, "uuid": "91167e5e-d5a7-41d8-ae8d-d8f39a352d2c", "value": 45964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099522, "uuid": "e0e78f98-17b2-49aa-a889-cce883cdd2d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099522, "uuid": "8950a5f9-9bbf-4566-9e70-debdefb5f5ee", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487406.1386.1313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3287e48d-9268-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786111164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111164, "uuid": "294f6bc9-25b7-4908-9014-10aa68e8296d", "comment": "Malware payload (Mirai)", "value": "9c4f8fe8367f87e22600b2cc8b980bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111164, "uuid": "8baab31d-9bc2-4b34-a9d9-1ac85307116b", "comment": "Malware payload (Mirai)", "value": "1cad417279c955d47c97202a38ec1c9a4a1cf5a8c458e8cf09806fd70d81bdda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111164, "uuid": "5c5a1658-e558-4299-9933-131a61ae1900", "comment": "Malware payload (Mirai)", "value": "aa8981b9af38506ae25fde0d68589bed31aa6a2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111164, "uuid": "a2f54bf1-3034-458a-a067-24eac1846051", "comment": "Malware payload (Mirai)", "value": "6eee6caaeaf0ba7245179b9e14a6a3fb501ad4c7c759456064859292b18711edc330c39228b44063cb91c6a261f7845b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111164, "uuid": "2aafd62d-0c2e-4159-aaef-185b3acbec04", "value": "T1376312B6885A3EE2CBB7C0F2585607512C1087EAD26F71BF2914D0C74467FD7A43AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111164, "uuid": "99b236dd-9c7c-48ce-8699-eb5ed7a47617", "value": "1536:IIFfmCje9/5OEkhTnJ6tq6+Krm+5aD59ZOoNSRKyHiqpV1cit:uCjDitR+K6maXwWS0iV1Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111164, "uuid": "4bedd002-ba85-4a93-98fb-bac5d44be8d3", "value": 72736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111164, "uuid": "83c2d6ba-232c-47bc-95ef-40dd03edc917", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111164, "uuid": "1f27c2e8-f7f2-4d6a-a357-b459e258df3f", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e514f9b8-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786111034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111034, "uuid": "685d50c7-6931-47e6-b979-2a958bb753a3", "comment": "Malware payload", "value": "fb3d8ef44c3f16465758b4d7678f917b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111034, "uuid": "0a71dd6e-b1b9-43d5-801f-3b996809f138", "comment": "Malware payload", "value": "1d48115a18f6c2f3ebc90aa9b29fb1f37eee824682f00aa43361d910e096c230", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111034, "uuid": "1b517ca1-5e1c-4e0f-adf1-ee243ed5988d", "comment": "Malware payload", "value": "0e69abec0006566cf31ac0d24064ef5a2ee184c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111034, "uuid": "f5d3999f-cb88-46ed-b329-82e4c54cb821", "comment": "Malware payload", "value": "51315652c1fdc75842d0d029ac5f9cd122ce1aa09e77be6d86c01473ed9a276f398bda8fab0f7d618329c72b0ce85891", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111034, "uuid": "dee66092-e9e2-4147-90b5-29daa4817883", "value": "T174236D661A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111034, "uuid": "c469c32e-5d56-459e-ac2b-6c9941623a79", "value": "768:qXRWNGxVT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Wlxacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111034, "uuid": "953420b6-6de0-4a8e-b776-dfccff6f8e84", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111034, "uuid": "9dfb6ab5-439a-48cb-94b7-909c1deb28b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111034, "uuid": "ae872058-ce58-4721-9805-f92bc229a993", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8b858e-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097863, "uuid": "90f556ea-f5da-476d-ac6e-07052e57e3c9", "comment": "Malware payload (Formbook)", "value": "16862c97784725db3b01ae44bffd315a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097863, "uuid": "708eb0f7-2382-4da1-b599-d186657846ba", "comment": "Malware payload (Formbook)", "value": "1d5322c50ac0e03e33c503a438fb9a8314f717c4a5456bee6b7c4459e1c79670", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097863, "uuid": "139b866e-8ed9-40d6-a424-b34b7f296273", "comment": "Malware payload (Formbook)", "value": "2f1e8f14e192de8369027175bfb611bddc33616d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097863, "uuid": "a0687776-1ee5-4cbe-a011-90f8bcac5038", "comment": "Malware payload (Formbook)", "value": "727a106dcee0936d2c41b459c9999190e5e876603c07a8bd196415e0390598bd1a3d0975f406ff4d3810defeaa92fd43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097863, "uuid": "3a0d0703-8d85-4795-b542-168010a105d5", "value": "T178E5D7A232CB66858D91775BF44C56340A1EE4256B83ACCCF4EC1EC4A65ED9F36C0C9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097863, "uuid": "87ea3749-0f90-48e4-b765-8480141858cd", "value": "12288:T9+6ai4jo6WaVmkKSrVGywVxC9nccW/CyMYwEm3xnhnmoRta4Xz1+chZDkLg8jPA:gro6WZM1gwr9/uM5iDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097863, "uuid": "173b7886-2a7c-4f0a-87b1-39f48652d14a", "value": 3131169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097863, "uuid": "ae903220-a32a-4805-9a4c-9a8cb99cc162", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097863, "uuid": "942b963e-a1b6-448a-bc2c-b7f32c693c57", "value": "PO 050186.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726a119f-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137900, "uuid": "da92bac1-11a0-41d8-bc5a-2bea393b4716", "comment": "Malware payload", "value": "d4369a7773e4e4c40061bba26bf19c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137900, "uuid": "118b684f-09bb-427f-91b6-dbfe5b250082", "comment": "Malware payload", "value": "1e05be6774dcb4e877b68d645a328e32a6f061d1198888ce6b370558f2f8c74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137900, "uuid": "9c0fb82e-b740-4b17-b8c8-3009d3f0fed0", "comment": "Malware payload", "value": "d4e961231e9e14d872b8b19d466eebcf5a563a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137900, "uuid": "d83c8ea2-2d16-49fa-b18b-b33d6940ecf7", "comment": "Malware payload", "value": "7ff48cedc20a3e08ea40828b481f89ea34b168a113a22a1ae55aa838561680dd9d665f0d82621be260ee8715e1ee7c68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137900, "uuid": "e2e6ba4f-b7e2-4d7f-adec-1dc4d62e244f", "value": "T17B23C516B6A3B07CC24BC0B45A9AD5F1B93178B402213D3FA7C9FA312E35D116B59E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137900, "uuid": "62a1ea4f-5bb7-441a-b71e-0f0f828dbe64", "value": "768:wYFrwOKcpJ85Z1f+5uA5h01aoNowG8CJwGXQ3pqiOTljz1J:rEOKcoxdA5hgadJwGXQ3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137900, "uuid": "fb3d6b6c-dff1-4964-96f7-ae2e4676fac0", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137900, "uuid": "3b21b905-058d-4306-b92a-4bad2219f93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137900, "uuid": "075b77e6-e59e-4ca7-92de-475d10b6b43a", "value": "main.x86-64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c231648-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137890, "uuid": "f6ec8e3f-ec6a-4ba0-aee3-30cf718deb5e", "comment": "Malware payload", "value": "99354009214779d165368905702a27f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137890, "uuid": "ca09a380-34c1-4680-8b52-4be80ebacae5", "comment": "Malware payload", "value": "1ea36fd1287782a96bc746848356a7993d92f6aac8a5f65112fd0d2b97b551ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137890, "uuid": "9f3d7d72-09c7-4414-acbf-0a4ba10ed46e", "comment": "Malware payload", "value": "9d4fe37c130f7f4a1bb3fc012ea6e3ccc1d21d76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137890, "uuid": "4711ef0f-c5a1-432c-b815-f3eade765d57", "comment": "Malware payload", "value": "42ed3bbfa73dad82205fba5360a35bf95f3921318c4c90a65a4567a91d4ec6a6f4fa4a9b6653848f0ec19dad2439e3ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137890, "uuid": "080920a8-7744-42bd-846e-7f61e184dcc1", "value": "T11353F723FF0C4017D49369380A3B47AEB311BD5160BE9516330A6B6F2776E31A647B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137890, "uuid": "2c8da56b-9af2-48ea-aa6f-7a8c3c8b3415", "value": "768:cyUSBMK5b+7cChVOM8HxOGJjv2QwmoJuHGj5en8Y35v7I6zI+kJkN:cyUSBMB7dhsM8H4i16JsD8Y35vTzIpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137890, "uuid": "bd1becd6-bbd7-498a-bf66-2c16275cb90b", "value": 66452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137890, "uuid": "88d058db-ecc2-4dc4-a92e-377ca36c30a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137890, "uuid": "2558ea57-f299-406d-8ac4-311589956c54", "value": "main.e500mc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33074f6b-9291-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786128774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128774, "uuid": "ff47e966-bc4d-4929-ae28-74d7e4e84fb7", "comment": "Malware payload (Mirai)", "value": "0be3aaac8168a6039c940726f4532200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128774, "uuid": "210f2687-5c6f-4393-96ec-f83ce82a6e44", "comment": "Malware payload (Mirai)", "value": "1f83457bc3a239c4e9dd7d1adec246fd5cbaa5512fddcae747c6dd4c88966bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128774, "uuid": "bbf14d5e-708f-46ef-9a1f-975cc5ec1e57", "comment": "Malware payload (Mirai)", "value": "57f04c643b444ee9d94968285d3c34f9e6657a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128774, "uuid": "a9614e93-019e-43b2-9257-f65301ac770e", "comment": "Malware payload (Mirai)", "value": "7853cc4b3ec03d4fd474f7d1509bb5461f0c2fc99c02f8aae99b03e72145ba995414e3bcf4bdbf276159c156296f01fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128774, "uuid": "22cdceba-5c8c-4eda-ad88-538091154085", "value": "T1344302C18102AB96C1D3207AC4DFC052930D309BFA99F26A72264109BED789BB9FD123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128774, "uuid": "d5d6131a-06d6-4c6b-aaae-4c415b796c37", "value": "1536:Yx8VKXtfvF3EEx8woi89Q8RPIRFD6mDlay7oVvauf1:Yx8VKXtHFLiRKd6mDlahCut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786128774, "uuid": "575e6aae-c573-4b30-a0e3-e6fe10f43583", "value": 55440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786128774, "uuid": "3a622e92-f5e2-4944-ac67-3bab55d366d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128774, "uuid": "5a480721-a666-4727-9424-f98a5026f945", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2390e4c-9245-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786096373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096373, "uuid": "c30556fa-05ed-4fd9-b818-6d6a1c6e2b93", "comment": "Malware payload (SalatStealer)", "value": "4ba88b5790e327ce805843417d2708c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096373, "uuid": "de3c4d2d-6d5f-4269-9d43-bee746049ae4", "comment": "Malware payload (SalatStealer)", "value": "1fce06baa55f455053a1d5094513a1d509d14cc0270241d329d287feb9a66820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096373, "uuid": "2315df3c-f643-427e-aea2-85e165611413", "comment": "Malware payload (SalatStealer)", "value": "f0c95addd0f6d77d8ada755ce186b66515344f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096373, "uuid": "ff5f67cc-d246-4be5-8a10-818693c2382f", "comment": "Malware payload (SalatStealer)", "value": "aadf1c543cc7ae8769deff6f9dbc8a31058c0e94eac1eeb23d7c3d9b4724c16db211478804255cf37e89470082812d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096373, "uuid": "d24dae71-ba07-4cdf-ab41-5d73186019fa", "value": "T1E8C65B01FA8B65F6E9035831415BB27F23315D048B28DBDBEB583F2AFC776A1183A645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096373, "uuid": "f5d4dc4e-3799-458c-bb1c-a7768b10d031", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096373, "uuid": "b8f88d09-a123-4cad-b1b7-b28d86aa9545", "value": "49152:vXxLFxcRUsGTfTS5L4j2mWSqm/W1sDBKBkQfImdU3c7RAb1vLvktHN63a/jjun9J:9FSRUs6j2h8/uYKAb1o67E4qrNnEo/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096373, "uuid": "646c8333-b09f-4aca-ae9d-e18409c9abc4", "value": 12543488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096373, "uuid": "2926adef-32ce-4f7a-89cc-c648b6d58531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096373, "uuid": "333c94d9-ead1-4a7f-ae7c-6eef93fd75d6", "value": "6ab8540db2cc96cd482583c84b2bac2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7337f73e-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137902, "uuid": "fb7cdae5-3569-4614-9dc1-304c3b7bbf64", "comment": "Malware payload", "value": "16f5c276640ad55736617aa899c00919", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137902, "uuid": "40c0a362-fbb5-479c-af9f-65fe6940959e", "comment": "Malware payload", "value": "203548104d9582d155e95123af5f8f5bc3a8f07436ba47d318ab6ff0bf11db9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137902, "uuid": "ea7aafb2-9b6a-4cbc-acf8-da4f9e786b28", "comment": "Malware payload", "value": "706471d39c4bb754ded04f5d9dd29f6fd9e75770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137902, "uuid": "199f26dc-ed94-4697-8a6a-8ee89920e22e", "comment": "Malware payload", "value": "1842342255dbe86cbb48cc65321466309e51cc494f67157ef4a46fa8b95791e2165b6e3e2f23af1495e66a8711176181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137902, "uuid": "098c8fad-29b8-4e35-b2b9-7818a1e5a195", "value": "T1DA23D627B6A3B47CC24BC0785A9AD9F1B8317CE402213E3F97C9FA312D35D116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137902, "uuid": "e090aaae-374a-45d5-990e-40457fe4d32a", "value": "768:vTOu57X4mJtlTqtc4vQVcu9x5jSY9vwO9YolljwJ:bOu5rHTSc7cK5uY9vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137902, "uuid": "cf20148f-7487-46d8-8992-ca408b2b1d7e", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137902, "uuid": "49bcb394-83bd-499f-9467-3aff1b396cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137902, "uuid": "b57a1ff5-affd-4405-a4ae-fd546b7bb2f7", "value": "main.x86-64-v3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f9d2b1-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786110871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110871, "uuid": "539e9d66-0d43-4ee6-adce-69ce4fc1d5fa", "comment": "Malware payload (Mirai)", "value": "e4e3242ad2a95df73f291a7dc3ab68f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110871, "uuid": "442de554-83cd-46be-9850-769b2d47c07c", "comment": "Malware payload (Mirai)", "value": "20caa4100a46af1cc5afe27b9ecbc27b20c27382a5d92137fe8d12e113274f5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110871, "uuid": "ecf124a8-d40e-4e7d-aa77-3cdc9fe913ff", "comment": "Malware payload (Mirai)", "value": "4a8f6ba533d2113263fd708652c3ce5ffeb05057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110871, "uuid": "3786586f-c83e-4e36-a63b-98ee95efd82a", "comment": "Malware payload (Mirai)", "value": "0b8a3af8820875dcf9170f4ad84aecaa8cd9df174e49fe4b4f2faa9761a685d5e7049f7c1e53cf7b7dc461ca53f6059b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110871, "uuid": "f1679997-49b2-468a-9035-bd66c9a39ba3", "value": "T10EF46C627B22DF64E364D17108F3C7A595D421621EF280C9727CD7187A60A6E2D3FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110871, "uuid": "1e5f2b5c-7ef7-4c22-8eb9-50089e2a9e15", "value": "12288:f2s/kOndahO4GxuORGWQ1VChzcrkjvpfxnbkC+gRn0n8pu0kBb0S3:f2s/qhO4GxuOkChgrkjlxnb6gRnTk53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110871, "uuid": "137d7a05-5da8-4396-8e0b-a3b445d62c30", "value": 738432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110871, "uuid": "c657a872-093a-408f-ab6d-87eb7c597be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110871, "uuid": "0b2fce55-91b9-40a1-acc2-8a60b4ef7115", "value": "xd.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb5b86c-9208-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786070116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070116, "uuid": "9af6cd48-a286-4e4a-acb0-02ff052f5f46", "comment": "Malware payload (Mirai)", "value": "52b08acc9b2be0c6ecf821c65a271a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070116, "uuid": "8822d9f0-c435-43af-9486-1b9335374ff6", "comment": "Malware payload (Mirai)", "value": "22a7183a59a6dc4203686d5482928fc587c5fd4db20949d599c09e75d01d790b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070116, "uuid": "bce3b0f3-bc17-4d28-9546-17f392e464c0", "comment": "Malware payload (Mirai)", "value": "fe675193c9ece1cf520ff4322773ebd2ce34674a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070116, "uuid": "8e8836a9-f56b-4a41-ae62-84c3dd45f142", "comment": "Malware payload (Mirai)", "value": "9a89253af72d9770ea3e98f6a0a001ab076e208414205a38991d44e80ef3041829dd643d75c687060bdacad2c051117c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070116, "uuid": "931c983b-1f3a-42b1-8076-99861299ef14", "value": "T101E3AFA7B70F2450C42606F81BCB57AC2A3361114E6F9BE76C6E763E1A375DB28063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070116, "uuid": "25052630-3e81-4d50-93a3-8f39523666bf", "value": "3072:8Cj/bseNZu8cAUrj8Vry0uSHjqgWCWtQuy51dFIHvxq:8Cnhb5U8VmDAjiCWDy5kxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786070116, "uuid": "38cee23b-f192-42e5-95a1-f14c803619d6", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786070116, "uuid": "aac77165-c16b-4c43-b995-fc914df3385a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070116, "uuid": "0ae90255-8f27-4d97-84c3-e54ed11f3bd7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3699ea-91ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066409, "uuid": "bbca35f0-7310-48a2-8e97-813b9c7cba3b", "comment": "Malware payload (Mirai)", "value": "4538b25c31206119dbbe7056c7423a76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066409, "uuid": "f1c7ca36-0e22-428d-8163-5ac3983f5f3a", "comment": "Malware payload (Mirai)", "value": "2313008eb3ed7c5874283b577f6614bd0eddd471014d3b6b23a8d1218c2f4ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066409, "uuid": "1297993c-cbf8-4509-ba2d-3d9b58aa05c3", "comment": "Malware payload (Mirai)", "value": "c5e6b9568a6fc3a57d5514e6f80ea8cd2864270d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066409, "uuid": "560a6d7b-848b-47ed-b7c3-9d4536ddeadc", "comment": "Malware payload (Mirai)", "value": "06849daf7a55f8ce8b0506df0791503a49389bbe9146d7b3d3888dd8aafd7d80226399d3d4af03d22b6c76e896c3982a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066409, "uuid": "67889d0d-1d27-4b90-9cad-9a5ecf5b9d7e", "value": "T1F9E35B06B30D0A47E1632EF43F3B27E1D3DFDA9124E4E640251FAA8A9271D32558ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066409, "uuid": "601d3f57-7192-4dc0-8afb-ba5cba9bed93", "value": "1536:g3Ex7Y865aRP3xzaesgHfbU+pERU+MF5uMuRkpEFtTi49Nd/MG2q3vA16ogbpK0U:pxcM3xGeXy2ATiuNZc12iotHY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066409, "uuid": "fde05b37-72ab-42bc-b00c-4d1d76afbed6", "value": 147324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066409, "uuid": "61baa4c1-ebd1-474b-9beb-e3269f1d038a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066409, "uuid": "07bc9e57-614c-4093-a25a-6edc09aa1d24", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ad19f5-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097832, "uuid": "1b90fa62-d0c7-4bb6-a572-702b0b03c452", "comment": "Malware payload", "value": "b13498783ece036d03a245c0c740973f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097832, "uuid": "d95c5dbe-800e-4f9a-beaf-773e38d4a990", "comment": "Malware payload", "value": "24662333e3c68aad11b140421caa6d5ad883ff9d3d992c5b04fe1e0fc11fd9bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097832, "uuid": "6da25bea-7da3-4ecf-918c-783c68cd7f1e", "comment": "Malware payload", "value": "7969fba3fc189efbaa2b39039290a3db6a01bab0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097832, "uuid": "2c3a40d0-877f-4821-898c-a899b8b0ef61", "comment": "Malware payload", "value": "3a331fedbdb719f82a67649baa15be2747ae6591e15cefeb5b5198519a0929ab0bf2192affa9e6d60697b19311648b37", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097832, "uuid": "4699a2e0-2826-49cb-8cfa-c739fc5d2a33", "value": "T1DA474A8809EC8D6AB6A140B0B5EE71F01ED96859312736ED0F9B01E3DD1B8FC35A2DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097832, "uuid": "d9ac0353-694d-4133-8757-1ddcf49da83a", "value": "3072:Y9Aw9wOInwf9AwbwXwxw+wxwf9AwbwlwwjwOIzwwVw7wTIZIZInw0ww3wws9Aw9P:0owD74Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097832, "uuid": "5d6a6683-29f5-44d4-b97d-3c4233c1f24b", "value": 26022698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097832, "uuid": "7afe6160-c713-4a02-b80f-60a6baf6c528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097832, "uuid": "a1d122b8-998b-4b37-baaa-402540c3668b", "value": "760530263.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb7946a-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786135795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135795, "uuid": "9abf47f7-75fe-4385-a028-3207a6737d9f", "comment": "Malware payload (RustyStealer)", "value": "11b388e073236318b3851c168aa1abde", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135795, "uuid": "3cb9143b-397b-4b23-b1fd-a9db4c0a18c1", "comment": "Malware payload (RustyStealer)", "value": "254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135795, "uuid": "56e2e054-4389-4374-a768-ddf0e24b1335", "comment": "Malware payload (RustyStealer)", "value": "3b2ce84bea55b35c195a046f40dd838931960270", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135795, "uuid": "17768b31-29eb-46c6-a330-0536c2f45d41", "comment": "Malware payload (RustyStealer)", "value": "81e6a679fa985f025e296c11a87c9ec5c1820ecd3ca1c39c35ef2b35473c63adaa1723f56453fb99a0111d31fd1bb5c3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135795, "uuid": "a4dc37c4-a083-4e68-9816-638dc53249e6", "value": "T1A9565B12BB9A55ADC05BC07482464773AB7270CA0B35BAFF419486393F6AAF11F3D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135795, "uuid": "a94e2071-a8dc-407c-857f-00fe85bc3bce", "value": "05dfa411eaf5e24de0f77bb28b01c408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135795, "uuid": "7ea7e4da-9da0-471d-b72f-69f590e57b53", "value": "49152:Prkotepov6CNp+cQiHo+kPYKOUJYrMyiGVKoZP1jjGsRH/nEEnm/IMr8XNKCiEfv:gizibmXH/MrgggIxQ2XHInt4Kj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135795, "uuid": "15535c21-492d-4eba-a86c-5c2cccd3b330", "value": 6468139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135795, "uuid": "86874dd8-fde2-48c2-869d-6fa27ce5f65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135795, "uuid": "080f6ec1-ff5c-4c96-9a5f-30732ce56337", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94115dd-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097727, "uuid": "9f0a9cc7-d5c3-4ad2-8315-a59f99693f37", "comment": "Malware payload (XWorm)", "value": "30cd643d698edb2ea5058dbc808faefa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097727, "uuid": "9942ce8a-672a-47f9-b4c0-7d350bd2490d", "comment": "Malware payload (XWorm)", "value": "26462fea1501648c12c421b7ae9087b37f9948c54db73b4d3f065db8608e0a39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097727, "uuid": "33e267fe-3902-4c74-8acc-36b98ce93645", "comment": "Malware payload (XWorm)", "value": "f28f1dfc9eaf87254f7e3d2c6760d5755b54be24", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097727, "uuid": "886399c7-6fd3-462d-a2b3-093a68fd1d77", "comment": "Malware payload (XWorm)", "value": "63f1056df101fe24c1085d79daddc87cf99d53322b33f97f08a9abb4c59edc23a004376951bb1e355dde69a67f672222", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097727, "uuid": "d485d5e5-258d-4f61-bee8-41ed2da137ea", "value": "T17C434DE366AEAEC0027C521D3F8A4C0EBB7E95F485633E0E95395FC040B15A9D987736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097727, "uuid": "d4588bdf-a157-4ec2-910b-b69a2ccea0a4", "value": "384:Fxgl+fMzx+SmuTfiRBiYVnNoDGhnnJn8rN7ANZTAfzG4EQu5/d1jpgIGf9vjpgpg:L5f2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097727, "uuid": "37a21db6-ccb1-408c-b2f3-e217c4319941", "value": 55934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097727, "uuid": "d8cfa3c3-407b-4680-83a0-d7284c8e90f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097727, "uuid": "7ce8659f-d908-4d9d-9494-d06524af85a3", "value": "pdf_Receipt_20260807155706.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9249859-9201-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067125, "uuid": "32b18869-b5eb-4fe9-9ac3-1e2ba511bff9", "comment": "Malware payload (Mirai)", "value": "6887af6cb9a62c67ff55ce9fc74c4bba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067125, "uuid": "b8e87bb5-5303-45eb-9f4e-0c31ba6e7008", "comment": "Malware payload (Mirai)", "value": "2759b171a3a9b245bb0559d8a9aaa2ad753a140a072d6ca0c26235139fdc2a7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067125, "uuid": "d106c937-dea2-4eb2-a521-de4104f2314f", "comment": "Malware payload (Mirai)", "value": "0d22bdff94de2a302d098487493d578407474e6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067125, "uuid": "f38ee60e-3402-4bfc-86b6-69a362956069", "comment": "Malware payload (Mirai)", "value": "f70fc0435921820e10ac5924134e27404c3eded0b8432d7e02d0144df41fc3615ec34d0c34c360544c10e53cb0831b54", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067125, "uuid": "befce605-4b83-4d4f-b958-210aa9d3f038", "value": "T156117FA925707E20428EDF4D71E587E45206F5C3B1935BF2E5835D25A8CAE40B816F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067125, "uuid": "aa2c98e5-d598-4631-b557-2bb35b28ac40", "value": "12:7kft0dt6hbNaKjT6dODOqaDU8fGMGTK1zk1ZhVbcVb1LBqhN0m:4fCc3FHDwjYKxkpCe2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067125, "uuid": "df506ad2-7953-4a4a-97a5-ebf554817260", "value": 1008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067125, "uuid": "6999442d-bedf-41d3-93fd-9f07beb1dc0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067125, "uuid": "0f9f98a6-eecb-4226-a34d-d0bd4ff28323", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6989d4ce-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066589, "uuid": "202460a0-6e56-4615-8442-935cc87a28d4", "comment": "Malware payload (Mirai)", "value": "568010db2d21df503755125aee81e5ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066589, "uuid": "bef4ed7c-b33d-4661-9f96-a4b2ebba5e6a", "comment": "Malware payload (Mirai)", "value": "27f5a48e661bf28d1f2498c31e692411ecc8891a13da9f76458c0197dd3c7079", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066589, "uuid": "f03bf6a5-00ce-4895-add4-fb42c5ae0d70", "comment": "Malware payload (Mirai)", "value": "5562f5947d78a29326760390d7fcee5ad9a6102e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066589, "uuid": "134725f1-2a40-48c3-8f61-558aec3a6be0", "comment": "Malware payload (Mirai)", "value": "fa79ebfdb0fc4aeedb093d9d247da8dc9e7d6f4934978ca76d95c4ce4e80a19f13ca71eca128589e2b0f3e8f715dc3b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066589, "uuid": "dae5693f-21b1-4b63-b275-d57691d3770e", "value": "T1DDC36A77C8256FACC524E9B0B0719FB86B63A911854B5FBE1967C2758083DCCF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066589, "uuid": "0d9a96f0-cd35-422e-ac3a-b327341748fc", "value": "3072:+l1pDga/5yuZcqnRe24m1+AguAWz/RW4DVHj:+lHcw5MqnRem9Jz/vDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066589, "uuid": "81bd3671-7625-4c46-a385-a278804d769f", "value": 128504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066589, "uuid": "f6aa8111-b421-42a0-9cfa-94e7c6f87653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066589, "uuid": "0c323feb-f7cc-4843-a33a-6725c50945f8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8823726-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786097699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097699, "uuid": "ac8b6347-d452-4263-8afc-54b5d2c4a023", "comment": "Malware payload (PhantomStealer)", "value": "79366ade4f7165602471ffe010ca2347", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097699, "uuid": "d4cc874a-ce7d-47d0-881a-fc90cf3f61ff", "comment": "Malware payload (PhantomStealer)", "value": "291c41c2b004ffbdec29311ff4336c86b1ca132e3379a5949042c01cd4aca3fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097699, "uuid": "5b6f9bbe-1a53-4a7b-81a9-10e63ff70124", "comment": "Malware payload (PhantomStealer)", "value": "d0ce4d8cc32029b5054df683c4f32151c391e8d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097699, "uuid": "cf1ddc28-be59-485b-9f98-c26c6cbe07d4", "comment": "Malware payload (PhantomStealer)", "value": "dc9e6af1b394016e017baac1be6ffb9ca74871248aae6c9bc28a8fbaefbeae1c28a46dfc11753cb8f68493ef3a6e6f02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097699, "uuid": "1ad792d9-6c85-4b01-a2cf-69eee3734808", "value": "T1FE9310910A877480537767BFA36AA8E4EBB20B2702901927B83C7850DFF1D1ADED4D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097699, "uuid": "0e90c748-7482-44c0-949e-c6e40999b726", "value": "768:j5QngVchBjfDW/PXXn/ZPBTmoxfRUOBuUMXp6cQznTT9ARzRY168+fDL7lJNoJVW:OHmSeT68/AaX6Gnd3F7Rwi6ljIO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097699, "uuid": "7f96d00c-0861-46f7-8ca0-3f0c790d0472", "value": 92111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097699, "uuid": "111d757a-4b9d-4e8e-96ad-5caf8c1d4259", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097699, "uuid": "7e54437e-dec0-4516-b287-c8b6e29f691e", "value": "PAGO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf1693-9292-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129520, "uuid": "4592034a-0e8f-4555-b6e6-49039516eeda", "comment": "Malware payload", "value": "1116b6ba281ddc6af49f9f3003e77c7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129520, "uuid": "73215eea-f056-4c18-9187-6196aae4e2e4", "comment": "Malware payload", "value": "2a8452e563abcd314e274f41831420fe9aa906e80de34a971605435232486bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129520, "uuid": "ae9cbce4-e148-4586-9aff-a25769d28e46", "comment": "Malware payload", "value": "7ad60ebedf35bb691dba44e5251d408837acb012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129520, "uuid": "7e542bcb-7351-4f9a-ae8f-8fea86513fc5", "comment": "Malware payload", "value": "a6f4c4b74b8a62496e7d92ef2418fb39c66c931f02d8dd3722379f0b897fb74a778389b1f758f7cbb3fb959e95fd7e51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129520, "uuid": "454c1ec2-7d4c-4ac0-9078-b18a9f514faa", "value": "T169933B4B660779C4F17101F4A3CE4BD03F2260DB6B3A5DB6AC7902F2ABB319A1D1DA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129520, "uuid": "0943d1a5-100e-41f7-ac57-8d09f2bff4bb", "value": "1536:XfdcR27hEbhjjHb1aJIxYBfDjwIwyRGAEgdUn5p5M/LWi:XFcRGg5bb1aqxYdDBdJEgdhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129520, "uuid": "bc853ae9-296d-4d8e-b97c-c9b3719e9f64", "value": 91612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129520, "uuid": "13c3047e-f30d-4af3-8a7f-194db0cace26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129520, "uuid": "06d0a8ba-870d-4d9c-b715-97a81c5736f6", "value": "main.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04ba80d-9278-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786118247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118247, "uuid": "a4d30d35-830c-4554-85d6-48d57f53d12e", "comment": "Malware payload (AsyncRAT)", "value": "23ed3c85947705b76a5bc6dfaaff0b41", "object_relation": "md5", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118247, "uuid": "1c2b62a7-a4bf-4d91-9fa4-ae8e4a788729", "comment": "Malware payload (AsyncRAT)", "value": "2b45aeb88bf38dd8dfbb13390c5b0f5efd6a298a6f967ac773cf47b2489ee5ab", "object_relation": "sha256", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118247, "uuid": "2744e7f1-5c49-4e1e-86d2-1897717b055d", "comment": "Malware payload (AsyncRAT)", "value": "3526ba1e856cf7c229ac3149ba05eeacf74fa7d6", "object_relation": "sha1", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118247, "uuid": "0add70ab-f8ac-45f7-a923-b9082b76631a", "comment": "Malware payload (AsyncRAT)", "value": "090db10a7d91142c891b5b727edf34a902eb25d10a85c0bd70f3b684edba58c70a3971972b16c6f2b98042cf7c510229", "object_relation": "sha3-384", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118247, "uuid": "ab65a0ce-0905-447e-9532-e83ed8d009a0", "value": "T1FBE55C02BA9B94ECC15AC475C34A4A736E2174CB1726B9FF42D496383F6ABE05B3C705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118247, "uuid": "f33fc341-7506-45ab-8093-eab719eee332", "value": "d6b9541054194c4e133d201215d246df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118247, "uuid": "997bceaf-235e-45db-b8a4-6132a3b80f25", "value": "49152:uYxnboMd6s63cABpYcS4ytd07MYjMGWqrUVrlFhK9j9o4Q4IU6izr4:BovsA0v4vAdkUH+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118247, "uuid": "8534e7c9-a8a8-4621-b4c0-b82026d66a6f", "value": 3215256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118247, "uuid": "61ce9cc5-8d0d-4554-af70-19238fd35ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118247, "uuid": "5d38fd02-ec45-4044-b744-3a84fbe25040", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb63d02-926d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786113517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113517, "uuid": "ec87ca65-6c6d-47e9-a14b-ac43b356d6cc", "comment": "Malware payload (Mirai)", "value": "ad68302faf97881caf2961821b2af61c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113517, "uuid": "c73e325f-f2f4-499a-97cd-df66845a592d", "comment": "Malware payload (Mirai)", "value": "2b61598d6f31b6a4bdd80a2f996ab8ec7c5221e975c6f795f025eec1027785ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113517, "uuid": "58f7640e-cf6e-4229-9faf-57d109d6dd45", "comment": "Malware payload (Mirai)", "value": "3ad0cc0536c35a68379fcc3603082bc4e7340d2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113517, "uuid": "6fba5894-eff0-4a8d-8a0f-396ba5bed67a", "comment": "Malware payload (Mirai)", "value": "6b6a212f9480f925288803fc9c1adfab1c357435db7a841b47544cfcceaecc72949efb0fef7cfc0f9eebbba049f9a961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113517, "uuid": "f3a63f3d-5dc4-48ad-baef-76eafaef2d60", "value": "T167259D12A7F11296D2C0933587B2D7A07A46A79A24E4420FDF608FDFEF562750E84CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113517, "uuid": "36f6dd7c-635a-40c4-a3a2-5b90eaf49b42", "value": "12288:o7wHLTqIGc06qsDl8dlEZh0+zjjjb30WSVls5ldorT:r+c0RlEnl/jjz0Be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113517, "uuid": "e599c552-532c-4a8e-9ec7-aac7cb55a3f5", "value": 1057496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113517, "uuid": "24af0c83-64d7-4cd2-a91c-435a2bf6eaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113517, "uuid": "e14763b5-89ad-476c-ae41-29d38a828a72", "value": "xd.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95f1ba7-9299-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786132516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132516, "uuid": "eaad8576-23ad-46e5-b160-bc4ddd48e060", "comment": "Malware payload", "value": "f03d324ae6c499fda8f3142f35c7d1c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132516, "uuid": "baf4dc78-f4d1-41f1-879e-4eb508502b26", "comment": "Malware payload", "value": "2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132516, "uuid": "ee101590-7a89-4a11-be2a-ed402fa076d5", "comment": "Malware payload", "value": "5bb1895c14a2304b3998b97d0d3e8bdd9a74816c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132516, "uuid": "3955c92e-0fdd-4f49-8e3a-8166ab25fb4b", "comment": "Malware payload", "value": "18898b660ade00865e6e10f99772b2ed8e81d3f41dced58064d107398caa83cf8c8a055ea7cdae7f39574ea21dc9c041", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132516, "uuid": "30505123-b21f-4d67-9de6-bc478841a089", "value": "T118C27D956A867C44BEC94A3E4CBD2B1D6DF5C3E1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132516, "uuid": "5295e09e-093d-4fa0-a7ad-debda0a01023", "value": "768:vC8vCB+25j6es8Rj9FYpMSUpi+20qUpi+20YQX:K8l25Jld2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786132516, "uuid": "4daca968-c367-401d-b45f-ac896520dab6", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786132516, "uuid": "33876ed4-730c-4422-a769-da00e0b12926", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132516, "uuid": "f9031366-fff7-4e0e-b0cf-d9667295ced4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb245918-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786096012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096012, "uuid": "0c80b58a-a6c9-4105-9890-17697b5cbbc1", "comment": "Malware payload (RemcosRAT)", "value": "2819ddcae16da493049bfe044d3d04ae", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096012, "uuid": "3024ff95-42bd-490f-b2f8-496f7cee4577", "comment": "Malware payload (RemcosRAT)", "value": "2d84255d9842928cf7d7d198475842718e2acf6fd6caea4858096d0c232c4ee3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096012, "uuid": "02e36945-3875-4abe-872d-1286a4f39e93", "comment": "Malware payload (RemcosRAT)", "value": "d940c8fd2b3c7ca756951ae26b063962d6793391", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096012, "uuid": "3b470658-617d-40e7-b3f1-ca11e905a09f", "comment": "Malware payload (RemcosRAT)", "value": "9ef7cadd64c961151f5a5fe6044b7e969995ad530a16ccc4bbe5317fbba0f547a85ba3062c4f44ba275b5e2f76d088a3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096012, "uuid": "bde01f71-a7a5-4fea-9b66-0dd1666b17d1", "value": "T17B250116FF808936C94247350BA371D5E31DAC7BAE2A4E0E270577396E376E0D972D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096012, "uuid": "506e334b-ddaf-470b-92aa-83fbce4f7187", "value": "24576:YfMMUKhioqKmt1QRT/64rm/ukO2ejES0n2l:geKh2KmtmB6YkB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096012, "uuid": "038837a7-9603-4948-9934-37ac3cee913b", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096012, "uuid": "318f0a73-b957-4f7d-b70d-9018bf009320", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096012, "uuid": "e4b3ff6b-8728-4ed3-8ba7-1bf05b4856aa", "value": "Order 399201.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44aec8cc-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080271, "uuid": "cfaaf7ed-a120-46e1-9c29-cfb5ec5dc41f", "comment": "Malware payload (Mirai)", "value": "008f96dcdbb513e17cf5376a599973e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080271, "uuid": "bf58722d-cfaa-481b-9bd5-fb58c6e02445", "comment": "Malware payload (Mirai)", "value": "2ffefb31dabd53ac8259deae8cd3d2ed5813e4ac15b7fa4cbb4882627b803de2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080271, "uuid": "1635337a-67c6-4766-8bab-26c8378e8749", "comment": "Malware payload (Mirai)", "value": "cba6df8ab7988fa56e51ad64e782c8cb0c2bb72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080271, "uuid": "04765687-8c2d-4e41-b650-33da51fd0c0c", "comment": "Malware payload (Mirai)", "value": "cf9228277ba575b996aad21d605587d8318662095f0ec12496471f9f416e40008c86897f7ba4cc59d51971d85e4a7b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080271, "uuid": "6890ab6c-da32-4028-af8a-eebbe89ea86c", "value": "T1EDC32A9AFC90DE52C6D52675FA5E418C332317B8C3DA7206CD209E34B7E7D5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080271, "uuid": "c924ec3a-cbb5-447a-a2ec-21ad0d5fb835", "value": "3072:k4Y3KobiEZhEVGUQ4g8OfC+qKz+uD2dh4dsVp4f1DlX:kf5gVGUQ4g8Oq+qKYdh4e495", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080271, "uuid": "03f50259-26f8-4e1c-84ef-151f2714c160", "value": 120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080271, "uuid": "4f67cb1e-2c0c-4a68-9a67-49823cd350c0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080271, "uuid": "ce4e961c-ed8a-421d-b557-65600742de25", "value": "e7763421d994358879b052070205b41c1603d17e8d0ce362c47893e438c5fcc4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14af7ea8-9259-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786104672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786104672, "uuid": "7108ff68-86cc-4045-b460-67c93cd0edad", "comment": "Malware payload", "value": "01f84e942908ccb2fc657d9dd1caf8b5", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786104672, "uuid": "5cfb10a9-1747-4921-85c1-fa04f45c09e5", "comment": "Malware payload", "value": "30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786104672, "uuid": "84a976ee-0b74-48ab-8732-6c1aca0cae13", "comment": "Malware payload", "value": "c6cc775f76f0aced85206c313b452f29334c6ac9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786104672, "uuid": "3840c5a0-e2b3-4a86-9fc9-120321842f48", "comment": "Malware payload", "value": "82de9b5fbe224b6fe1a7a95e00b76bf7205e99e2cf33ccde91c8295aaf54c459743d2ed2b67c6189dd9137e63caaf4ed", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786104672, "uuid": "c8481bad-9dba-4fa8-891a-0a4717041af4", "value": "T108165A07BC9548F6C0A5A73189B74256BA64BC0C5B3233D72E60AFB82F727C06E75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786104672, "uuid": "de30e741-7c9e-47d3-a230-6014423afde1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786104672, "uuid": "2296f0e6-2dd4-4f3d-bd7a-d98d54a48757", "value": "49152:or6eizASPXwsy0kCfMNsuNATM93rsvkENKT9iDMzwKo4MIwXZ8fhsQWLg5sR:oFfckCEtiM93rsvkEETBzc4MvCZwLms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786104672, "uuid": "597c22c4-b235-4104-b2ba-302247f79c29", "value": 4200304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786104672, "uuid": "85b69892-423f-4728-950e-7e480162eab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786104672, "uuid": "87a6d6ae-d6ce-4408-b19a-4f824d460e6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1d227f-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137918, "uuid": "490fd806-7c4b-43b1-ad66-9f6e0858e9ee", "comment": "Malware payload", "value": "82b77e89caaf3c25b47a82d978cdea84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137918, "uuid": "baa4940e-f0c8-4d0c-9299-34a787d5b498", "comment": "Malware payload", "value": "3052ea8b43bf40e9d4060c95523c7e194238d1ad941f5df06d01ee04cbdb2985", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137918, "uuid": "8022a43f-fa17-46da-8c22-a6ce69d40804", "comment": "Malware payload", "value": "c243e96593606df91ecf10cc60fb387478a111c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137918, "uuid": "0452d0f9-9db9-4954-9601-2df6a3de186b", "comment": "Malware payload", "value": "e6ce34ea68537327bddaa96c3f1a70abc2901be7fce38c90d624a89e6f41c5d0165a4f447ab82c288700ea11c8c027bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137918, "uuid": "c5fe4213-97c4-4d1e-8bb3-a795133ca210", "value": "T11525BF5237F61461D74086398FE2E321724ADBB824D54A4B9F508EEFDF072651E82CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137918, "uuid": "6eefe841-e310-4fab-8596-ab409563847d", "value": "12288:0At/M8JU4OshB0JRDi0FLbCRpKPakyiSUa5g6eyY:d/GrJmvpKVyid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137918, "uuid": "890b51e8-923c-47a8-9415-1248f5bfea47", "value": 1057080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137918, "uuid": "09edf609-45ce-4dfe-8afa-c060d7cf3a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137918, "uuid": "bde79e6c-16f1-44ad-8673-ce3317fb911d", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08a607e-922f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786087002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087002, "uuid": "ac6db8db-a949-4eda-a0c9-2f712b666ea9", "comment": "Malware payload (Mirai)", "value": "bab69e195a1e9fef65538d2304144f13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087002, "uuid": "7f978d2b-6f78-49cc-9ec8-be0b4effdb04", "comment": "Malware payload (Mirai)", "value": "31160b1393a0860ccd5e1c1702bfbd15a5b495af8d368f9db65732cf162d8ab2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087002, "uuid": "a93f7903-d602-425f-acfb-5abe6ffea123", "comment": "Malware payload (Mirai)", "value": "559d29909b30c02b650e791914d24c070b30570d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087002, "uuid": "4a1410e1-3fcf-4345-ade6-5424e680c9e4", "comment": "Malware payload (Mirai)", "value": "5ef5df8298aaaf4bc5b32602424f2a4fe4819fd9738e57a1e8fb88c7ce707ead39d2f878de8874f28b1d86b908d785e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087002, "uuid": "47588fc1-bca2-467f-8659-3db66d1bc099", "value": "T1177302A3DB051C7ED49819339E95B3A8A06DFFF74443C3DE7E20659923494AF14290AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087002, "uuid": "ffb19fd1-0099-493d-b949-39c6372d121f", "value": "1536:QbNvXRGnETVKTaCJ1p24AKwJEC4ytTMF3XWMSOQO:8vBGns+aCJbAT9tWWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786087002, "uuid": "2a8dbce8-850b-4859-a06b-22f5bc7480e6", "value": 73700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786087002, "uuid": "5bda799c-75cf-47ef-8f68-ff192eeed5c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087002, "uuid": "980e91ec-c65f-43c7-8121-f219c921e638", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33280b02-92b7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786145096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145096, "uuid": "1df00358-d98d-41a3-aa26-f28abfbd021b", "comment": "Malware payload (Prometei)", "value": "c8fd9f9dd386d1e8b55a1b31cd53bf3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145096, "uuid": "028c2729-2725-43f4-912d-4dca6d9c76e8", "comment": "Malware payload (Prometei)", "value": "3119fd7988607b0c3a5eb5256ee942d5c711d1141e831742f433d8f58d56b900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145096, "uuid": "4f1724da-4566-44b7-b586-5d826dd9c03d", "comment": "Malware payload (Prometei)", "value": "62fbeec3e944a13d5f101df06c916e3f8c6ca90e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786145096, "uuid": "a3bcc6ae-6b6b-440b-b39c-78ff2431ae58", "comment": "Malware payload (Prometei)", "value": "383d2cb8875923d0f6ea0bd520385f89e52742f82482091bd802741e57fbbfac9c46896b18518fe068152a051e79fffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145096, "uuid": "ab836a06-dc1f-4827-99ae-a28bc27bae40", "value": "T184A423B4F9229E8F6DD769F91B24835DE182C172589D4C1313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145096, "uuid": "a41018f5-479a-4b36-b067-d3ed9296b169", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdZ:Fs6pyCC/Ya2hpi6T6N4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786145096, "uuid": "a5926b50-b9f6-46a4-b843-fb8e3781f9ea", "value": 449079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786145096, "uuid": "bb670c0e-343a-4bc4-8719-e7c65df59f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786145096, "uuid": "0a75b7d1-1410-4871-9837-709c27544556", "value": "3119fd7988607b0c3a5eb5256ee942d5c711d1141e831742f433d8f58d56b900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81a25e1-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080572, "uuid": "fc609b26-3e69-476c-9686-039d7cf0b62f", "comment": "Malware payload (Mirai)", "value": "001a67e69b7c6e27dfd5efb566666abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080572, "uuid": "16e64f63-35e7-4797-8326-5234be88b46e", "comment": "Malware payload (Mirai)", "value": "312757404d0350b110d18fe3a9350b3d1f05856dc77e58860387e9d1068f3544", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080572, "uuid": "a7b4eba9-e57e-4b01-89ca-70a059686de5", "comment": "Malware payload (Mirai)", "value": "f2fb743adecf1622f84de94a6710ed5e37038470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080572, "uuid": "71c5d814-6db4-469f-a66d-05a51245d10e", "comment": "Malware payload (Mirai)", "value": "37db09eb44604aed6b647bfdffae2f271dc1fd7a3643d56894cce61e63b0e78e5f3c236de4914d6941e1e53612ae9acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080572, "uuid": "26095ed6-682d-4e21-ac28-e8f30999c08a", "value": "T126043B49BE642BFBC05FCE30052E930A21ED945FE2F6B3396678CD4C799A24859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080572, "uuid": "cb36133c-e17f-4f01-8820-92748dfa233d", "value": "3072:jZvSOiwrXktX65pnSGqVIRSXVtISswWLV5H+wtBFl3w1DIlkX:5SOLrXktXeVSGqVIRSXVtISwV5H+wtBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080572, "uuid": "174b4525-ec9f-4b66-ae74-4cd05537bb8d", "value": 181144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080572, "uuid": "1fa0e006-6924-4112-9d2f-7d65eac6639c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080572, "uuid": "242f4c41-4aba-4470-adf2-ec5267407b67", "value": "448ce36622569b98a650ed89b352bbcfef5910b5df1c156c16a9c924cdd539b0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cdcaa1-924a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786098612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098612, "uuid": "ebe910b4-db7e-4693-8ec3-893f7afdc3ca", "comment": "Malware payload (RustyStealer)", "value": "aecc5551bc3c5777277681e6eb357f8a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098612, "uuid": "610fbf0e-de78-49c4-8ace-d072c12a3a57", "comment": "Malware payload (RustyStealer)", "value": "31700814400f94fee4d2b9bff13d7423c3cbfb9578a05ccf4a39a6df57d2639f", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098612, "uuid": "89b97ca7-fac6-434f-852c-70452c4b6642", "comment": "Malware payload (RustyStealer)", "value": "b166b11b6d38492a9d24b42721203112603fd00e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098612, "uuid": "be893093-dd2e-42c4-81b1-c66eb1ae3953", "comment": "Malware payload (RustyStealer)", "value": "34023bb5fc381b3438770a56059a4c467d29829890a45976d536a619367442dea60a2324d1da7454977f454d66cd8167", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098612, "uuid": "e9152fe6-3f1d-4a45-a24b-565ccb5fcfcb", "value": "T1ED462263B661A27DE1AAD07493468AB7B635B0C905317DFF10E4DA382ED7E920F1CB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098612, "uuid": "9c0135c9-7f67-4242-95d7-3a947207c761", "value": "b949039b6ebe4372b35d3494c33e4a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098612, "uuid": "af772834-68e7-4d19-a09e-a85e2c782609", "value": "98304:LgBzOpSLmYVe+oaaiZEb4+mIRaYLIW/ZiXMh/pzkfwR4Gbt:cx6aqPjLn/och/qCHbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786098612, "uuid": "7a65c788-b55d-4e4c-99eb-0b17d3d3d277", "value": 5552640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786098612, "uuid": "22a101af-02d8-4e57-9d5b-f90e933f429f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098612, "uuid": "8a425d45-902a-4588-986f-48462f1da06b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd790df-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786097921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097921, "uuid": "ed1f6674-b66f-45ee-8622-613026940dc6", "comment": "Malware payload (MassLogger)", "value": "4e1de92c1c568e49bf75049f2547873d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097921, "uuid": "bb48a102-14ac-4d25-9143-f0fe0a0ca7c2", "comment": "Malware payload (MassLogger)", "value": "317d93f4c82ab3761f02d8ff2380bd07adcf23f24ba6a88ac63d281069c2ba59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097921, "uuid": "2233f647-685a-46a5-8f6e-6e7159c77eee", "comment": "Malware payload (MassLogger)", "value": "39ff459017e872647043004a2906bddc179768ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097921, "uuid": "f03cf5d7-4e0f-4b4f-bd36-e01614e92d1b", "comment": "Malware payload (MassLogger)", "value": "5e70dd6d3d7337e27a89d08c1dd97fe6b3fdd0eb016c6f9d4515298c17998b56efc9a229145c3de91d95a554b2adabbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097921, "uuid": "5160cf75-9b0c-439e-a078-015483b78010", "value": "T19D25D9DF7BF73A8C2408B71A89FDAD8D1442CC910462A07AAFB417DAC51D6416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097921, "uuid": "65281dbb-d53e-45ab-bdcd-0f882e9a618e", "value": "6144:uX6Tis73LM4pm/HTTWFuQsX6r9EKxYtasXsqkjelO7B5lYqAmcQeFsM:uq1bM4AnUu5ta+kClOfZWQFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097921, "uuid": "6106fcc1-4819-4291-ac9d-baead2695452", "value": 1033118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097921, "uuid": "a6498737-8f0a-47ba-954c-84f628b3318d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097921, "uuid": "7f527d15-bba0-46f7-b19a-a67b6f7af9c2", "value": "RECIBO DE PAGO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a5e80f-9207-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786069757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069757, "uuid": "ca23d2b4-2107-49b8-9f61-53543fd4ba75", "comment": "Malware payload (Mirai)", "value": "2919a523bb69bed68e3575ea4980a661", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069757, "uuid": "85b7b6cd-8cdb-450c-907b-a87bafd8dce9", "comment": "Malware payload (Mirai)", "value": "3427810ea86c988af3702d5b43dcfde93205232f5d5a567580f739b26b0fd4d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069757, "uuid": "b479adc5-1a7e-4317-a746-e96bf6e59706", "comment": "Malware payload (Mirai)", "value": "7b2d001b80b3f20f522a7d48ce648864101547d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069757, "uuid": "f6fcdf1b-b248-436a-9d16-81315cf37cdd", "comment": "Malware payload (Mirai)", "value": "10a3eede109628dc729f847f192d0a601e6e04e06f4e1bf89cba243f08e62fdf30484979cadb1539b725aaa14975a86b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069757, "uuid": "a3a29d74-a9cc-41d7-9121-0b0bb7516bce", "value": "T1FA936C89FB83E0F4DD4A05B0116BF77E8734DE125034DE5ADB98BE729C72602A51A72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069757, "uuid": "2fcbf5f8-3858-484b-8db7-8d1a369bd638", "value": "1536:IK6iz+N31yWu8ay/5uYArV7Ub310KtoIyvXT99CGaAVeNSr1:IK7zQu8z/5uYXuTIyPjVeo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786069757, "uuid": "1ab9b684-7247-4316-8159-4a317c2c7625", "value": 91080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786069757, "uuid": "f39947d4-2d4b-4e6c-afd7-923452ccad80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069757, "uuid": "227c23cb-d432-47eb-9d06-22c91625c0ae", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca56edf-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118563, "uuid": "3ab3b385-c2ac-4c55-b0e9-aae95d05d0cd", "comment": "Malware payload", "value": "f961175e3d7055befaf13bd7d6d8ccc8", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118563, "uuid": "37d898f2-2f6f-47f1-8d8d-8a85c43c5dfc", "comment": "Malware payload", "value": "36664f0225595e160bc93b3e3891cb84bcaa21fe1653e6485dea0a0bc3bed97e", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118563, "uuid": "915a9cf7-6b1f-4db7-9031-a3eb0dbebbd3", "comment": "Malware payload", "value": "d7e4be52a4f21a8f5483fbc87fa9bbf87b4fb278", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118563, "uuid": "bdc87337-d68d-4659-9355-e295c026f509", "comment": "Malware payload", "value": "26807e164e3883551302c23d9ab54894b62538ebb2b0e411d3b1561b442208e0515fe6773059a3253502f67340862c96", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118563, "uuid": "7efd4768-6fcb-4c70-babe-6fa2231e7b7e", "value": "T1DF214996B022451D94B0737A5B358733570E72D33980F1ACB1B4C89E74DF52DBA71295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118563, "uuid": "d717ee82-924a-4405-abe1-437c86d2cd40", "value": "24:wv69Vf0rY9v694LmZAjWT/cxHldLQTwsFsUk6FhfB3CAQxBtNUQ:f0M9v694LmZLkxHldqGWpyAQjIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118563, "uuid": "bef43e0a-0198-4522-a47a-dfcc8ba021fc", "value": 1181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118563, "uuid": "26632415-3038-4336-8ad4-e90e6a8f4b27", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118563, "uuid": "82df3a62-ae39-4569-be67-422279732815", "value": "tIM9CNSIu.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e299a735-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129928, "uuid": "ec5b6567-f751-4ddd-b537-863a06738c5b", "comment": "Malware payload", "value": "72aa0bad2a21171c3879093737bcf175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129928, "uuid": "bb0000cb-016b-4d12-a8a4-90e7199440f0", "comment": "Malware payload", "value": "3718225ad79a697f566149fba744e81a4bb31ad0c8637568449edb5357c2153e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129928, "uuid": "d8f1efd1-139d-4d70-8d35-c7b8cd60bf3f", "comment": "Malware payload", "value": "3546fe092b07a7dbaa27d8792a3a38d2aeb34c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129928, "uuid": "4df1e22e-3161-4ab9-9fd5-c0abdd517f6b", "comment": "Malware payload", "value": "5976faa455ce4406dd12403d99561ad79d35f11fc6d7aee31f223489dd442c630de0c05720786585f8da62f5cab85fc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129928, "uuid": "dce50eb3-58bd-4cc4-a4c8-0e821bfe3e89", "value": "T12A03E723CF65F42EE08F93B05BDF96219523B8FA133E6006A3E1FF645E45680DE95252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129928, "uuid": "5d64f21f-beaf-4c40-b2b6-291177f4856f", "value": "768:x1prBPD4oA62Ib7AAJGCfbMjgb5vNt6CgCf/amkwPrqd:9BPD4k5XJJGCYq5JgXFwPrqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129928, "uuid": "1d93343f-1496-4f20-a503-6ad48399dd83", "value": 39296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129928, "uuid": "5fdd528a-c4ad-49cd-b176-6ebd9a941a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129928, "uuid": "861bf16d-b6c9-4ad7-b97b-9ea59f93424b", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e13063-9274-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786116612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116612, "uuid": "fe95bb12-47cf-4f02-b2eb-367116b105cf", "comment": "Malware payload", "value": "44e6f71cf949e4b3f8bf34d193ac449f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116612, "uuid": "6672ae22-fa9e-4522-b422-f80c4d42fa3e", "comment": "Malware payload", "value": "38dd590230477de92aec21c75432a4df5df521c6975be04cfa66ffd1853f87a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116612, "uuid": "da11b408-89d8-44d3-aec1-a9570dc7fe9e", "comment": "Malware payload", "value": "1d4ff674b15a2af6f53602e8577bdba1f9410a31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116612, "uuid": "a0d6aa13-26be-4392-95d2-93cca4e8faf5", "comment": "Malware payload", "value": "9988665517d37a2230695ed61950588acc00f37875cb8933a4ba827816609cd88221a504e64a435da6e34de623e56c6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116612, "uuid": "193d50d6-400d-4188-8a7c-6f6d8cafe18c", "value": "T1D0462873A49154E4D2AED574C6256213BEE0389B273423CB7BD076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116612, "uuid": "2c9afd69-82f6-4321-8d86-29c402180459", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786116612, "uuid": "81b3ee5b-a601-401a-b35f-0634a9d3b97f", "value": 5373952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786116612, "uuid": "3ba6139f-5cf1-491c-bc46-91bbb818609d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116612, "uuid": "3598cced-9a35-4440-bfba-b0d01af8e43d", "value": "38dd590230477de92aec21c75432a4df5df521c6975be04cfa66ffd1853f87a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45e75f1-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097665, "uuid": "f9a44bc0-4390-452c-97d9-baae9b3d563b", "comment": "Malware payload (Formbook)", "value": "802ecb0a1c9f666dad8f95e3a294749e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097665, "uuid": "fbdea3b3-c734-4ab6-928d-f6ff18333dde", "comment": "Malware payload (Formbook)", "value": "38f6528d14eccac7905abc380c9de8b1f67766c15d2faaea8efc44d7b25c4b03", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097665, "uuid": "80f80ed2-ff42-4aa2-bcbd-44cd7a4b1a19", "comment": "Malware payload (Formbook)", "value": "10866dc1b00f4cca336b03bb7d1d2b444ba6a1f4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097665, "uuid": "6e6d58e2-6408-40b6-bd94-20e11426a68f", "comment": "Malware payload (Formbook)", "value": "a83d8ecc92a16a1c1e6d8ec224158d0aae5f79062e1e4442998a63e9ef83834b5a98fbd7b160678e154c524fe99d7919", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097665, "uuid": "ef58966a-5142-44d1-a0d1-50aba9a931b2", "value": "T150643B382DFA902971B3EE559BD47BE6EA1FB7B3370A545D0091034A0713A42EDD263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097665, "uuid": "76eddb2a-a5fc-4e39-88ac-e697ec802375", "value": "3072:Ctb0Ua7s0w+JR8nVn866yZ57kbMxuinhv9z9xIdrPAaLUVyjuyfbmZS3CG0Oyalg:PU0wN6cNFxSV2yjuyvh0Pyrrnmvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097665, "uuid": "0bfe4e02-b749-4c67-85bc-0950a9812c4c", "value": 313360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097665, "uuid": "d21127cd-ad1d-45f1-ac6b-fd05a1799ebc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097665, "uuid": "5a5121d5-ddef-445d-b505-68ef76c07a1f", "value": "SWI0020260608938FT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c44b3a-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130891, "uuid": "2ea73715-4985-4111-9296-dd5b00417646", "comment": "Malware payload (Mirai)", "value": "304607686d3f55e0beb9b4ad4d07fed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130891, "uuid": "099a3382-236b-48cd-8997-e85c4f9fba3d", "comment": "Malware payload (Mirai)", "value": "3a288b053b77e4d53e7bc2f4ba44775af457c44760b992705d9559e249d71fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130891, "uuid": "efde1e17-2b38-41c5-985c-80ee322b6176", "comment": "Malware payload (Mirai)", "value": "3f83b23a60768da67ebd10d36df97881c709a3a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130891, "uuid": "5e0cc5e6-5edc-4ae3-b935-52af2201ec3a", "comment": "Malware payload (Mirai)", "value": "2da40287cd0c83ed994ad5019517a392b3c5a93214f2067e2037b8b5ec86eede60e14ec9c7681654ab30a1240eeca994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130891, "uuid": "1c78ef93-58aa-4f30-89bf-309559b8368d", "value": "T1CE6302807B628497D3A1403A8161C3CB1FB14BB4DA4BA9DE7F33F492B5963C8606B9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130891, "uuid": "7572e1e6-59c5-4500-b590-ed26532c6920", "value": "1536:hZ76w7t4FxEF52qnnGftSNqfmsZQYvtXTdQSBZCCV1cBOY:hZ76wJCm52qnn5qeBYvNdQI9V1FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130891, "uuid": "d26bbc70-aea9-42c6-ba4e-31f467d22b88", "value": 72988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130891, "uuid": "0010cf5a-ee92-4f5c-b475-2b701c48efdc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130891, "uuid": "0558f17d-8e18-4bd8-9914-8984e335a96e", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6937f36f-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137885, "uuid": "af3a1dfc-6cf9-409d-a6f0-f6ed7d169def", "comment": "Malware payload", "value": "834f048ac141ba852bdc53501ebb73e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137885, "uuid": "668bdd26-142e-4bf0-a4b9-f5645121007e", "comment": "Malware payload", "value": "3ae5aaf19ca804193a1fc773256c7aa0369369c0141ec50251e691c9bd75decc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137885, "uuid": "ce619bfe-f52a-48f7-ab2d-df5a83780d01", "comment": "Malware payload", "value": "0957f8e8b24edbf2c93e3ac2e9894869aea22336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137885, "uuid": "bc8360a8-a73d-44cb-9866-962b3d9f27ab", "comment": "Malware payload", "value": "d5839ba0713f6707ac942239adcaee7fb332941783d0beeed47687744c6a151baf7cfa52caae53c05a0081fd32a0a5fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137885, "uuid": "677225ac-f72b-450d-bfc0-4761447040bd", "value": "T11F630A3A7711AFA9C3ACC53009F2CAE58AF51A6329E280853365DB1C6E7150D2C9FDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137885, "uuid": "3a867329-7d6a-4d07-afbc-4d101a8adb30", "value": "1536:SaD9rB93OYau0EYvv+cqVuMEdYioziTN7OiqcYglDW6fb8QnvnnXDM:Ux7Oiq9glDW63nvnTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137885, "uuid": "0abc2aff-c757-438c-96be-06ffdd5c58e4", "value": 72836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137885, "uuid": "0dfc59d8-67ce-4734-8950-d218c2dd247d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137885, "uuid": "37ef580d-7ee0-4e88-8461-14d28aa727e0", "value": "main.mips32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c976707d-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130315, "uuid": "ec22087c-9bb9-4f32-aeb5-484f04187fe9", "comment": "Malware payload (Mirai)", "value": "e12deab87ece00740e49b560be7d3cd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130315, "uuid": "9b96509d-8a24-498f-bfa4-3d13ebe16f7c", "comment": "Malware payload (Mirai)", "value": "3afa3a117915cf21b105ea9c8aae346af4f733556e6a6fe62e1352901d2b4831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130315, "uuid": "305532a0-d122-474b-8b4c-f3a1b0b2a512", "comment": "Malware payload (Mirai)", "value": "f234cb95c13d5f3f8afcc522db06892738f00479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130315, "uuid": "e68a6dc7-18a0-410a-8c11-af0a7b3c407a", "comment": "Malware payload (Mirai)", "value": "e8edc6bc2e931406055cc2532e4c668047a122bdc45531ed1c57d6f253d60d1aa903ad4f05e2366fd0192ad10e0be510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130315, "uuid": "0bb5aab9-36bb-41b9-a9ae-c543664fec89", "value": "T1ACE4E80B6E328F7DF675873047F70A249BAD23D627E1C581D2ADD5141F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130315, "uuid": "24fc3bb8-65d9-4439-8d3c-e62ee801c563", "value": "6144:sE58MyLf7xl6X3SHlW+Jj/Aeupf+qKzgztsfbHnFRKYEIxwAGeWRdhPff6AOwcDi:s+8l+oEfkbqhJf3rzb78awyqn1v2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130315, "uuid": "692fcd49-ef50-430a-a66c-bc15cf9a277c", "value": 672772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130315, "uuid": "f26c18f4-f924-4865-8170-62c7a02c6df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130315, "uuid": "79c90fe7-a9ee-4c04-b942-32b63a91994b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f35687-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786113994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113994, "uuid": "be7419a0-5cc1-4d6c-af65-dfb4cdca5d50", "comment": "Malware payload (Mirai)", "value": "520e2d0a2a2d76d26d4ffb8db82cea6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113994, "uuid": "dba2d6ed-2ea7-4b6a-83da-1c4ab210b941", "comment": "Malware payload (Mirai)", "value": "3bae4a32fee979d96dd7d2c313aabb87d589781e79a6f2d05307b77a6ea7aab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113994, "uuid": "c1ddccbe-6878-416d-a53e-5706bf653cd9", "comment": "Malware payload (Mirai)", "value": "9dd481e8bc646a3ead669eca88bbf0fdfbb5d9a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113994, "uuid": "664eaccc-c63e-4b8b-a754-4ada1f025dd5", "comment": "Malware payload (Mirai)", "value": "00970e04e5d68e1509431035f4a82c904f934ca25ac60bf2caa22bdc9cb2c146689d38b2d90bc461322dddbf7b728cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113994, "uuid": "2aeae763-ffec-44e9-8c6e-2e58b062f9ea", "value": "T1A394E0A6F7562E46C8D78635188591469B4DE49B33F383063703A9BB3C293378F6D389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113994, "uuid": "d2526662-a5bd-4115-adc4-71e26780067e", "value": "12288:0/H+cYrBl4c8FQw8QQumCy89PH8pLj/h:0vvYIbhQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113994, "uuid": "75f23d00-88f7-474c-a33b-40d7fcd9eb1d", "value": 436640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113994, "uuid": "d3560cf3-74e2-42d4-81c7-84ad12ca7d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113994, "uuid": "74e16097-6b70-41df-962c-8337cfaf15ad", "value": "xd.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4023fbbc-9219-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786077257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077257, "uuid": "f69a46a1-c6e5-4735-b5d4-ba3b964838a0", "comment": "Malware payload (Mirai)", "value": "d821ec46cd2e3eb9d9c6fa5e7574324e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077257, "uuid": "05c18b04-102d-4f5f-b83e-62d0dd2c9138", "comment": "Malware payload (Mirai)", "value": "3e38c5571de0b11bb4fa805dd6f63162d46befe27408bc545ad5445b7d88849f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077257, "uuid": "9eb9ea1a-5d04-41e7-a5be-d69bf15be3ba", "comment": "Malware payload (Mirai)", "value": "439094c8449b9cf55b53f105a188cf4889dba1f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077257, "uuid": "1efee961-7b9f-49f6-9030-2c1c2cab09c6", "comment": "Malware payload (Mirai)", "value": "d401d1d9a80233d3c6b0b475c04c2e97d13bafa9af177fde629241e610be2fa80a27e038572195807d24d27b190db867", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077257, "uuid": "b0af9b0f-ace9-49a3-91d0-04ad0f9c1485", "value": "T102C36CC5B10C7EADE5936E3CC20617176E1C9A51DC83411190B5FA47E9BB2E32E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077257, "uuid": "3ed99bd5-ff1e-4ef9-b477-070b6b2a538c", "value": "3072:7usTUAXTPZU3WD4KO7IPlotypvD4tGTQLLjyo+:SsjLZdO7IPCIvD4kTQXv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786077257, "uuid": "557ea6a3-6c71-4435-8b4a-da9cd7bf6776", "value": 125308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786077257, "uuid": "64cfd2ea-292e-4884-b576-294a317281e8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077257, "uuid": "3b081e73-1a4d-411e-ac49-8330c46a0129", "value": "3e38c5571de0b11bb4fa805dd6f63162d46befe27408bc545ad5445b7d88849f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57700ee5-925d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786106502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786106502, "uuid": "ae320b6c-159f-4101-9d99-a021ca3d6dc8", "comment": "Malware payload (Prometei)", "value": "2475ff7941e5323aa1bb774824b813e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786106502, "uuid": "5ca5257d-2c0a-4053-b51c-e05cbbecd8ac", "comment": "Malware payload (Prometei)", "value": "3e4d0280aae516e63098fe8a2ab21d480161463cc63eb2102e0cf07ad78f1e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786106502, "uuid": "803b6355-fa63-4375-b4ab-1efcb3f35d23", "comment": "Malware payload (Prometei)", "value": "90d0d0ce2df120ee00ed29e3f7e9febbc2a8e923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786106502, "uuid": "2dea1026-da06-4563-afbc-2612de87940a", "comment": "Malware payload (Prometei)", "value": "79b8216ab56da2a32f56fd0e7bf7bed91cc0013d324b7e7a6bcc33c91dd0707c244f053e1cb3beb5fc6907728b6e5642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786106502, "uuid": "8cc232be-268f-4fe4-a415-c644c695705c", "value": "T16EA423B4F9219E8F6DD769B91B24C31DE181C172689D4C2313AE95A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786106502, "uuid": "33955fa4-4e94-4158-820a-73125a83b61c", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd+:Fs6pyCC/Ya2hpi6T6N44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786106502, "uuid": "c26380c9-bcf2-4092-8580-7a00a8a8909f", "value": 449103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786106502, "uuid": "c87a11b9-9a2f-4ba0-b952-4ff231011a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786106502, "uuid": "a08c6684-4074-47bd-a117-e6d078f4d9eb", "value": "3e4d0280aae516e63098fe8a2ab21d480161463cc63eb2102e0cf07ad78f1e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaddf537-9201-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067128, "uuid": "886da8a4-34c8-4fce-96ad-b180ee1c66d5", "comment": "Malware payload (Mirai)", "value": "f390863fc6d3fe71a4311afcfd0b8926", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067128, "uuid": "03f44b6a-168d-4fe7-8fc6-d28c4f892f17", "comment": "Malware payload (Mirai)", "value": "3e54bd672c62b54255400308df61b30f508d92ccd80c097b73281bf92c04c58f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067128, "uuid": "eb409ca5-d1ff-4301-97f2-47e96352dbb5", "comment": "Malware payload (Mirai)", "value": "007023ed69e4997b368e21a1f299509b5e6d46b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067128, "uuid": "efd160d4-12a3-4ed1-b7f0-b88d76c62242", "comment": "Malware payload (Mirai)", "value": "3b19bc7bc4b2ab1492a7c9cdf2f73a59b496af97f1876d8c3595db79059528b4f70dc8c708f0ad651561d932b00ed208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067128, "uuid": "d3d7765e-617d-48ff-810d-f1484f897e13", "value": "T1C963029396B23C43E9D870FBE03687514A84F63501BACD743A74A5DA9F0D86EB0B849D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067128, "uuid": "beb33710-dd9c-431a-8e34-bfdac4958c25", "value": "768:JJ1ELbD1VyJjw3raqEYkv3MKGhfBjJfpfXIGdpaK+Yu/H/9hVupQguhWRJxf7ev+:JvELFVtdnkvKhBjJEK+z/JzguwSOQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067128, "uuid": "3e2b0002-7c17-458b-9954-7901faba2139", "value": 69760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067128, "uuid": "acb42d8b-1f3b-4eca-84c8-3e80c98a6853", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067128, "uuid": "b7eb678d-cbcb-49d7-a429-6b26bd5a20bc", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3574f0e7-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786110740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110740, "uuid": "abb94d05-87c1-43b1-8693-77432ab0db85", "comment": "Malware payload", "value": "4c35a4b7986bbf36d8b7e3df9ea694ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110740, "uuid": "59c0ab23-e2bd-4999-b7f6-f20e9ba6f186", "comment": "Malware payload", "value": "3e72d017e4872fa665484bf5cfa846b79d4af94bb2e4a64adb1952b493657d4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110740, "uuid": "1847a7b3-b69a-4377-b54e-abc1a05f2ee1", "comment": "Malware payload", "value": "4ebb62eab816cfbe4d1c0f2355fdeebb35aeb4cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110740, "uuid": "75b020d9-34a3-4f32-aca2-0f3fc55536d2", "comment": "Malware payload", "value": "bfe34bc494c86434dacd75ec6df189ff322c126e979600ba0703eeceaed4b668ff3bc89b33a64f06f645b4eb3c92b79a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110740, "uuid": "d9110bf8-3762-4a00-ac9a-97761dfeb159", "value": "T168C3C4476A16587EF0B203B115DEC6F83E23A2F792B70C16686B1DED5F13E959E060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110740, "uuid": "61ca7e53-c71b-49b5-8884-86e3c8bf8acf", "value": "1536:YOkTvttNCmu9I0OUgPf1tlXMUn5p5M/LWVgg65/T8p2UU99yvlWNOz:YOk7f5usU+7lXMhqV8Ip2UUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110740, "uuid": "c7d8dc4d-83f2-4104-b416-d583599d9839", "value": 126676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110740, "uuid": "9cf08a9d-77b2-452f-98a5-7782736fe27f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110740, "uuid": "d743b32a-558d-4419-b984-b8a91d70e22f", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee39583-926f-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786114272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786114272, "uuid": "eb8a29c8-52ae-4881-a344-5056f22a44cc", "comment": "Malware payload (LxBaseRAT)", "value": "4cc9e265970754c2c8f49bc839e486b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786114272, "uuid": "440e8f4e-28de-4917-8472-2cd3982a2111", "comment": "Malware payload (LxBaseRAT)", "value": "3e9b5fcc1f49b8b0fe84c9f78b15499ab39e16d8a353f21ef6816c8b82744656", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786114272, "uuid": "eeedbd55-be68-4140-a221-7ca0141d573f", "comment": "Malware payload (LxBaseRAT)", "value": "784b2e4130e2aa524a072620ef40d68dbcc18805", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786114272, "uuid": "19f61af7-e7d6-4910-bf96-c655819d4103", "comment": "Malware payload (LxBaseRAT)", "value": "a55ede44026cb12739c10735fb2a17927a8aa5bb6013b3b3118e8d69be576bb4a16283ccb5e23fd62d2788c49516bc82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786114272, "uuid": "cd6b4509-1602-4e2e-b961-756a2be2d1dc", "value": "T119058CA7D269CF1C8E41B9EB5F5570C3B0DC07CFCAB1C3D4A8A82426B58C859F4AC659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786114272, "uuid": "52b29bde-c1b9-4dea-b477-e7424ccc06e7", "value": "12288:xOrsbfrcrsvioUJcZaLNwsgvcwlFOUqghwBGbY4JH4QrrAZr3Jmvc:sruIvrL/gvXlvqglJJrOZmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786114272, "uuid": "0834b099-fd58-4fad-a17e-d311c05e8d14", "value": 853825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786114272, "uuid": "35932647-ee29-4c15-a0ae-1347b18356ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786114272, "uuid": "ee92faa4-0602-4eac-a420-ec5e48da7fdb", "value": "PO139046.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b945281-927b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786119313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786119313, "uuid": "1d0a1c76-edbf-40bb-9d1a-b070baf7bf1f", "comment": "Malware payload (CoinMiner)", "value": "f4b24101f0917af773057ae219396c0a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786119313, "uuid": "21db774c-90bb-4f71-8702-924b7f7cf900", "comment": "Malware payload (CoinMiner)", "value": "4050513fd2c0e7872d037adc911283a8362a5173ff1910ff5eb8890b980e7994", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786119313, "uuid": "70589eb7-bf5d-4c43-936a-b26e8f98f732", "comment": "Malware payload (CoinMiner)", "value": "cbf24d71c84ee8a087d205c43a089a276c4fc342", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786119313, "uuid": "c73cc4d5-6d0e-46ae-805a-e3600b669a6a", "comment": "Malware payload (CoinMiner)", "value": "e343c5da011218c55ad4b033249d2f9e5ec0e7d5a624ea940abdf9814a72ca6a541fae732495cee1709f2dade54cfeb5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786119313, "uuid": "57a24a2d-ab45-4e7c-8007-cfdb6be1e04d", "value": "T1ECF533C6719565D8F0138736C33FCBB1D10BB073972A09FB6643AA10BDA66C54B35E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786119313, "uuid": "9e0247ec-5f8a-431a-ae4c-a6dd801dc17e", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786119313, "uuid": "1ce4fad4-67b3-4c2b-b277-17decc65fb60", "value": "49152:RNavJ3Sd/oJ0wdxF3/NGU7PbOp0yNwvmNs7tYdtm//UNT69:R+J3SRCzVGU2WOwuNs7tiQ/mT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786119313, "uuid": "db5cf9ee-2752-4297-95e8-5eb9ed4c4a01", "value": 3447784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786119313, "uuid": "892c958e-c8ec-4fcb-80d9-f34a43809470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786119313, "uuid": "5cd25419-e626-44a2-a68f-24a558427dfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6575d5-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126267, "uuid": "cbce83b7-9c04-4927-94ba-cf152562036f", "comment": "Malware payload (SilentNet)", "value": "78d60d3a08bcb582b0ce93faf9e8000c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126267, "uuid": "1e67b13d-7de5-4610-920d-3db1a5307400", "comment": "Malware payload (SilentNet)", "value": "40b1019c2e7579b594807eaec0632d79294ff7b1c42706d2bc80a0e14a0d9126", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126267, "uuid": "461bb591-0199-4719-aeba-47e0cebd1a73", "comment": "Malware payload (SilentNet)", "value": "c055828f1c619c954949441e6203e0854f612aa4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126267, "uuid": "27d39aae-30a6-4690-9e2c-5b2c5f264363", "comment": "Malware payload (SilentNet)", "value": "b310e24a7df5536f30300c5fad494d4649754b4aac01873368afbc44d26a0fcbe3dffc6fc0c946e3df2f83d31a4a99bb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126267, "uuid": "1e80531e-8165-4928-9a03-72a7b989f282", "value": "T1E7E4C003E9D66BBBC057D33AC0958752F73A8376890DB0CFE538500A2EDD8864B96B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126267, "uuid": "52c23e56-1c77-41df-ae98-f802a63959d3", "value": "12288:Qet8RmS/JKhLmtHEzHsym9WyhTKF6n3yXUs6ns2:Qc/gKRIEi9Wqc6CX/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126267, "uuid": "d5bd48b5-f318-4a18-b136-b74a095a5ca8", "value": 719987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126267, "uuid": "cbf8af99-79f5-484c-8367-4e4d5c0c06c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126267, "uuid": "b4bc01f2-a11e-4c28-9e42-e443bfda260e", "value": "entityculling-fabric-1.8.2-mc1.21.6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bb96f2-927d-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786120139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786120139, "uuid": "33d84cc2-8519-4ad9-963b-9893212ee267", "comment": "Malware payload (RemusStealer)", "value": "65cef1e97cc1dbaa4fe794599838e434", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786120139, "uuid": "739546e2-4dd8-42f7-a256-6f6883520547", "comment": "Malware payload (RemusStealer)", "value": "4115dfac942c3e99fa356fcd89cb30ecbeb8156da57b1fb0d8c8270699b6417b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786120139, "uuid": "4431810a-5df3-4fe6-a238-2572c05bdf10", "comment": "Malware payload (RemusStealer)", "value": "4b2314b9fcae13e7c9e93ac93d08404bddea1a90", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786120139, "uuid": "5647484f-56c7-4f4c-b463-08edbb419857", "comment": "Malware payload (RemusStealer)", "value": "6caab8fae16cb68218176d50bc252b4fd2a585f14156d9fe6a052a64a8e00057ad7225171338d24488f9b1b279a5d03c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786120139, "uuid": "9ea751ca-f286-4a78-acc3-e0ecb70805a9", "value": "T149E55A13BCA249F6C1AAA73188B746567B71BC484B3233D72E90BAB82F727C05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786120139, "uuid": "1d4aa1fc-f11b-47bd-86eb-4017a068375d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786120139, "uuid": "fa0a38a9-ee03-4191-9737-03c2a820c7e4", "value": "49152:Eewz0g2zzCjq3wbIzPFbG/0tkJVlRNgCXPT/qhjBQhE/sqHOe1UEiLwQfAHK/OKc:Ei1zPFbG/0tkJVlRNgCXPT/qhjBQhE/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786120139, "uuid": "03edf312-b0b8-41b9-afcf-a9aceef64a79", "value": 3140472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786120139, "uuid": "fa1ee510-2a56-408d-a538-496a9f4e601d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786120139, "uuid": "1ae19905-384c-49df-8733-24541a7eb469", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdcf4e5-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137896, "uuid": "753da45a-a390-4f10-9bdc-603fd42fdac8", "comment": "Malware payload", "value": "8203eb6a6606da60989a9f54b2e3353c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137896, "uuid": "308952d6-9f0f-4331-a639-327e529bc065", "comment": "Malware payload", "value": "412c7713c1ea777268ce5e434c51bb467a3078e331363f3d1f6333c2f45ebbb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137896, "uuid": "5d9aa64b-f758-4bd0-9051-e1d2261f6c4a", "comment": "Malware payload", "value": "d90591a4274b3d8e8f1f13d17664f3db2cf61994", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137896, "uuid": "64c2db91-fc85-467a-8633-48239b583ee7", "comment": "Malware payload", "value": "1ce50a7c379be497e34b20743eb9ecca06d8645c4d14c1108559bc1753d646540b9a727b5dc2cfd85ceaf5eddda855a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137896, "uuid": "6df877b4-3958-4660-842d-6ab7ce8b8b69", "value": "T10463F813EE91B9BBC40B9DB4416EC29214DB6CFEA3E6523A71E4469DAF7C30705C3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137896, "uuid": "156a5155-0d18-4705-954f-07924fe27bcc", "value": "768:hPDkC1UXUPTcvJKm0oNG0K3vuZTWh5g9/TxFNSesRlwHrIiJVIJ4X5/ju:NDkCiXUPTcr+0mvuZsqbxOZRl+EiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137896, "uuid": "4864c675-77bd-46b3-b6cd-9f90e444e2d6", "value": 72836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137896, "uuid": "23cda7c1-4dd7-482a-877d-fbb541920deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137896, "uuid": "cce4651b-cd19-4508-a767-13faf97ed453", "value": "main.mips32r6el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699015e6-928f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786128007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128007, "uuid": "53482a59-a890-4f25-8c1a-413f7b82f50b", "comment": "Malware payload", "value": "707943c27faca7648380cb0206ea7714", "object_relation": "md5", "Tag": [ { "name": "asci", "colour": "#12DC7F", "exportable": true, "hide_tag": false }, { "name": "contagious-interview", "colour": "#BF7477", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128007, "uuid": "65f93165-3904-442e-9cbd-e9527081f19b", "comment": "Malware payload", "value": "416e7d7ed1d47f077b3630436bdbeaa43a669b536f6982efe54260492d4fb469", "object_relation": "sha256", "Tag": [ { "name": "asci", "colour": "#12DC7F", "exportable": true, "hide_tag": false }, { "name": "contagious-interview", "colour": "#BF7477", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128007, "uuid": "7fc949ab-3e14-47a1-b227-0514edd6054a", "comment": "Malware payload", "value": "0a8f73512f1f5f35fd10e629266b7aba5158674f", "object_relation": "sha1", "Tag": [ { "name": "asci", "colour": "#12DC7F", "exportable": true, "hide_tag": false }, { "name": "contagious-interview", "colour": "#BF7477", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128007, "uuid": "a247d18c-3374-4469-bb32-2e62644706cc", "comment": "Malware payload", "value": "d1e92ad5bda2054a6dbd7ce32b0c9f87d82eab5ed33b7f9f66a9f1626db599181cbfdede96dbce7b0aae0485647e7072", "object_relation": "sha3-384", "Tag": [ { "name": "asci", "colour": "#12DC7F", "exportable": true, "hide_tag": false }, { "name": "contagious-interview", "colour": "#BF7477", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128007, "uuid": "490aada7-a30f-4adb-a681-dd159bb4b567", "value": "T1CF71408D6EE524F80B8685FA893B28A6AE24FC963C40F483D510D8D33975F084117F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128007, "uuid": "0dae8d1e-3a70-4573-b5b6-1bfe71b49e2a", "value": "96:4aJrT2bJ1B4vvEZIbNJNu2zVmJXZepP+kp+:V1T2b36vvwIBP581ZOWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786128007, "uuid": "a41cff54-bac7-4e29-858a-7f07ca2063fa", "value": 3493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786128007, "uuid": "54932d6b-893c-45ad-9d81-c09b423159ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128007, "uuid": "c647a73a-4967-4a33-9092-dd08e6a89050", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdfbb39-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099530, "uuid": "912c3dca-5a18-4dff-abc0-ba6c4b39f52b", "comment": "Malware payload", "value": "d49df2b48027b9d0090a702f6c9dcd59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099530, "uuid": "bed50ff6-8b99-4f4f-a268-4c1171d3d55b", "comment": "Malware payload", "value": "419ff89080c8ef82c4ac20ec7d4526dcd46aec83c5b2fbe65ad3a136a4c2ccb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099530, "uuid": "e42ba098-cfc4-417b-ba41-6689a5bb2fdb", "comment": "Malware payload", "value": "2d13ea9b55959cb74e0e283ded59bea254b6c61f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099530, "uuid": "54d688ce-054c-4912-b4b9-db0572b69770", "comment": "Malware payload", "value": "7c886572c716703fd2804122efe9d650eaa26b9627161451e0ff7367963ca6c397f2b6cdace4bc8e14653233e636eec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099530, "uuid": "2367cb75-8fbc-4ed3-995d-feeaa33da106", "value": "T1D703D847631D0657C06B29F03A736BF197AEBDA202F49140521ABFC05775AF42192FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099530, "uuid": "2382464d-ab16-452c-93d2-aa1241ba3944", "value": "768:55/llNvN5R5291TqnkAT0z89VDsmNDQ+/:7/nM1Psk8nNDf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099530, "uuid": "135eb8ff-7f1f-4ef7-a486-088e269960e0", "value": 40196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099530, "uuid": "09722de2-ca62-4098-be93-8c70bfe302d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099530, "uuid": "46fdf995-5a04-4234-94cb-5e8cd2e713d6", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487445.18637.29514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c679fd2-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129649, "uuid": "4db70809-fd70-4284-9629-e4354bb4a8e4", "comment": "Malware payload (Mirai)", "value": "11b61dea9204592e990288603ebf6e5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129649, "uuid": "3bf8173b-6543-4ea5-b822-5dd8f90a53b4", "comment": "Malware payload (Mirai)", "value": "41b408e8828055a70fe5be975756d65537b689c9073d3fa71d4377fec1d4f7f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129649, "uuid": "a0bb171c-2782-40bc-bfd4-12006d5edf0a", "comment": "Malware payload (Mirai)", "value": "b9b9f7177615cbeb024b4c782d2746f4b9235702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129649, "uuid": "dbf739c3-9b41-494d-a12f-3bad53b502b2", "comment": "Malware payload (Mirai)", "value": "c62cf55864d21c3ba44c06cfca54db377662fcc6deead2f8853c633d3fcb2c76c8939f14be6bd13b93aedfa193609348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129649, "uuid": "9f348c3b-1cf3-427a-ba5f-363ead665899", "value": "T141530245A08C4951FFA6953189E9F4C82F6303BF6B2BDD9117DCBE74D98902078A2ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129649, "uuid": "4e0b1eaf-7182-45ce-84f8-1b5d0812fae4", "value": "1536:7aQ36o3uBoSI94t+1wvjjWGDn+FqZ2Ch4xDxl4u+qgw0rMw:733nAoweWjWkiqZ2Ch4xf4u+qgwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129649, "uuid": "391fe31f-3ee8-491d-872d-f13d525b259d", "value": 65348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129649, "uuid": "6deba733-48b1-4b55-b91e-0ceb71475e1b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129649, "uuid": "6218dd41-0af7-45d4-9690-312cd6669602", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcac4f49-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786131153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131153, "uuid": "e9d23e2b-6de8-41a7-87d3-287c25ba662b", "comment": "Malware payload", "value": "f3072a9ac510bcd737f8cb1627de945f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131153, "uuid": "c7a638c5-b84c-47a1-a2bd-d1e63169239f", "comment": "Malware payload", "value": "4366bdeb654f2918be1c5fbca6c71fc79eb82eafd656444cd79d4ad3fcbd9941", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131153, "uuid": "1773deaa-fce7-464c-8e22-bcc607b30359", "comment": "Malware payload", "value": "0a236ccba687a4872c7903241cca865c32a2b4ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131153, "uuid": "6f96d877-f197-49c2-b2a6-64b5ad91d35c", "comment": "Malware payload", "value": "ff8084cbb7e2a13934f265e533699d6434e5362f8ddfc847455bd9813f9fa9baccd58998bdbe91024fd8f8bc092dcb1f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131153, "uuid": "6873ac53-f047-4992-8af1-2dda509ef1dd", "value": "T1C001E3E8D8D64C327F0CDC2764080CC6F182182B00F51DD8E24D7A625F0C6A4726BB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131153, "uuid": "de48886b-bb36-4662-8445-68b910b6ab50", "value": "24:KdtD9jWijWr5jW2Fr7jN/F5haHifMDsxVewUQjjJjCmYDYXmYRY2:Kdd9jpjY5jPnjN/zACfMDqe7g13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131153, "uuid": "9f062e4a-7147-423b-a90c-0dfbf3ca3c3f", "value": 811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131153, "uuid": "1fbb260d-dd15-4aa4-98e9-46834119dca2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131153, "uuid": "dc769c3b-64bf-40bb-8110-a31036a80634", "value": "netgear", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200b0fa8-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099537, "uuid": "4d4c031a-779e-4b34-a95f-17067d90b420", "comment": "Malware payload", "value": "e7199cfc09a8a38d5f7878f71052ed7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099537, "uuid": "e960061a-2585-4a50-8da8-b07efec4ecaf", "comment": "Malware payload", "value": "4414393615a06ed5032161cf7ec7265401d215df4f3ec28397c85af14270ada7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099537, "uuid": "5a6d0ae2-b316-438f-a128-d8d0cf2ccdb7", "comment": "Malware payload", "value": "d4ed7edbcb4b03c6ed00fae49eccd54e863f2b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099537, "uuid": "e12d9daa-0b08-473c-83ec-a95bbc01e59a", "comment": "Malware payload", "value": "4f6cd59a20c2eb1516a6b2e36b5c3b133612e56c7f18f8d74061441738bee6d77155277c6194606e9942589c7e202cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099537, "uuid": "3f4bd8b1-5e62-4218-813c-5249f66f1715", "value": "T19623F9D4F844D635CBD075BAF50E83DD73030FA8E6E671119E21AA312BB79094A3B992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099537, "uuid": "25ca4cb5-2874-4a06-aa9f-800025a418d4", "value": "768:l0mUOXs2geJzHyArNPJWgc5akMWk3IXAxS3hh4gVfUGEAjikwLBt8YvS7o5:l0mUO82BJzHyArNPQ7Yk1k0Ax6KGEAOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099537, "uuid": "39f0b0c4-27a9-4ed2-8a59-08a699622f17", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099537, "uuid": "94b7014c-ddc1-480c-b4c7-cf44de3c6c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099537, "uuid": "651ec3de-f1d7-47cb-b023-39ba656338db", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487409.6776.1269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26063736-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099547, "uuid": "bcdcd2f0-f8b0-4cfb-97b5-9f6fea17c97a", "comment": "Malware payload (Mirai)", "value": "7b435361cc2cc8d7d1cd7be4ec8cc74c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099547, "uuid": "c37a28e9-6b9f-47f3-ae6a-81d3c067b8db", "comment": "Malware payload (Mirai)", "value": "443593d4ef3eec4205913ff69e2fdac703131daae4b38fb5bb9aab327a73e3b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099547, "uuid": "242e77d4-179b-44d1-81d5-b09a883db040", "comment": "Malware payload (Mirai)", "value": "3bf4d6c0df920cebac0c78089837062ccb3de8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099547, "uuid": "b043aa4d-841d-433b-8de9-a868446fe055", "comment": "Malware payload (Mirai)", "value": "e6b61842ab181a99d644d15fe66a89ca0ddf8810321b2e9eeccc0493f641e0508e2c3160d3ec5d9a01808db219882229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099547, "uuid": "9b6e52a3-618a-4422-b664-3a911222302b", "value": "T12B030A42EA519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099547, "uuid": "e7ed7f59-2872-431c-8a9d-602c0c925bca", "value": "768:yGnHfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdz/2:yGnHfD+gTFvhM74jMQ0MCiNB2YwDX/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099547, "uuid": "84eba99b-1f07-4944-b928-62de09abe1eb", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099547, "uuid": "60983a98-f86f-40b1-b889-af2da49bcd6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099547, "uuid": "045b666d-69cf-436b-904b-a8ff494cd442", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.12315.5422.2497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee045856-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080555, "uuid": "8cb93361-87bf-4cd0-9dd6-954f9249d159", "comment": "Malware payload (Mirai)", "value": "d0f1caa39f161c6b73ded0c444ded27d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080555, "uuid": "89cca4a5-a696-4bfd-89a1-788aeacf3656", "comment": "Malware payload (Mirai)", "value": "448ce36622569b98a650ed89b352bbcfef5910b5df1c156c16a9c924cdd539b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080555, "uuid": "473511b7-8e52-40ab-b464-b1de6a911031", "comment": "Malware payload (Mirai)", "value": "1dcf137cd9d6ca1eaa752ddbb4b843db02e333e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080555, "uuid": "18108837-717d-4570-b17e-05a5bb92e1cf", "comment": "Malware payload (Mirai)", "value": "3bcaabcae043ac586d63a7c9b008d4fabeb89f5ddd6f64243be833ab021292b310de48a9b413112140d409c78a909e0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080555, "uuid": "15f0260d-9cd3-473e-88cf-b7a187f89615", "value": "T12283122E6E0542E4E86B90B37FF75CCB751D08506989C6239CAC96A5F249840B3379FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080555, "uuid": "1c7918d4-a120-4155-a524-3a9d7436a765", "value": "1536:IBhBo4NWcVThyOn6CPqCwqoDm13OJaevBVz0ai1Dl2A6Zr4CD06D5:MBlkIhNnHK/6pOMyB/uAA6ZbD0U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080555, "uuid": "f9f092c8-64a3-43af-8cbb-33a93b532cea", "value": 83348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080555, "uuid": "8f99e170-618f-41a2-a455-a4b8a01e9a63", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080555, "uuid": "b056a4cb-5f37-40e8-8e33-7b044fb9d40a", "value": "448ce36622569b98a650ed89b352bbcfef5910b5df1c156c16a9c924cdd539b0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb18d80-924b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786098811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098811, "uuid": "2723f1e5-33bd-4adf-b266-e2c0bc12ad07", "comment": "Malware payload", "value": "8ad758869c26a27a6e0e4dfb1f527c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098811, "uuid": "b9b61bc4-ae13-4f11-8155-2f8b46ade3cc", "comment": "Malware payload", "value": "44a66ed32dcadbd403e2c66a5a25fd91afdb82959f15c7003724f3523d563f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098811, "uuid": "7b53819d-a384-4676-b8f0-4a7c005e99a1", "comment": "Malware payload", "value": "cf9c8e672f602753e6536905b0ef73414d46fbf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098811, "uuid": "34e66949-3cf8-431f-aec9-38fae5f3750d", "comment": "Malware payload", "value": "abf2f054dd1c13c47bcdca319b5f1ff97ea9fa270dd216a825be3b47c2afa1f85d424315ff9559e91eb3486c73056a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098811, "uuid": "6ec41e0a-c75b-4b27-87c9-260b0bda38f4", "value": "T1A1A352599BA10EBBDC6FDD3301D9060225CC514622A93FBB76B4D528F64BD0F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098811, "uuid": "fc051a5b-998c-4147-8b8f-4deefe74fcc9", "value": "1536:StXs1QbUg1BuF0+liZe0tRmuV03Y0AeQP0WkCOtzyf5aSy4hHZ4ar6iHA:SXnBcg9FkSPxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786098811, "uuid": "dc81c380-8d83-4c6d-ab8d-28ae9308ed72", "value": 102833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786098811, "uuid": "340b2bfe-dfb3-4979-b525-3e827c58212c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098811, "uuid": "f7126d0f-ecd7-41ba-b88c-e2234b7ad8cc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318f8219-923e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786093124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093124, "uuid": "033a4836-0389-4bfa-8abf-e72e1fe0ebe8", "comment": "Malware payload (Formbook)", "value": "4c89e8e3891926324195087dae487afa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093124, "uuid": "76120bf7-1156-48d0-a8f8-d8b94697f52f", "comment": "Malware payload (Formbook)", "value": "44ccb0b2c6f16f1223735532aa70d7986e3b440a45170c7015a1982748638593", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093124, "uuid": "c83456d2-40ff-42f5-84f3-1a79a42d26fd", "comment": "Malware payload (Formbook)", "value": "1518e4d7923937eb11dae9ca20ab67cc9d0d25ab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093124, "uuid": "20560705-e807-48e4-aeb7-55d61dc7c5c4", "comment": "Malware payload (Formbook)", "value": "036c1f38ead1ee9663eb3fe103ed027f9e039b97db6e0d1ab2ca84ecc30e90c8bc2a583a6a545b508fca7e71251f9a1f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093124, "uuid": "5dffaf8c-8ba8-4a6b-848c-994bd218dd34", "value": "T19CE509D337EF6A8E5A293608444D269C8F5AC4700583BAD835DE06E4A70FC6F25D4F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093124, "uuid": "6e0d08e0-c657-4262-9274-3fa6bd1a4d0c", "value": "24576:M52nIJed8vT4O1JTWPsn60W6FHfRCnbATmM:Spy8X1aQMnbATmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786093124, "uuid": "7105526b-0b35-473c-9485-9fdb1ec85509", "value": 3163454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786093124, "uuid": "7649ba50-a3a9-4d1c-b298-805dcec76dfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093124, "uuid": "b4f00b92-0c46-4baf-8360-b6b96fe3b104", "value": "Bank_Payment_Receipt_MT103pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de2d132-9277-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786117599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117599, "uuid": "dceba399-f832-4772-b1bb-a5658ed9edbe", "comment": "Malware payload", "value": "5be531bce1322cb2ccfeda55aceba7b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117599, "uuid": "89ce00fb-642a-4fdc-8607-bec26fb80711", "comment": "Malware payload", "value": "45673a6be8ea49ec58d1c264087744f5ee5b43ed13e59545d3eff27544bd9e6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117599, "uuid": "1f45161f-9fa3-4298-8015-a9a61ec30a57", "comment": "Malware payload", "value": "0832fc2b178b02bb8fecb2a961c2c69452609aa5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117599, "uuid": "118d0155-8a52-4140-8f96-61d043696d36", "comment": "Malware payload", "value": "860a5a238ee84e64e1a3182776db559630ddc1d75b37e7cfd657fa442f73a6a3ec6c0637a03acc2657e3e80afb95cead", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117599, "uuid": "b49092ce-f249-4aba-8e27-ebdc00af711b", "value": "T1CB1194E5A8D648327F095C27691C4CD7B2C1042B14F92DD4B25DAA23AE0CAB56579F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117599, "uuid": "c49cc5f7-8add-4f23-95bf-42eca7cb8b60", "value": "24:b4QtD9jWijWr5jW2Fr7jN/F5haHifMDsxVexUQjjJjCmYXmYRYCYJ:b4Qd9jpjY5jPnjN/zACfMDqe6g1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786117599, "uuid": "3cda2a70-ad71-4bbe-b2b7-7fb5a639db84", "value": 888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786117599, "uuid": "cad8dab7-c363-4bad-aa24-f4abacfa473c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117599, "uuid": "980cbc08-ede2-4a18-ba67-657e922f993a", "value": "hnap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5150b6d9-9268-11f1-bd95-42010a9c0009", "comment": "Malware payload (XenoRAT)", "timestamp": 1786111216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111216, "uuid": "45655e5b-fea3-416d-8cbb-1e0d752155c9", "comment": "Malware payload (XenoRAT)", "value": "9cf073fefffea51d7e6780b3b886f00c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111216, "uuid": "e3eeb85e-246b-4690-bd11-03cd04955df5", "comment": "Malware payload (XenoRAT)", "value": "45f245b964952e7ab59f50597ba1458ea8a3dfe42f0bc9a12696af02a810fbac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111216, "uuid": "a427d38b-2a5e-4f48-86b6-f7da12b2b884", "comment": "Malware payload (XenoRAT)", "value": "923ae59f2983bf854f2a6222083b55f5ac886cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111216, "uuid": "1f543e21-bf8e-427d-835a-1780dc08de27", "comment": "Malware payload (XenoRAT)", "value": "cf4c911711999b27abd41a32a343e2e20e0c4767729b17599536aeef111a7e154ce31ebd12fc0f1b7bab0f3371420abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111216, "uuid": "70643baf-d72c-4107-a9e4-d6982136aa29", "value": "T16923F84C57AC8923E6AF5ABD98324263C7B3E3669532E38F08CCD4E9379338554053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111216, "uuid": "613e928f-4544-410b-894c-1628580f53c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111216, "uuid": "5e2232c9-5b0c-4368-833d-51834067fd1b", "value": "768:VdhO/poiiUcjlJInBSH9Xqk5nWEZ5SbTDaluI7CPW5Q:rw+jjgn8H9XqcnW85SbT4uI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111216, "uuid": "eb236bc6-c9e0-44af-b399-3000c57a4c11", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111216, "uuid": "430a5750-654d-4392-8f69-be98008822cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111216, "uuid": "f7297fb9-c777-4300-9e53-9a3c331c082f", "value": "9CF073FEFFFEA51D7E6780B3B886F00C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3719311-92a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786135540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135540, "uuid": "e8d50378-12b5-45e5-9589-325554dc8f56", "comment": "Malware payload (CoinMiner)", "value": "2f89f9431bd97dba2fab3cd2f02d6f10", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135540, "uuid": "aff94734-ca42-4b56-bc31-6b42f0bccb8c", "comment": "Malware payload (CoinMiner)", "value": "467ed1f5cfbbb2bbb6f90f75d1b2bcd99dbeb38a65cc4bcc7bd39767a62d5676", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135540, "uuid": "7ccdb290-d049-4b9c-99cd-eadc9f4ed9ee", "comment": "Malware payload (CoinMiner)", "value": "912baf829d387831d0dd450744b5cc0d5496000d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135540, "uuid": "2aa980c6-208a-4663-9b8a-8e53e1aae100", "comment": "Malware payload (CoinMiner)", "value": "eb91e9fabe353dbe0eadd8cdc1b46a029bff4ddc9e11b3c740b979b0f2504f7c5577d6c6458ba2decec90bb4e9a23f87", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135540, "uuid": "86c0f4f0-ba35-4309-bac0-497b638efce3", "value": "T1D746339238CAC1F8E443CBB8865B757DB36E3B5249A43D5F37CD7A009D1AA18647E381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135540, "uuid": "4f73e353-9f05-4fef-997f-5df519d08645", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135540, "uuid": "7588b7fc-a88c-42b1-802e-5a8c45f37f22", "value": "98304:2LnzhCZQXR+2V88cf4E+BWG2oLehWT29vlVVKCawyLBMeIMH8o:2TzgZQXR+2V81gnBjP3yVLZ5A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135540, "uuid": "708f6d65-d3bc-4ac9-99d1-813a0d3b5da4", "value": 5351424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135540, "uuid": "120054a1-5be4-4819-86a1-8c807ffc0d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135540, "uuid": "64d83089-0ed1-450c-9505-d1fde4ecb93b", "value": "467ed1f5cfbbb2bbb6f90f75d1b2bcd99dbeb38a65cc4bcc7bd39767a62d5676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0542eba-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080559, "uuid": "77a2ac37-9f9f-4cef-a727-5d8a1193e82f", "comment": "Malware payload (Mirai)", "value": "55e63e4bc00d2957b4f58b7b61b84279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080559, "uuid": "6aa8eff0-da08-4c40-835a-8e44844a89f5", "comment": "Malware payload (Mirai)", "value": "46cc2f7d004090d35756b38ea28a5d0e62e82b3ac7758c054b48aa993c94b8ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080559, "uuid": "7130d806-9667-4f57-9c85-d9c57bb5728b", "comment": "Malware payload (Mirai)", "value": "184e1f25d7abbc0eecf787060bb017cf121c9d1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080559, "uuid": "e0ddf14f-3077-4d71-847b-79fc24a4421e", "comment": "Malware payload (Mirai)", "value": "9581062cb8a6c3e5cc01d1715a7c468326a59568e067e778c8cf05eab02e712c0f2a4fdbb19b86477e0dfc79ba260179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080559, "uuid": "6b26f339-9f22-4949-87fa-c95f6eb6bc94", "value": "T11A43024627B45E93DAB335FC9DA8C1812FCBB2FAF13771508D088A127D1621723997C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080559, "uuid": "1b4c638e-1c5f-4a0b-9dce-8071bc87cda5", "value": "768:BHAJStmAJgKqun9fggdcllI76uPaGanG9WkOQsOx/woWlSBI3U03wfo:RAJStmAJgKT9cjNG9WkOdBlwfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080559, "uuid": "f43d45d8-7b48-4ec3-a779-cf7cc155cf74", "value": 56348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080559, "uuid": "07af8669-d1ab-4ca6-817a-b0fb5665fcb9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080559, "uuid": "12a093a9-b7c0-4fd0-b0e1-a0ddca8ef9fc", "value": "46cc2f7d004090d35756b38ea28a5d0e62e82b3ac7758c054b48aa993c94b8ff.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0d5d5d-9297-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786131578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131578, "uuid": "08c9c3c4-6743-4d00-924d-5e043985ac90", "comment": "Malware payload (Mirai)", "value": "53b765a823545e4c6b6b1ae60ec431df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131578, "uuid": "2327aa11-23cf-4163-a6a9-2fc439f687ab", "comment": "Malware payload (Mirai)", "value": "47795b054489861e2e14b03793dbdbe0f6a732ba4e9dddefb922a8f9a09104c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131578, "uuid": "73cef596-8a61-4a68-93ed-2caed8613981", "comment": "Malware payload (Mirai)", "value": "35ad3e36c9ad00448a635ba4477ee1ff6f44905b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131578, "uuid": "00edc79b-6180-4ca8-b4aa-6c96efc4f3ee", "comment": "Malware payload (Mirai)", "value": "fa32cfeab1ececd012363d5bf6cfb1daebb89f45c90b9fcbb7a46d3b668f89c7986a38c00ba046c1d8498f0c3e65f2f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131578, "uuid": "db0318b1-b409-4e75-b93b-825cc20c841c", "value": "T1B2044B49BE642BFBC06FCE30052E930625DD945FE2F6B33A6278CD4C799A24859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131578, "uuid": "d30e5b18-235b-41e9-9456-5d2626022eb0", "value": "3072:ngvAZhrJCvdBk6XrsEf8SGvkciw0oh3gZiKBV1tSxg1YcAYtv1DdD:ni0hrYvLk6XIEf8SGvkciw0oh3g5V1tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131578, "uuid": "fa5a4c22-c0fa-403f-9ac9-fbb02e29fffb", "value": 181368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131578, "uuid": "12510018-f966-4f27-8a12-d77eda89a1bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131578, "uuid": "e3404798-5526-45c9-9115-d6a4a6145531", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3231959-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066766, "uuid": "2f28917f-27df-49f7-84b5-98dd3b6bd04a", "comment": "Malware payload (Mirai)", "value": "ef9e282b9917c11798dc99b9298beca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066766, "uuid": "f0d6cbe1-c7bf-46e0-b64c-598c89be0ad2", "comment": "Malware payload (Mirai)", "value": "4b7c709aba3af9f79945f21998b06e73ec951ec5a523bc038fd21d0bdecfe326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066766, "uuid": "5df04f67-ac22-4235-820e-749a45ab594a", "comment": "Malware payload (Mirai)", "value": "c0216d9bc7cd0e7f7da8a75de3baf3817676b338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066766, "uuid": "fed7d45a-4d09-4d62-86b3-b12a692a34d4", "comment": "Malware payload (Mirai)", "value": "9a59a172b2b74857269849e58c67fb063abc074d501d758f7f754d9eda37c2f42bda0908064930e55a9937fb8804323c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066766, "uuid": "b7a45a81-5f46-430b-b40a-c22b382a3f10", "value": "T17D43026B9359D1FBCA35E8B6B443638DF4B17C037602470FB53922752B5AC227F60682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066766, "uuid": "6e525078-cf61-410b-b3e5-96f297f33c29", "value": "768:oJOy7sp/RfJScbFon8/huyCxykcOQUvxDvnnhmuwxlfnSfshmjL0VUm3aLEDKJ8k:kOy74pfrm8/Xz1wDvnErfGYm0VUmGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066766, "uuid": "69b2b24b-802e-48d4-ad6e-ba21ecb37ff3", "value": 59628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066766, "uuid": "42bd6be0-ea69-40c2-b3ff-0183e1ba307d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066766, "uuid": "e50838c9-e082-45b1-92da-21eeb44474ab", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89604f14-92a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135362, "uuid": "f984efbc-0bae-4811-8c1b-f9261e2f1d6d", "comment": "Malware payload", "value": "0bd6bad16df527be7162da5bde59cd48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135362, "uuid": "16b2b2e9-0cd2-4c78-92ea-91eeb9e1c9e7", "comment": "Malware payload", "value": "4c05595080efd5b9ba7c55f1d8fba88025b4737b905119fd728b7e40c17e89a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135362, "uuid": "e0a65522-a98f-41bb-bfc3-d8345b772b1c", "comment": "Malware payload", "value": "0937c31f7d0ff7344a73b2bb073987f9b3606c91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135362, "uuid": "abace590-4123-4604-8c81-cba691db0838", "comment": "Malware payload", "value": "75954483e717ec823e4092f9a6e4d104cb485375a59793ae13c3315d304ee39d21a3ffafec10c2156778a696f22da72b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135362, "uuid": "2ff087e2-167d-4fda-9536-a374d6828fa0", "value": "T13F365AD5ED1E3841F2C7F2BDDF965BF2702BA6A4D32780F27A924548D1CDAD8C2A1520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135362, "uuid": "3b09c58a-6451-4c44-b9be-746c513b0844", "value": "98304:IB2FSpFA3Hvf+nMwX+CoM/Wdc5Gbz+2Oqb:1SGHvfpdQWdc5Gbz+2Oqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135362, "uuid": "1117987a-3cec-4d9b-94ce-64d4959916df", "value": 4958965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135362, "uuid": "173e4144-c1b6-41ef-a757-26d612a7ad84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135362, "uuid": "6d442049-0196-4359-a67d-1f9ba9dd92c9", "value": "Error84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d81b140-927f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786121115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786121115, "uuid": "3d51ef24-bb07-4960-9db4-10fce6107827", "comment": "Malware payload", "value": "e0dd647e449fc4a85ffece03c2a5312d", "object_relation": "md5", "Tag": [ { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "adws-avcstentrega-com", "colour": "#D02BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786121115, "uuid": "555e36a8-e006-4b6f-9e07-8fe419e53a0c", "comment": "Malware payload", "value": "4c0cc7a436d76943027df0515a69c3281fb981ace332a3b8897ae2faf154558b", "object_relation": "sha256", "Tag": [ { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "adws-avcstentrega-com", "colour": "#D02BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786121115, "uuid": "62828346-b5bf-48f2-9286-1368c827aee2", "comment": "Malware payload", "value": "f59501ea3c6a59eabb54ef6eb2f5e927eb4eaee5", "object_relation": "sha1", "Tag": [ { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "adws-avcstentrega-com", "colour": "#D02BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786121115, "uuid": "7ec0c054-51d3-434c-8cf9-06e92d03b555", "comment": "Malware payload", "value": "b448b24b6d5f572a37e3e1f3ab4a1aa15eb9914a7f7efda2745c7d59f1a44ed939a599bdeefc790483575d50e4f7682c", "object_relation": "sha3-384", "Tag": [ { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "adws-avcstentrega-com", "colour": "#D02BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786121115, "uuid": "415afaa7-e585-4db7-9314-d64476217c61", "value": "T17575F102BCE18432C27335305A7EE76659BD7C315BF1663F279C2A3A5E70180BB15A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786121115, "uuid": "d53a3b07-9a78-4c6e-aa26-f206f9f5861d", "value": "f5d0218de4f1718414ec3c509c2f6857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786121115, "uuid": "d26b1bfb-4d7f-4ea7-81c5-cb19fdde4133", "value": "49152:p9Mkb/+iJdR08S3Z/4KN4qfKyDTX6YvG1:p9MCzJdR0DgKiHOuYv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786121115, "uuid": "dd0df36e-f1b7-492e-8ed1-6333ee621006", "value": 1633880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786121115, "uuid": "90d250ae-db6c-4d8b-89bf-cc872cd958c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786121115, "uuid": "020b8477-e01e-4b99-a4ba-7a8e134914bf", "value": "sc.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b7de6e-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135845, "uuid": "b226c363-2994-40a7-84a6-7b3b3ab00bd1", "comment": "Malware payload", "value": "6e51e49773ab2d2f086680afda973bd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135845, "uuid": "ff0dd62d-4448-4153-b208-1921ed59a818", "comment": "Malware payload", "value": "4c88965c8181ea12c34f98eadebbf65f046ab6d428afe94048a497cf65df9bb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135845, "uuid": "a3d90600-e1eb-4ec2-b150-11e542e4b54d", "comment": "Malware payload", "value": "39770685a93845ae4ba22809428e435e709077a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135845, "uuid": "c7fd1cbd-b75a-434b-a686-cfc160108c02", "comment": "Malware payload", "value": "4c038a93a33fe329eadd3056f040147b5b0a596ba71db1d5e4e1bf2917811825830fac09b9a24db656583ec1216be026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135845, "uuid": "875e5824-ef86-4c67-992b-369ade9713da", "value": "T1E2C44BD4F2C65D7DF00219321A83DB16D6165FD2E3295BAF892947492C8CBEBCF32168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135845, "uuid": "b70657e2-7214-441c-9dab-42ce84c98056", "value": "6144:1eJZkHnXRYqvzVsF7qQCFPl0pLAlPSTgS+60tkLZOYWDG+5VQyQp3q3KIO:10o3zWs0d//+6mSZ67Qp3q3pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135845, "uuid": "97f3047e-9468-4d45-9daa-fdaf3c11a0d3", "value": 562880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135845, "uuid": "fa57b25e-81fd-4f25-913a-03e6f1b2b810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135845, "uuid": "8e4fd540-6e92-4d1e-ab2f-bdf9c1708395", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2252e6-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137888, "uuid": "c2b24d4c-4622-47b5-8c0f-a32637915ce5", "comment": "Malware payload", "value": "58b2dc6bf10924f6167a734128c25173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137888, "uuid": "fc62422c-e76e-445f-b067-c214684dc8e1", "comment": "Malware payload", "value": "4d5d94834459317b9810a6e11789106f1b7e328058bb4f238fb5746f7f290c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137888, "uuid": "5bf0cd9f-31d0-48f2-8c35-971b2c65b0de", "comment": "Malware payload", "value": "1616d1772470a526fc11f329c4604708c425c5bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137888, "uuid": "d9b98af1-9085-4227-bcd7-15b49dd8388c", "comment": "Malware payload", "value": "6233c40acdff985feff757279ea67970b62fc6fb9a8f82d14ce493fd42aecfe44474b8cd553bb20c05c88465710741f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137888, "uuid": "f2b1cce3-0d45-412b-b90f-b8414d198849", "value": "T1F0533A12B348FEF2CE903A3060C1D1B0234D1CE217C5A9E6E54CB2A57973617BAAD79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137888, "uuid": "a3fff232-703b-436a-b37c-8188db75e5a0", "value": "768:21mTkC3qj2h8iCt8X0ZCjhUI/CLoE/qYJYaoOxTBCGizoVMzvGPMzK:4mTvdhlCiX0ZEUI/jE/1JpB6Mezvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137888, "uuid": "b1bd032b-c423-4d3f-865e-90adc6405717", "value": 66336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137888, "uuid": "c85dc0fd-b89f-4952-b1fa-b1c8f4ec9791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137888, "uuid": "53da53d4-40e3-4c90-b94a-b70dc870e912", "value": "main.sh4aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9c7847-9239-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786091079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091079, "uuid": "2329c021-1208-4a95-bef1-9f177fd98ede", "comment": "Malware payload", "value": "5a1bb5d7f55f40596c1335a7728277c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091079, "uuid": "05515ca3-71cc-4e74-9f1e-45138d52b03e", "comment": "Malware payload", "value": "4e4e32f6259b82e6b932ab81172c22560ec2ac46e85543d4851637a63eaace3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091079, "uuid": "312d9781-4594-4851-87f2-7da98eaa230e", "comment": "Malware payload", "value": "02975ba8659e0843913111fcf9cce8c47bf728a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091079, "uuid": "634dace1-d7ba-4c4f-9f95-efeda84203ba", "comment": "Malware payload", "value": "1703c3c321ca554f3b667232602cfadecbc9ced520924bcbd28fedcd70532dc100e2d73fb572090d4beba6fb61336d4c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091079, "uuid": "d83963e5-fe61-44c6-9ff9-44c2f7d29fa4", "value": "T1CEF48C3283E95FD5C35D0B37B461C048AF35A5388DABFB7235226278605F34AB66ED18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091079, "uuid": "e8eb32f7-4212-4d92-835d-1c3af6ae83bf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091079, "uuid": "305b3bf4-6898-44a5-9ad3-ebdb03c05ef4", "value": "12288:b70cbVq5a5HDq2jimC/LwRe62NtljwBj7VSuzlXxC:30cZMKjnOmQsRx2N/MF7cWXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786091079, "uuid": "af6e0664-b32d-4244-87a9-2e8d465bd0ce", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786091079, "uuid": "e1b31cf6-d753-4fe9-b248-06c9aecb1b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091079, "uuid": "eb7483ee-e733-4b3e-8bb8-772b2e79f696", "value": "Vymxn_Zfbgctbp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf46a5-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135723, "uuid": "39510578-0bbc-4026-8dc5-a4f96032b5ec", "comment": "Malware payload", "value": "7a90711e78958dcac12d55a32af85b4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135723, "uuid": "2407f17b-dad8-44b3-86ef-e554c784e6a8", "comment": "Malware payload", "value": "4e8807b243df0c6a7561061f10e4f8be103a9185d07144442023b7cd4b73767b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135723, "uuid": "befaf7b5-5aac-4148-9205-a6fc9d6687ff", "comment": "Malware payload", "value": "58e08e085761a9bf36d56ad251d77156beb16f30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135723, "uuid": "0c32e8a3-4f0c-4a65-8bff-2b941045f127", "comment": "Malware payload", "value": "a6bd5b4aefcdc857be11639eed70a83babe9b1edb49ff5775deabfad8f7de538c8c8148d9644fca79daa49e307435ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135723, "uuid": "b5a54f75-4864-4b3d-bbf7-05f371b0fd13", "value": "T1CBA36C47770B2880F82202F067DDA3E03F1561DBAB361EB7586A62F77F731991D05A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135723, "uuid": "3d726a88-f67b-4815-ae4e-55546aaa63b5", "value": "1536:EpU37cBIxUGhOCgZKK8nuekvJhtvbu34jgLuUn5p5M/LW:F7pxUAJgGGJhzgahq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135723, "uuid": "0ceb1274-9017-46cb-9118-de373ff4f496", "value": 99824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135723, "uuid": "3407a8cc-31f4-4aee-88cb-3b13a9fdf657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135723, "uuid": "6e29323d-922e-49e6-b982-16ee03d6859c", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741613a5-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137903, "uuid": "3e6d0a09-4b42-422e-98cb-32bc2f62e279", "comment": "Malware payload", "value": "e675bbacc06129fd8edd3ecbeff318a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137903, "uuid": "ed6f8e2d-8e2b-4808-aca3-ab2e3846fd8f", "comment": "Malware payload", "value": "4eb8ca26a953e5d5f4bb50c7e46c2276410a9c05f17c8df0e5ae9680dee6fa9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137903, "uuid": "f319a184-17f0-4c50-96ac-6b9e23a08c56", "comment": "Malware payload", "value": "c3ce9d72b08db867b4c8b1f5d703f241af1fc4c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137903, "uuid": "16dd720b-2f8e-48a4-89f0-ea28b21d8ed1", "comment": "Malware payload", "value": "80d4445acdb0ffa00450dcf8cc387a36ad50eeaf44a3c0033bbe485496192a784db7035479b865dffeb00a73f7dde3c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137903, "uuid": "b6d2ea1c-011b-473b-a701-4dcd4271cd01", "value": "T15B63CB49EF41AA7BC09FCF34896E814B04D53DB552E8432E72E8EA8D7B7D25C4BC2944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137903, "uuid": "d767fadb-cf51-4154-aef3-884e4b991e85", "value": "768:9Sf/vc/S2m1aWl5gF5ii2oP+/rAsdpymeq55Cey4m4eMEkoS1Y:Avc/SpaW4F5iiHP+jAs2meOLyBfHk9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137903, "uuid": "4cadc082-20c5-4fc4-80d1-2e52b57ec028", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137903, "uuid": "dfea365f-c04c-4e5f-8a5b-ac9d0e044eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137903, "uuid": "d75cfa70-b7d2-4f5f-86d8-4f296591b5d0", "value": "main.mips64el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3ac71b-9298-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786131852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131852, "uuid": "0daf29ea-760a-4b75-ac87-272811493dcf", "comment": "Malware payload (Mirai)", "value": "855ba6cfae0dabfc68e2c85145fc928f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131852, "uuid": "53ca1e70-af68-4f3e-9d56-ef68844d7037", "comment": "Malware payload (Mirai)", "value": "4f91e8cc2d5ad77b010bc5db30e6e667e6e9c120f4d0b92ab80e5b71282b401c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131852, "uuid": "8a2c829b-750c-40f7-8e80-815fadc168df", "comment": "Malware payload (Mirai)", "value": "6a63b30bd7327f42e43b00cfe9c4b4bac7f19e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131852, "uuid": "66f751ae-d4f6-4467-b7de-1b82298ea3d5", "comment": "Malware payload (Mirai)", "value": "d6797d29cbc56b4e7a362ec9c6cc04be890b17584920afc7d4ed3fdeee2f8237531b27137aff150993a65960adb2535d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131852, "uuid": "c81b10f2-1ded-42b4-bb3c-897132859055", "value": "T15FE43955F8809F61C6C529B6F65D42AC73074BB9D3EB72069A144B343BEB86B0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131852, "uuid": "1e968d07-f5aa-47bc-8cfb-c2ed4a34ded4", "value": "12288:Oijanr2ZYGCCa0IjQ3M86MzJnlWEmdpgRK3vFo/qZmr68N8pqP8qOt:Oik6CCAsMTMFnlWLdGw/fmr1bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131852, "uuid": "e757f5ce-aa11-4ffd-9397-c727754254b1", "value": 669972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131852, "uuid": "8cec3050-9ae9-4062-8440-2b252eca05ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131852, "uuid": "bd8b8b97-b101-4904-af14-03e5d55f4e9b", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfaf96e-923b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786091963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091963, "uuid": "28888f25-9736-4cc2-b460-a8746289cd0d", "comment": "Malware payload (CoinMiner)", "value": "7d289e6e0baa505ca6a4852958b61139", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091963, "uuid": "272e9e01-8907-43a3-bb5d-375c1535f4ae", "comment": "Malware payload (CoinMiner)", "value": "51498477da8c0c5abf4cca3de0704a83d513c4005c2f4f3bb09fc8121e1189dc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091963, "uuid": "a05b50b3-ef92-4327-a129-f1156b82a3d5", "comment": "Malware payload (CoinMiner)", "value": "8c21a9815d0d6d82a82e00ec8c047606b0022ecc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091963, "uuid": "64e8df34-8355-41fa-9356-f8a104fd6227", "comment": "Malware payload (CoinMiner)", "value": "e80bff49dc64df93406ceaebfd61080e5f735141b7136aef2b9df007125aaed70daca8ce2dcc150b8a49caa53af239dd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091963, "uuid": "696c7027-a139-4a35-9e0a-ba4ee0df1167", "value": "T18F3633D36CDAA4B1D046C3B48617206EF3B637A1D4217C5632DE2A04DE9BE19B97E3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091963, "uuid": "ae643588-2c05-4ebd-8646-e00c764f7ea2", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091963, "uuid": "b89dff7b-ccbc-4eb5-a771-be805ce5bc0d", "value": "98304:Dd2zmvz933qESvQxle9nMMra+98I+7ZWNR9LQuIktkbHkFKE:DdNvz933qzac9MMhjGWJGulFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786091963, "uuid": "8b2cdebc-d662-44e9-8187-71a9906fd0e3", "value": 5260800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786091963, "uuid": "19860b49-7aee-415b-9fe2-6bf701b1a1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091963, "uuid": "cc1ecbc7-c0be-47eb-b756-ef76e12b0558", "value": "51498477da8c0c5abf4cca3de0704a83d513c4005c2f4f3bb09fc8121e1189dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2814cc36-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099550, "uuid": "621780e5-1edd-42fa-b9d2-56e53d174dbc", "comment": "Malware payload (Mirai)", "value": "389db7c0903cd2e1bd946beeb5449232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099550, "uuid": "d8debe54-76c4-4d55-b1b2-d0d2c783a143", "comment": "Malware payload (Mirai)", "value": "515fdbb6d03d39b69901dd7f23ba17918331bf5fef763d807d6f13adc6a7a80b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099550, "uuid": "77892221-c556-4258-b788-f7cfda6b7d8b", "comment": "Malware payload (Mirai)", "value": "b3bfb05c69d50da4523c225b1727acd3683c7643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099550, "uuid": "8f88e01b-7eb9-44ba-b03a-e8a8785c7b09", "comment": "Malware payload (Mirai)", "value": "2a63fbd8708daf730fc14f700988c65b94e877c5340f4979e009234cf15be8447df950ee0e61ceab261092f54ac28b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099550, "uuid": "0766bb7d-3322-4f74-ae43-1286c8faab6b", "value": "T1A9030A42EA519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099550, "uuid": "84dd2357-835d-4946-aeca-bd7637f54ad5", "value": "768:yGnpfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdzo2:yGnpfD+gTFvhM74jMQ0MCiNB2YwDXo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099550, "uuid": "65218fa8-e5f9-4f8f-80c5-53c2c8cf8bb5", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099550, "uuid": "6aaf25a2-ead6-4472-898e-e878780b13fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099550, "uuid": "cbca9620-88b9-45f7-b06b-4f9203a27ec8", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.12318.27744.11549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afee9f45-9233-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786088611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088611, "uuid": "b6a36f07-c1da-4eff-87b9-ba69d6d84eff", "comment": "Malware payload (Mirai)", "value": "f626dcdbaafa4e6b625a426c649138a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088611, "uuid": "3523150e-6901-422c-97e1-a7a0922b7bd7", "comment": "Malware payload (Mirai)", "value": "51e25237d9b05007d1687a8a1687507579300fef256adfbf1aeecb18d8f8ec4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088611, "uuid": "16cfb5f3-5048-4476-84ec-11fb0e9862e0", "comment": "Malware payload (Mirai)", "value": "9b38ebdc21d127c87a9cd938c7b2b865d56b8d58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088611, "uuid": "6ca67b2d-58bf-48db-b246-9e4445ab2727", "comment": "Malware payload (Mirai)", "value": "a135ebf670bc0fd7731ab7ae6ab18119659f4caa6721ac2224c5b2691da0ce8850943bdf929b60f0455188c3bbab5897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088611, "uuid": "67bd838b-e458-4263-beea-6ca7d630729a", "value": "T15AE35C82FA87D2F1E95315B0001BA71F8B349D368124DF1AFBA42E71EC76706856B67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088611, "uuid": "7a22703f-1651-4ee4-828f-6d9325023285", "value": "3072:JJd/ixHHLzH+EHe4GuWaJe4nx77HbGc6B4cxQvxQ8qah/T7Il4:JJdqhX1rTWaE4ncQvb7vIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786088611, "uuid": "af44f7fc-2d8a-47c4-946b-2e47b5fd0f20", "value": 148808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786088611, "uuid": "7bd28ca0-d7a1-4f17-87fc-c94c940f527a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088611, "uuid": "ec18d4c3-81a5-4128-885a-96e0d60c40f9", "value": "disconnectraw.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ace592-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786110738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110738, "uuid": "8c68f85e-8736-4bec-a3fb-e4eb5f48dcf4", "comment": "Malware payload", "value": "6946a2a5cfa2dab6d5f799c1c94734bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110738, "uuid": "da6d6ad2-d6a0-45d3-acf5-8830c8afad9f", "comment": "Malware payload", "value": "52e097c58cd59934fdec2621bbba372032c80c82537e1e03874f18fee6517f98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110738, "uuid": "2b9a2d67-dbca-4200-90a0-0612d178dc20", "comment": "Malware payload", "value": "d6d1838130d43b148cd4a2abbe0faa9b84be98f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110738, "uuid": "1a64937a-7c5c-42bd-8f23-62f5b0d82f70", "comment": "Malware payload", "value": "3190c2478ed37d341646d30778016655725f28db3cdd26aece60b74be8d0e494c3b6f7255cbc9dfc3d676f336b7e027f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110738, "uuid": "c99903e2-8dce-48dc-9418-46cd2d5ba8ca", "value": "T1CF318E9E08144A311103DA9F73623558BA8EE3EB2C8FD7D4D94D0EEA92897CCF161B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110738, "uuid": "a45d31da-b5dc-4599-9a9c-e1b35e3a6f8b", "value": "24:/Bh40ISv37hVreXtqrJyK1v+61yLDl8DnBgAGf0QPjn:/Bhj7hVr71v+68V2BgAG8QPjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110738, "uuid": "6860b211-933a-494d-ad1d-c898dc2f630c", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110738, "uuid": "06a80027-129b-42d5-9793-f01746ae7e37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110738, "uuid": "4ce77875-6b4d-4557-826a-f0f42a9085a5", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a6e71a-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137899, "uuid": "aa85f379-1073-436d-9305-b47bbbd15331", "comment": "Malware payload", "value": "e22b9d67637ab422225c59aab92f0e7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137899, "uuid": "b13e8b91-e0cd-4f42-9b4a-bb9ef1e12dcb", "comment": "Malware payload", "value": "52eed4374640ea0926abcd5fd3723f47476225ecda14f6b2d9659ec5ff06b374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137899, "uuid": "14083024-c842-4a1c-9a61-26936d8ee665", "comment": "Malware payload", "value": "556d0056c3bb5a441905f5d644391c805427cf9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137899, "uuid": "1aae75d3-6843-40e7-8146-9e854f49b763", "comment": "Malware payload", "value": "ea7e8b9210f3b8f5297f70bb01717745a51b9f8e467cc191c62efa5d79f1a30945f0717f0684117e44b5c2ff990de5d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137899, "uuid": "5136029b-d051-4198-a813-5a6e3f8cfbe7", "value": "T1BE231981FA53C1B4E19382F008A7C7EA9634CE37505BE6EAEB4D3921FD317018D9666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137899, "uuid": "f7a58532-12c2-49ad-b3fb-c4b428074673", "value": "768:BPLC+X5txkB4zS5QnGMFAg96B/cEGylxPZyuSSgXvcIT:BPLfX5tCwS5QnOgU0yV4cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137899, "uuid": "9db559f0-c317-4c5c-9388-e07ace7ecb8f", "value": 45860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137899, "uuid": "5c7f4479-a43c-4971-abe6-aef30cfbb2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137899, "uuid": "ab946832-df2e-4d8a-b6ff-15c309342a6f", "value": "main.x86-core2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff88a99a-9219-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786077578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077578, "uuid": "10bdfd9d-168a-4617-9956-4acc690865ef", "comment": "Malware payload (Mirai)", "value": "a0efacfd828b4d938b67e8fc663aa924", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077578, "uuid": "0d73f464-9beb-4033-ba54-d87059122b4a", "comment": "Malware payload (Mirai)", "value": "53d4b22a89cdef88fe9df507a4d8a09867e4fea1847bced3ead6dd6bddcdd778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077578, "uuid": "3decbce2-1c8b-42df-99ba-116f72fe0302", "comment": "Malware payload (Mirai)", "value": "b690a7c0c2f259b4e535bdaf088b51cdeb806dbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786077578, "uuid": "904e2af5-fb9f-41ab-a115-82f92c00d560", "comment": "Malware payload (Mirai)", "value": "d3d75e68f32b4981493f2384a0ee231c5a392bd0a63c4992b4535155557c4643b78d9e131da591896c44aa733efa3044", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077578, "uuid": "5a333fc1-a717-47cc-9e2f-aff6e0682600", "value": "T1FCC32AA9F890DE52C6C52676FB4E418C33231778D3DE7105CE249E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077578, "uuid": "1cc2c0c3-a97b-438c-9634-8e4dc2362749", "value": "3072:L+tC/Hvx/9eY24fUpoIiacYEEU5/cMWNNwhik6IwPnONvF3Q0uzf1Dl:L3fhx0ovacYEEU5/cMWbwD5wPYA/z95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786077578, "uuid": "b40dc329-3cc2-41f7-b457-5f64196f2e13", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786077578, "uuid": "b8255472-11fc-47bf-8018-217d08c145f8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786077578, "uuid": "227080dc-b306-4973-b78e-d4c9e751a045", "value": "17ef78b562169b88449396a87d732cae1f23d4fa98255c499a951e688642534e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b2ae9-9282-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786122433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122433, "uuid": "0d787c9a-6724-4634-880a-0aa64d92fde1", "comment": "Malware payload", "value": "eff03caf0d6bf380421dccc32af93c52", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122433, "uuid": "fb4f8be5-63fa-4d2e-bd9f-19e20e29f757", "comment": "Malware payload", "value": "5483f928b33e4ad3cbb016f04f0feb0a9429570071cc93393a800b9faf85eddb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122433, "uuid": "acbfe179-564e-4f1e-a09c-ab55227d4c55", "comment": "Malware payload", "value": "9688ceb0dc4d89ee627563beb5e5b03bac44fadf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122433, "uuid": "e004c5ed-b5ca-471f-b6b0-751026297401", "comment": "Malware payload", "value": "8d47a692442188a4988b876f06194b3729bdd628dfb3c498937a41445ab25a48cc32c1701519636d97c78301655ad7c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122433, "uuid": "eebbbdae-ada7-4bff-afd9-10771a4babd9", "value": "T1C1C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D4B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122433, "uuid": "bf6722ad-41e1-46c4-90a7-fec834f3ef06", "value": "768:X8Oi8vCB+25j6es8R99FYpMSUpi+20qUpi+20YQX:X8V8l25Jrd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786122433, "uuid": "3597ff42-f007-4c4f-9fc9-f2d7fff4dc7f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786122433, "uuid": "efcc6c18-1443-4eae-92f3-0c1d3014c150", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122433, "uuid": "3058318e-fba5-43ce-aa8a-a8db28e86555", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8624c75-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786133266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133266, "uuid": "3dcb4706-49c1-4cab-ba03-b0ecfb9a93ba", "comment": "Malware payload (Mirai)", "value": "86c49422d7b3ed2598c50899485536fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133266, "uuid": "546b5a47-a172-47f0-bf9a-d1b1a35f074d", "comment": "Malware payload (Mirai)", "value": "54c38e4fcde2afc3b93bad341ca08dd475f47eb7a0843aa979e030831f251061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133266, "uuid": "43ea7baf-27fb-436a-9de3-e185d780c7c1", "comment": "Malware payload (Mirai)", "value": "b3ec8b38b32fd8054bd4206cd424c9e8694395a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133266, "uuid": "70eae00e-f9d0-423e-91c5-f337abf13256", "comment": "Malware payload (Mirai)", "value": "54a96fa44335c757c4804a30d4e1b6b17f8bb69ee361c9da6c710fdcde852644696bdeda0d514f060acf803223421fa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133266, "uuid": "5341e42f-6567-4526-b1e7-0ae6e1a29980", "value": "T135C329A9F890DE52C6C52676FB4E418C33231778D3DA7105CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133266, "uuid": "26b7361a-02ed-4d78-ae61-c7d46a9c7c49", "value": "3072:Is3MwjVxhyC400VIUccYEEUQPOMWG6NwhQBmBkPLfHNwFCmluGf1Dl:I7K4VlccYEEUQPOMWGswwkkPLmV0G95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133266, "uuid": "86a9cd07-596c-42b9-8040-a06c856fb42e", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133266, "uuid": "013c6864-deb2-4b82-9baf-9cce526f67d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133266, "uuid": "6a60cb95-fbe6-404d-a1b8-2c5a0b00bda8", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dac98e-9276-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786117458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117458, "uuid": "793c0007-d832-4eb0-ae3d-08b9e2fd54e0", "comment": "Malware payload", "value": "0930be6385735022876dc185dfc10531", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117458, "uuid": "8de31c69-a089-4f9e-abf1-56cf02ba1793", "comment": "Malware payload", "value": "55555e947e261ba604d11975dced1e7db63adf6e1f36b65aec5bb0de45cc7ed7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117458, "uuid": "6ca1fb41-794c-4121-86e4-846521fdf271", "comment": "Malware payload", "value": "6189cf4804ed47fa650d2f8f8514bc5c4dfa6aca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117458, "uuid": "2b4d8765-24d4-49f2-8388-f79f97a24f7b", "comment": "Malware payload", "value": "39e2c46ad31f78a713b5d0c209a3945e3c1803f2426c5eb3c88aa655b1a8cdb9e7044ac8d1d0565d5cd795b4a35d9b97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117458, "uuid": "73d8e6e3-b514-46e2-8157-ce129143155a", "value": "T1DB21CB193E8374A44333D06A34EE30D2CB885270EB9479743C261B949801ACA2C7EA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117458, "uuid": "6ed649a2-9d74-492a-9c1b-cfceb8004bfb", "value": "24:UGxVEb81iVnONd/4Lrykec0yVdykUkqWTOVju+kqVqQWsDL:UGwCUvHykvykUkqoL+kRD0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786117458, "uuid": "1b454d6a-478a-44b8-9656-99331cd1f6b2", "value": 1113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786117458, "uuid": "f3cb5cc8-c1e7-470e-9b8f-c49660eadb71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117458, "uuid": "04df9205-4e98-4342-9151-221d848ae1d6", "value": "mac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb97cbe-9208-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786070114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070114, "uuid": "22010bbb-06a9-415c-8b71-cfadd812d9df", "comment": "Malware payload (Mirai)", "value": "c6dd1518b5abf4ba5f46d2bb31f87ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070114, "uuid": "bff51138-b2e1-4725-98d5-3c99dabdffbf", "comment": "Malware payload (Mirai)", "value": "555d862a10163c0da85fa24a58ec2caf5cf76d9ec0a4cb21983cec216fddedbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070114, "uuid": "a7824b34-25f4-4740-9945-bc0eb6536d6a", "comment": "Malware payload (Mirai)", "value": "aadc374b7c088aff4a53de3347f32fb1a3cb9186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070114, "uuid": "8796d44a-c8a9-4610-8f2d-999c8c9d4a56", "comment": "Malware payload (Mirai)", "value": "0b44cfa8ebcb72cbd028c826d02ceb17ee73947c5601892209d8e054355874bb3c8ae21d2cc2e62e5603a332050cda54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070114, "uuid": "0682a75a-de58-4800-8498-f7d0afc5661b", "value": "T12CF318C7F900DAB6F80AE3374853040AB130B7A208925A777257357FED7E199157BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070114, "uuid": "b6e1b73a-d73b-4353-8089-bdbbc8ea34bd", "value": "3072:4uNV09jAc97rorU9MyFa/v8yFLTPnbhJwqwX2VzjbifLhFHIVP6P:NNV0txf43yFcv8yFHPvNwXpLX86P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786070114, "uuid": "90564546-4615-4354-9366-c639b9f6d41d", "value": 170840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786070114, "uuid": "a0b38909-da17-488f-9190-38f27fc625f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070114, "uuid": "1a6ac295-f1dc-4892-8acd-947d3714b96b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbee37a-922c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786085551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085551, "uuid": "6d75bd1c-b049-43ca-8efb-215f38d1527f", "comment": "Malware payload (RemusStealer)", "value": "dc5235041961a6f4de3d35e1a13a1b93", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085551, "uuid": "4db06165-d85a-42db-a2b7-80f5cb0b5159", "comment": "Malware payload (RemusStealer)", "value": "55fd126063af89eb1c5639a56dcf365f2e817813a45758b3f12a18f12d5561d1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085551, "uuid": "3cc7e50b-dae8-4c5e-8427-d637579390e8", "comment": "Malware payload (RemusStealer)", "value": "011d0f62705b791f0931356d0fcfb30079c546b7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085551, "uuid": "152b3a3a-504d-4138-aa70-c1b902a39d7e", "comment": "Malware payload (RemusStealer)", "value": "80d734f7703606fc81b7dc55cd499726dd51a688ce7d57a8608f439e34a61e0e7684eda610e283029e184d704ef47ab4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085551, "uuid": "8764dc4b-b867-440a-b4fd-921caebb367a", "value": "T187F54A07ACA149F5C0D9A73188B79292B775B8085B3623D72EA0AFB82F733D05E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085551, "uuid": "bea8f647-d102-45d3-b668-d8602f088e41", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085551, "uuid": "b891de3a-ee53-4325-81b8-ca09e464da28", "value": "24576:nvbPESRqa39hPQq7qzs2wM5qnA2K/H6QTLHg0lMY6rC3nHWvv/oBele5I92widf1:nvbREs4qes2xcnUFTLkY6PdLZ2xW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786085551, "uuid": "ba9ec204-aaa9-4bd6-9fc1-d2193229d4f2", "value": 3511152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786085551, "uuid": "3962b3df-01c8-44d6-8721-9f5f23cf75d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085551, "uuid": "7ab6ab24-94d5-4d91-909d-26f5776e698d", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4e2095-9221-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080876, "uuid": "7d7005c1-1e26-4f4d-9a8b-685531a48f57", "comment": "Malware payload (Mirai)", "value": "ce8f7fe62bf34f3d701d241d5bed5df2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080876, "uuid": "50d90076-690e-491d-83aa-bdb6b8316711", "comment": "Malware payload (Mirai)", "value": "567669f7d57bdaaa0041ad01afeaf6e3c28ebef9816e3a4ff29da6eb03c91223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080876, "uuid": "a83a8a6c-1998-456f-b49d-a5f63839da7e", "comment": "Malware payload (Mirai)", "value": "f85dbc744dc5f656362fed322dbb4794d345e291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080876, "uuid": "fb28b528-eb2c-4335-856e-1897ce29d4ef", "comment": "Malware payload (Mirai)", "value": "4e974c1695c10d0b250ce51894a96266fea7694670d8658c656e7c7f1eface11665bd0c6263eea37beff747396a33411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080876, "uuid": "6aa40656-9712-452d-ac6a-41ff4b9a850b", "value": "T189C32AA9F890DE52C6C52676FB4E418C33231778D3DE7105CE249E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080876, "uuid": "d094cf90-6e15-4d1f-a1ea-48e2c18a0d47", "value": "3072:L+tC/Hvx/9eY24fUpoIiacYEEU5/cMWNNwhik6IwPnONvF3Q0uyf1Dl:L3fhx0ovacYEEU5/cMWbwD5wPYA/y95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080876, "uuid": "67254bdc-bf8f-4fa7-bf20-4815436b7937", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080876, "uuid": "312cea4c-972b-46d8-becc-c28c2afb17c8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080876, "uuid": "ea9582da-4697-4cbc-ade3-8bc7db6bc9bd", "value": "adb6cb8832d0e0980ec41ad725cfb3182e7ed6603ac085494be0bcb954ef08d5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799de5cf-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137912, "uuid": "28c0a8dd-79ae-4e99-86c2-7b6f30a7891d", "comment": "Malware payload", "value": "e167840827da4d204e88a20da0d28554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137912, "uuid": "4a9e5ae2-0643-45cf-99f4-c05c5cf58510", "comment": "Malware payload", "value": "56d359239b3a9cb3c88ada62cfbb61d0b114f425ce4fbbffefb680918bbcaf50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137912, "uuid": "874db510-cbce-49b1-b299-4725083c187d", "comment": "Malware payload", "value": "38fa62b116d96182a1f07a0d703901c4c6442ca4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137912, "uuid": "4514d07e-27dc-43c6-a355-b54f8d3cc223", "comment": "Malware payload", "value": "77e0011454dec814d71fa3918d749b5930ef7923ad084067e4b2e71504780f38711783446dc1fd2c2073bfd8a55dba41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137912, "uuid": "48d5d1ff-69c0-49ae-bdc6-2f273ca503ab", "value": "T14E531A23FB0C0467D8936DB81E3F0BE683159D5220FE901575096EAE1736F31A647BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137912, "uuid": "fb1f5daf-b43f-4b48-981c-2c206ef34de9", "value": "768:wDA96Go5/2GpUWTGLShvLvxDFkZmKjrIISHa/5iI3nnr29Hwc+rSKiq:wDA96GypUW6LQv4mKjEIwjknr2Wc+rDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137912, "uuid": "11bf0bca-6066-443c-b1a4-3d8b1114cb14", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137912, "uuid": "44119855-7f8b-45c8-b9a1-4049a54b0eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137912, "uuid": "70881e1e-6315-453e-af26-4df952ab6432", "value": "main.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edd3d92-926b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786112554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112554, "uuid": "276f9057-ff3a-473c-b1f0-ea2f779c2ca7", "comment": "Malware payload (Mirai)", "value": "c1632a2a143b59e0fe8236425102aeb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112554, "uuid": "f8106479-709e-4571-b203-fc4dc37f3e56", "comment": "Malware payload (Mirai)", "value": "579d0c0d2b975ed5f2c25618161e3986b8462f490d7f6a7e742ec7e9bbc4a572", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112554, "uuid": "247648c1-1602-4786-a117-ab193de31654", "comment": "Malware payload (Mirai)", "value": "4374306064167f3812d25bf2996b47a5ceb177a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112554, "uuid": "1f5586fa-7d70-438d-a945-761c64269a09", "comment": "Malware payload (Mirai)", "value": "96721707b32b7c675f4b1fb77ff7d25b4143ef9dcbeddce0020b54abe66a0a2c8b67ec09c4bb9497956c14eddce6809e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112554, "uuid": "362972b7-6dfd-4e3b-af9b-e02b205a3220", "value": "T141B4DFA3FAB06ED5C0120A7018FAD3340745F39113872A51F6FE85542C8BA767EAEB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112554, "uuid": "787c70a5-c446-4af4-bb73-a5b6cc2738c8", "value": "12288:fakbKo1K2u/wZsf0HbMalu2+pTWdYqlIDD+7HN08pOyA3:D+oIEc07nByT8lCa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786112554, "uuid": "5c5d4e59-b936-4142-a7b8-99a5ea62e7f1", "value": 529104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786112554, "uuid": "902d6b17-8772-41b5-888e-1dbd706dfbd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112554, "uuid": "a6ebfec9-980b-4629-8626-eb0d71ca7f3a", "value": "xd.superh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd784f89-91ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066408, "uuid": "ff1ba3fe-39f9-4b09-b854-be3a11e9378a", "comment": "Malware payload (Mirai)", "value": "f9090b20001e218c9537d60618fad407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066408, "uuid": "8c0c3834-581f-4fc1-a9f7-a43f384f2b8d", "comment": "Malware payload (Mirai)", "value": "59361ef6ce36865765e3f07506b99dd55373a8b31e2011b0f77c0d0ad9439126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066408, "uuid": "7b5569fa-a675-4a48-b188-a3a7cf705652", "comment": "Malware payload (Mirai)", "value": "802b14d268938cd9dcff28545861bf717a62781e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066408, "uuid": "23065a6c-1a02-4a1d-a8a9-f6cb16dac28b", "comment": "Malware payload (Mirai)", "value": "f798099ff91b27eda647a27c925aba57f6af4b4d013fed06ad9f49d14eff367fb4f75bcc0e51ce784c6a1ae3c608117f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066408, "uuid": "0ac548d4-b9b6-486f-90db-160522dd2980", "value": "T1349302229303B96BD63ECCBB97F517E16DF508351A747A113AF6DFB51A90EE49C00980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066408, "uuid": "0c9476da-10b5-4130-b7e8-a355216a48ec", "value": "1536:VB357QiG505OB1sJt24fmRX3OhCJqBNIC5/vyM1zTqYPhi+dOKpAFSbTIZHVEWf:jxus6XH3qBOCPzT/P0qmwPkHVE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066408, "uuid": "ec29bdf1-c40e-4e00-86a8-04d1c6d1c977", "value": 93532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066408, "uuid": "6926787f-369e-445a-b6b1-2c3e9beb5076", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066408, "uuid": "25fe6651-cb71-47a5-a31c-3707a6cc35cc", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a3b7ab-925b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786105512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786105512, "uuid": "8adb283f-16c8-44d3-92af-ff946b075447", "comment": "Malware payload (Mirai)", "value": "757a5851edc61c18d43129c2ba122534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786105512, "uuid": "14d6045b-c006-4b5a-b25f-299c31c49a63", "comment": "Malware payload (Mirai)", "value": "593e250c04a957ec6a260557e8e956cf9b2765614371f0e4d2af55f515e290a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786105512, "uuid": "def0f3ca-7285-4999-a737-1a373907b926", "comment": "Malware payload (Mirai)", "value": "553d9e85c13e418c09868c628b6d241aba5f4a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786105512, "uuid": "08451911-fba5-4690-a9bb-abeb629f0555", "comment": "Malware payload (Mirai)", "value": "c721ab4e0a302a1345955e74f1e3c4910fa5be4b1d3e53c620531663be5c7357153268f489e9bc60f2161b58e47018cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786105512, "uuid": "ce084800-875f-452f-be1e-54a095dd1a09", "value": "T18AE30855F990DE52C6D12A7AFB8E428D332307B4C3DA7102DD205F2977EB99A0B3E941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786105512, "uuid": "8042f5cc-ba10-4287-9a9b-1f329d623529", "value": "3072:jiXvN2V7JvhZX2aHVPgRoLmEEOSQ08Rgx7Vn8Kf:jGV2Vdv/XBHpLmEEOSQ08WZn8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786105512, "uuid": "8bf5c10f-9d84-41f2-8fca-38d76a24b12d", "value": 157248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786105512, "uuid": "9113df42-b044-483a-887b-9959ea684d35", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786105512, "uuid": "7115ab61-a08e-402b-8686-f9e41c6959c5", "value": "593e250c04a957ec6a260557e8e956cf9b2765614371f0e4d2af55f515e290a4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c8ac64-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786113992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113992, "uuid": "9d8334a5-6955-4af1-af4d-5fd608ab47d7", "comment": "Malware payload", "value": "e8f3d2ad5931ffbe3b9a7dd7008489fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113992, "uuid": "e3284b88-ed28-427c-9f25-8bc8aa5d92b9", "comment": "Malware payload", "value": "5981fa7d94135c8b7bdee873e0ae39c4239a10cce34d70222821ff4a9724a5d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113992, "uuid": "3b4d36fe-0871-47f0-8d1c-e3a3dc7a835b", "comment": "Malware payload", "value": "622c7e4decf0087e33138a006a42974b25f67218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113992, "uuid": "918b616a-60c5-4526-a6e3-f95979300c77", "comment": "Malware payload", "value": "72b1e280882cf8071576edf4a6ad7b29881a69df1dd85e787742dab13ea36088707d607849e91f3a08ad29a0cccbaf0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113992, "uuid": "dad451b4-6fdb-4cd5-b5b4-5bb80ed33cc8", "value": "T1EB833B0AFB93E1F0D94606B1111FFB7DC635EE225024DE5AEF947D72AD12A02925B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113992, "uuid": "fce5a4ed-1288-4ea1-b474-2c9bdba3ba7d", "value": "1536:Tw1BTLVHw4FZx6Rg+c3Ra/ofDQZV7JU/310vntiZvnwl7/4qA:yZ5FZxic3A/ofDMWClS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113992, "uuid": "ee88544f-7a9d-4121-bb31-093f11cdf2c6", "value": 87335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113992, "uuid": "743bc751-965f-48e7-a054-fd6707218efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113992, "uuid": "e86fb5ac-388f-4fe6-834a-74be39b5f010", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b302100e-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133714, "uuid": "11ee0d1f-ff56-4881-9a1a-25b40c755a9c", "comment": "Malware payload", "value": "a4b3b2fa6c6624e7343bf5d4223dd5c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133714, "uuid": "4d41c77b-df52-45b2-a2bc-b6f17cc21149", "comment": "Malware payload", "value": "59caa54df4e941f1fa20795b58cc02420c9e4400ba44a178614d330d5bfca79b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133714, "uuid": "da8427d0-48b8-469f-9f73-f63b12c02f25", "comment": "Malware payload", "value": "14c61c80c0e0609074cbaacb27c50c94d6808e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133714, "uuid": "058f39f4-a451-4848-9865-267aa950483c", "comment": "Malware payload", "value": "5b0fb6cf1c6883fb01f8d9c4b8d7c745a17b4b7f3202c6932ff8a037ad4c9b45ff3dfd83692a3119eeb4b3096c116c79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133714, "uuid": "ba8a8ca0-c75f-4aa4-8683-1d414323105f", "value": "T1A4C3C4476A16187EF0B203B115DEC6F83E23A2F792B70C16686B1DED5F13E959E060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133714, "uuid": "922fc16f-6fd1-4b3d-a22a-538ee5256ad2", "value": "1536:wakivttNCmu9I0OU7Pf1tlXMUn5p5M/LWVG65/T8p2UU99yvlWNOz:wakCf5usU77lXMhqVZIp2UUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133714, "uuid": "7e5a883d-ee4f-4aad-ba30-c51b88097907", "value": 126676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133714, "uuid": "1c93145c-3cd6-4f9b-9a3f-39c5147ef9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133714, "uuid": "1b21f266-d367-475e-8b2d-e2ca2263541b", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed55ad2a-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135959, "uuid": "036545c5-c719-4bb5-8738-ee50dfe3b95e", "comment": "Malware payload", "value": "d0bf4392f0b6c2efc7eab197b6392665", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135959, "uuid": "e4b5d899-e6a1-411b-9e2f-b1b0bf25a3c4", "comment": "Malware payload", "value": "59dbc8aa281e432de685e318cc8e3f318eb58bfc122063c1ab74cfd8d5732f18", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135959, "uuid": "d5114fa2-0b9c-41d9-a857-aea1254c9b08", "comment": "Malware payload", "value": "1ce03cfff28d4350b1b63e6b2caa290ecd3bb5c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135959, "uuid": "73cf789e-e740-4da5-9f92-26011230a45a", "comment": "Malware payload", "value": "7921c355285508a22a1935d65a85943995a30b785abce9b3a5980e15fd56d9a59aa11e64b9a45b15206221025db9f418", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135959, "uuid": "b143b875-fb63-4bcc-81a1-0ba42e3694dc", "value": "T1D81194D9A8D64C317F095C2765184CD7B281142B00F51DE5B25DAA236E0C6B96679F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135959, "uuid": "fdfb95e1-a61f-46d6-9ab8-3a8136ccd2a2", "value": "24:qh/tD9jWijWr5jW2Fr7jN/F5haHifMDsxVexUQjjJjCmYDYXmYRYE:qh/d9jpjY5jPnjN/zACfMDqe6g1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135959, "uuid": "bb458abb-5985-41ce-a161-7373e0063422", "value": 888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135959, "uuid": "47ee84b5-dda6-44bf-8f14-53d401d59d8c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135959, "uuid": "bbf76b8b-9d2e-46de-b86c-b1e3130f1bd4", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553035be-9224-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786082017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082017, "uuid": "dee46de7-22a2-46bc-b9e8-3005f2abaa36", "comment": "Malware payload", "value": "feaab80e40c5c6a53b55d92555485679", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082017, "uuid": "8ef98646-683c-4e90-98f5-a75d260b0f6c", "comment": "Malware payload", "value": "5a145920b162b6fee3429e2201c03fb8b3a8bc703d13bcac4d21166a05bbe708", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082017, "uuid": "6b34dbf7-1756-4fc7-8707-1d92de5285d9", "comment": "Malware payload", "value": "034cf562362350985a85bc77c41a4faeb0ed7262", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082017, "uuid": "4537ab42-bb51-4a1a-8025-f4b2e09304c3", "comment": "Malware payload", "value": "50e7907b94df2a6b8688f5dc45d6db5a61625ba6b9f642592f1ab669fac2e87584460060fef9ce6bf89d880141c38073", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082017, "uuid": "a6f269c3-7b09-44d4-acc7-677c5941b7fe", "value": "T1F4818783B4095696D5B78CC00997361BF091A27342F5AD74BF8D84D00F3D36AE3B44A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082017, "uuid": "b524f2b7-596f-4006-bd42-24f93b9d84f8", "value": "96:1yL9A7elvD0MEwULVh9Z0Grh0DLcy0jhAuD/Elif/4/qd:gL32MT6cchDD/zf/4/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786082017, "uuid": "0c96d094-13e3-41ca-a4a6-35c38bcd182a", "value": 4195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786082017, "uuid": "77d9d569-c2d2-4b2e-9f03-524ad25dc54e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082017, "uuid": "6f400105-eb01-4771-9398-3f6db902d033", "value": "white_notepad_rcdata.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21f3eb9-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1786097688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097688, "uuid": "1c5f2984-d0f5-4b7d-a9c2-854161c06931", "comment": "Malware payload (DonutLoader)", "value": "64ca379d04f00e6775fc039a2a86418c", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097688, "uuid": "6802d405-98c2-4413-bb29-9aeef98b7c93", "comment": "Malware payload (DonutLoader)", "value": "5a78ed88bda581548fd4ec5cd17d8d9f50bc9e7367404f487d92e28d50b28e90", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097688, "uuid": "600975be-e74e-480f-9acf-4451fbb0bebd", "comment": "Malware payload (DonutLoader)", "value": "25bcde2af11ea5ab4caa3f57c2ccc9d82a3a7528", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097688, "uuid": "cceec510-6105-4797-99d6-74a454ba77fd", "comment": "Malware payload (DonutLoader)", "value": "5a7ba3b07df20db3a386b9856ce6378d22509b6d8f183934b8c0a59b8ae1086be4ecdee7511b2c2587d452c8fff6b1f9", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097688, "uuid": "a6389658-b04f-42d0-8a60-0aea7ddf129d", "value": "T150462C08C075F02B98CFDB4DD87695A05CCE387A9A0CAAAE702F913D1C68F5786155EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097688, "uuid": "1038c784-91d8-48e6-aeaf-b56106fe5f91", "value": "98304:lNd1XtXow4ToxXNy8O6HqSFDvfYp1SEpQkMnj:9f4boc6HqwQXSEpQkMnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097688, "uuid": "1936b5ed-115f-475e-b88f-a679c7a61e6b", "value": 5691879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097688, "uuid": "6964abdc-6c6f-4129-9026-9172cb0b9e82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097688, "uuid": "fe71dd92-6632-499b-aa56-0cf6c6fb46fb", "value": "SOA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be9267a-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130185, "uuid": "746e1e22-81ad-4686-820a-b416b6f8f535", "comment": "Malware payload (Mirai)", "value": "64661837f00803e4854f570447502072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130185, "uuid": "dc0c2a0d-019b-4283-b560-dff664fa2ac7", "comment": "Malware payload (Mirai)", "value": "5a9e76c9183462a3c624fa47b9e7478b571d65e214595f29c0ae7a8473d74624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130185, "uuid": "5eae7b67-5521-4833-b28a-fe6ac917b688", "comment": "Malware payload (Mirai)", "value": "f0ae562580f74e9601ff39a1cbea7de470df5bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130185, "uuid": "9d7a642d-adde-4f63-b1de-f32692a249e3", "comment": "Malware payload (Mirai)", "value": "932784c6e00210b11b9cca9f2dadeebb0be93e1335f95a32f5650557ce0afc69cb7e8cae0352103c7d4c0b36c4b48a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130185, "uuid": "c81be3e7-0ad5-475a-b54e-40036c7875f2", "value": "T17F8312BB5F7A9D0DFC4B2065AC6162483E607B1F972D35268486C45D20FF9C88A28F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130185, "uuid": "2e2f75af-324a-467b-836c-91387e64d6d7", "value": "1536:1+xYJcDHvuJDgXLVARD0/MHGcMSC1t1064Frirb6dR5jS2pxoeQva:1+xqcDmoWDnJMVyJRIbIw2pga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130185, "uuid": "b56a7fbb-07ed-4ef0-89bb-8e1aaea37a46", "value": 84412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130185, "uuid": "ece36e35-3dd0-4788-ae4a-c294634d1b24", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130185, "uuid": "81310e66-a1a2-45f9-ab4e-1ca6ae9e0d48", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac05456-9276-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786117459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117459, "uuid": "25d33976-c3f7-4d7d-aede-1922f666130f", "comment": "Malware payload", "value": "c41c175ff8e2d6de1bda6f5c6d58d5f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117459, "uuid": "557db4be-c6a8-4e63-8aa7-ddcd888032cc", "comment": "Malware payload", "value": "5b94367e705b0f56543a37959cf1014d517d6ab34aac1ae82566d557e9439e63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117459, "uuid": "4f0a59e9-946c-463f-9d0a-bcbf90035096", "comment": "Malware payload", "value": "006cf0d13bcfffbf880d91435efaea9e82fc7c9c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117459, "uuid": "a3afaca8-dbec-4190-b3f7-96c72ea0778b", "comment": "Malware payload", "value": "cf7bb9e1cefa99685a8c2af4ae68b3f60a90d73a589829d7481b0d9934f095bf30db7804adbddc9888d44c944aa3bab6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117459, "uuid": "69691be4-16fc-4820-8cbb-c127fdd95a4e", "value": "T1A4E07D8AEB433D20D123E10F13C5644A27AC11703AEC407DA4476BF608B44C734F9F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117459, "uuid": "606a4f7b-1a19-4391-95a7-3845d6576b9a", "value": "6:8qLCDcKeGzQ6N+Icjt1cIDNxEkuwAWRxfE+zzcIDNxEPXkYcIDNxEPL:8q07U6NJ+t1TeWjV3Ti5TiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786117459, "uuid": "57d0938b-7e2e-4ac5-b075-5ba1a431c3ac", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786117459, "uuid": "5217e3e6-5720-48d8-9044-77ce8c4e5dcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117459, "uuid": "4e84ca7b-4695-4ed2-9fcf-7b3157af599e", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11949272-9230-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786087057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087057, "uuid": "6b465787-7047-4038-9b71-c75e975a64aa", "comment": "Malware payload (Mirai)", "value": "1f0543479e34bf9ce4620298eb7086dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087057, "uuid": "a397cdc8-788e-40cc-8715-33f1c9ef5ea5", "comment": "Malware payload (Mirai)", "value": "5c177c68e47e508593a608f755a2ce23e832fefa3ff4f504ad906592f03e9529", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087057, "uuid": "4841664c-aa89-452e-9dc2-a9ad71156d31", "comment": "Malware payload (Mirai)", "value": "21303496a33107b2b69bdd1dde790926a5671a32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087057, "uuid": "502020dc-a6cc-493b-bd3f-91360b2687b5", "comment": "Malware payload (Mirai)", "value": "2072fe95f4f7f2ab8cc6c52a85a0b7ba0277a15d916a9639387044dcbd06d8dc550bceeef2d15b9fc0fb17fb0cd11c96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087057, "uuid": "fec63cec-5675-40d4-9cf2-4918d0f13730", "value": "T142F37F98DA1FAD42DAC7E7BCAD694F6230373CB40264C1F31A10616DD5ABDD588E2532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087057, "uuid": "32190792-dc5a-4157-8335-d990554ab345", "value": "3072:xKshe3nfuA9R6qHsjmxn5Gm0GMG5zA4VkbkuumLKY:8rnft9MqMqx5Gm0GMAA4kduMKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786087057, "uuid": "46d354d4-441a-4d1a-8047-e0f6b614df6f", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786087057, "uuid": "96b0ea9e-5cf4-4a2b-8129-aa6b49e29c9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087057, "uuid": "859d2f8a-7ca3-4c6e-99a8-73479a62fcb3", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff478ea7-9297-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786131694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131694, "uuid": "acfc8ddd-b7f0-4e26-8640-c66ef9a1ac9b", "comment": "Malware payload", "value": "01d6c69bc5f14e6bc39c5677fa385ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131694, "uuid": "276b6d8b-fd5c-4b4a-9a64-7955d60a0575", "comment": "Malware payload", "value": "5c6354961179b40badc8d8c667db798ea97524af5498aba78e8ca35883146d3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131694, "uuid": "88188ed9-6a5a-44b2-9c48-048d5052cc2d", "comment": "Malware payload", "value": "db40db2755b8cfb34ab79d9484262a28a1ab0848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131694, "uuid": "036736df-24ef-4169-b988-64d7a2cd114a", "comment": "Malware payload", "value": "59646fe2d2681c0eed01a6e52995f902c0ac86b467dca6aa79eb9a83e5acec4ab535cf379a3c82e3e70fed95c0bde544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131694, "uuid": "e8e36512-351b-44c2-8bd5-763175e5f051", "value": "T12C03F981F286C573C80A953567BAD715374379DB2E72A20098B5EADDFB674C0AEB0433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131694, "uuid": "5ebba892-8623-4146-92c7-e18450366988", "value": "768:HiEvNt50ssGL+8770Ut2R5x2rn/w6F3TyD3hK3wf3MIAffP14d5AdSptv63uF:Hjk2rTkpMICadSw6eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131694, "uuid": "7954e2cd-6c37-4750-86c3-ddbab1c625ed", "value": 40328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131694, "uuid": "5d038849-da46-4842-a551-8c8b87dd5cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131694, "uuid": "2f51410e-801f-4447-ba92-e0dfc591b797", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c36d17-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786096006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096006, "uuid": "814c00bd-197d-40a7-bf67-b5cacc504c60", "comment": "Malware payload", "value": "21d0170d64be9f25afacf9a7e2c696bc", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096006, "uuid": "1ed83eb4-efcc-4310-b9f3-7463e457e9b6", "comment": "Malware payload", "value": "5c6b94f0b8eea8d97c7d5e12c89c8a17a26d679578a79e10687dda3804d5a870", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096006, "uuid": "6d13ca29-ab64-4ef6-a929-09be6e4479ea", "comment": "Malware payload", "value": "8ae31d7eadb1f138f5d32c69ccbb4b04f2a214c7", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096006, "uuid": "0b366b6f-a3d7-4781-949c-e330b7afce8d", "comment": "Malware payload", "value": "f1e00a6e02ea7dce9f2bff7cecb654277a2d27b5db9aa64aba4d0d9870cd5205c871e90f46c7652b28bd0bc1a8f6e33e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096006, "uuid": "813da4c1-a927-40fd-9715-cf04ec66740c", "value": "T1B205131CFB1694ACCB2B657CC10817D2DC4A59568442B84E1EC4BB443E9A0FBDF8E6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096006, "uuid": "cfeb47d0-284d-4719-a783-a46463c54f92", "value": "12288:YMlMDadzn89+xamtgnZ+xTru0nTlOvch2wacCbPYLuNTiVQJbyvvtffl3caU23X8:BJ5nXMZi/n5Ovch6pJGB9MaUYXe8wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096006, "uuid": "f0065756-8692-48b3-be6e-1d72539425a2", "value": 849368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096006, "uuid": "a044d753-54bd-4880-b062-9f6f0b68af5c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096006, "uuid": "d953385f-2069-43c4-95ba-d8463f507d84", "value": "R.E-LOECHES CAMBIO DE VALVULAS PTK30.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252a055d-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099545, "uuid": "4e50f21c-ee7a-476c-8aa2-f96dc88d5694", "comment": "Malware payload", "value": "76bf55ad8e876ac0f860d5911d026eeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099545, "uuid": "1185a5a6-c44d-4bb3-b80a-4c3f89f71e66", "comment": "Malware payload", "value": "5c85291479ce8389b266bd5e4a8c8ac2f2ee663ef57cb382c4618fb73a97cadf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099545, "uuid": "50711fd6-36b0-4ca1-85c0-19e9ccc37444", "comment": "Malware payload", "value": "b417525703615017b4442cdb1b62a53cdb4925fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099545, "uuid": "ee5806d3-cd01-42fa-903c-83623650775b", "comment": "Malware payload", "value": "b2e294dac92dbe15aa9409371e73d508230b5328dfd4834af2bdcf59aa7bf5ac7a90f39edd98a5712652394e86773366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099545, "uuid": "249fa407-3b1f-4c8a-abf4-7470255c131c", "value": "T11343462A6E22EFFEE56E823007F39E70975635E237A18240E26CC7085F7025D585F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099545, "uuid": "b5e164ab-aabe-4518-97ff-2ce4bf8b1a08", "value": "1536:UpXs5RFU4YwUNZXqWTzBnY9tdNGuAvxdsyE9Y9afq:Sv0yE9YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099545, "uuid": "d5f0a203-60da-4168-b4ee-93aaee9d49eb", "value": 59164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099545, "uuid": "d313ad05-d802-4d03-bfa0-6f8e25a69dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099545, "uuid": "3b6b58f8-de26-40ac-b8fb-201aa439a8d9", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487434.11330.517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e504cb19-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786097720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097720, "uuid": "b280b9a8-460b-4814-a1e8-7a85270e63d1", "comment": "Malware payload (LxBaseRAT)", "value": "75dbe1ee36ba35cb4b76d2ac7e18cfa2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097720, "uuid": "7ac96675-035f-40d8-bc16-ef25a2167783", "comment": "Malware payload (LxBaseRAT)", "value": "5ce1e12c368f37ad5a2d221acdc0b6158c896ad6e0666e4026622b4d92155e09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097720, "uuid": "83e3e29b-7139-4b7d-9b29-72a93345db1b", "comment": "Malware payload (LxBaseRAT)", "value": "64e67b5579438899ad592ef8f85d933eaba0d27d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097720, "uuid": "3f2d35a2-975b-41dd-b303-a339ec58371b", "comment": "Malware payload (LxBaseRAT)", "value": "0dd5f57ea41a3db6e089bc363b647d446c9baa51ef39006001ab345179afea99dd3087c20164dafd75cda78e7403fdaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097720, "uuid": "05054cfb-b75a-40da-8dff-d217e980d2c5", "value": "T181059E05F8688C3C059BEFDF274E7DBBB28AC2974C1F4097015844EA2553B97A5B2D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097720, "uuid": "4bd31f46-2a95-45d7-9b43-98ab919fa96b", "value": "24576:wmZUpK3IxVqCAwwBJvxRljwYUajx9Dk5fM6rw8+72k41Grj:RZXYTGhJvFUYUajx9DkOfrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097720, "uuid": "f9ecfe8f-8809-4379-bad9-34bd3bbc2010", "value": 834461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097720, "uuid": "318c7c75-9cd3-43fd-b39e-8483d4d7d50c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097720, "uuid": "8c6b6a32-95db-4b21-966d-05c29dc2f206", "value": "List_980045211317082026_Fugasa_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7577187-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786097724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097724, "uuid": "68926ce2-d66c-4a64-b5af-abfc3ea6b26a", "comment": "Malware payload (VIPKeylogger)", "value": "2fc5dddf808b0447b6d430e2fc629080", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097724, "uuid": "384ae59f-739b-4720-a909-35e6737ce24d", "comment": "Malware payload (VIPKeylogger)", "value": "5d5cd70cf760b62aa3eb044cd0e9d0a9d70bedf9c277fc26eced2915a18087f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097724, "uuid": "8d26c500-1c24-41d0-8e03-7060a6409b7a", "comment": "Malware payload (VIPKeylogger)", "value": "0366e214048220e35f437cd56568fe57b2d3c318", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097724, "uuid": "cc85a913-8a35-465b-8c74-d4f7a8e8e0f3", "comment": "Malware payload (VIPKeylogger)", "value": "68953847edeaf4f0a8269bab8ae53c8e2b93850a5b9f09c740a58db9164cea170f67dd4da381b1355c0ca88f7496f277", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097724, "uuid": "a0d3efde-05de-41be-baf2-1650d8d02249", "value": "T159058D9A9033DF3AD80879AC3B331993B7DC5536CF55AA609A8DDDBD10D846C39B09B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097724, "uuid": "971aa0bb-e5d0-46bc-801c-9d7bdd1b0ab9", "value": "24576:v0gngT90w4YVLHRlUYn0XmGyIzER9s4fj512B5hycRF:vohIYvVr7R9s6jIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097724, "uuid": "2534f611-feb8-4231-8506-048d17e29b7d", "value": 834231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097724, "uuid": "d8048bf6-faca-4a31-a710-4ac40c4eb427", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097724, "uuid": "e41883ff-f157-46ce-be84-214ff5c74e56", "value": "ALPHA WEB BANKING _ \u0391\u03c0\u03cc\u03b4\u03b5\u03b9\u03be\u03b7 \u03a3\u03c5\u03bd\u03b1\u03bb\u03bb\u03b1\u03b3\u03ae\u03c2..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078e1213-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786097778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097778, "uuid": "96fd78d1-4863-4017-8f62-6d167a2f7c7e", "comment": "Malware payload (VIPKeylogger)", "value": "c2c958ab331a4e9094b4ce7353db1cd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097778, "uuid": "7d8dd6df-d3b8-445f-8fa1-123cb5dc51b6", "comment": "Malware payload (VIPKeylogger)", "value": "5d9709d9df3105a401b0ba476bc582951883dfd0da0cdfef2bc7070a451ef29d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097778, "uuid": "e9a5b2a0-4353-471d-9e43-51071f09d193", "comment": "Malware payload (VIPKeylogger)", "value": "3db714c0885a04446c6e90ae7cd9d185a0406fa4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097778, "uuid": "6df91c32-3733-45cd-a47d-d3dc09d6dce5", "comment": "Malware payload (VIPKeylogger)", "value": "ec50e3b89ea54a9e69b7b43135418d1b9d810e774ef5397c3f4f2fcee123ab5aa3b1998eeb7184fa7a50f9889cfaf21b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097778, "uuid": "d36f6967-ffdf-4296-8cb3-1053b333e752", "value": "T19B05A06083AC813B6DE82143123B57D2E3679115D8A8BC71E1BAE1B6B79FC01DDFAD50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097778, "uuid": "29ddc722-953e-40ea-a4a1-3fccd6d21152", "value": "24576:nfZeh6URbY/hd/JH+pm6FmkoAtYpK1kMMHmwQ1Ej5DyZPX0weC:ngO/YpmlwkR0Eja0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097778, "uuid": "baba81d3-84a2-40f2-932a-11097b1c4cb9", "value": 848071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097778, "uuid": "1218194e-6142-4779-87e5-9c008f0461c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097778, "uuid": "76746bc8-27f8-4ad1-9a12-1845a325ad5b", "value": "Purchase Inquiry ( Prices )_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c82c6f-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786113995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113995, "uuid": "64f54e58-fac6-4b38-b22a-4a371469b378", "comment": "Malware payload", "value": "7e1d19daa4e0b123d294cb376923f519", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113995, "uuid": "801e0da2-463d-4aea-9eb8-7902f70fbe4d", "comment": "Malware payload", "value": "5df9b0d93dc7e3f3b485cb7b8522df1cb8e6654f1f8c9e719e0ba34af3dfb67e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113995, "uuid": "4aff10bb-3655-4975-9b30-a68e4f2a0c6e", "comment": "Malware payload", "value": "e3e84e7ecc207ff35fa99186942088ee34e0774d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113995, "uuid": "393e379e-b588-4c53-8739-0c44b3ea9448", "comment": "Malware payload", "value": "cf169453ef91c833c65756c4251b03be1e199003475607f2e9a81a75a2ca8caefda52372a3ff48b147b216a9ecc38c57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113995, "uuid": "91fe3c9b-9ef2-4e65-b1b8-6df24e10723a", "value": "T1ADC28D966A967C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113995, "uuid": "609ab357-8926-469a-98ec-1c6252ca44f8", "value": "768:j8vCB+25j6es8Ro9FYpMSUpi+20qUpi+20YQX:j8l25J+d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113995, "uuid": "e2de37c5-24aa-4b36-a0e9-fe150d2601a2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113995, "uuid": "e4e10361-f6ae-40c9-b879-96b128d2b574", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113995, "uuid": "6d7d0920-a46d-4ff4-a52c-069894781863", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39b630d-929e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786134681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134681, "uuid": "ec14c48c-a26f-4a61-b732-5766785dd71a", "comment": "Malware payload", "value": "9dde7125d9efe6899fcd683289a73aa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134681, "uuid": "115cd806-df41-430c-8b1c-fe7baffed8a7", "comment": "Malware payload", "value": "5efd3f43074c5bb7b180da4993b5db062bdd099be08b29b8a3d9d2e847fc6fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134681, "uuid": "57d5722a-3b96-46d8-af6b-aacedc1b25ae", "comment": "Malware payload", "value": "22a8ff8c28dc9b8b7ae55d86a8435d01bbfb7199", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134681, "uuid": "46f5e8cc-e96d-4216-8436-3eac640cc24e", "comment": "Malware payload", "value": "acff49a71e031f440c8752ff1763df20b618850ad7eaa2568fa19ede4105619fe1b542d5b2a6a3d7def73b6c99463950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134681, "uuid": "0ac9beaf-68cb-415b-8260-f9b98aec7a56", "value": "T14323F9D4F844D635CBD075FAF50E83DD73030FA8E6E671119E21AA312BB79094A3B992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134681, "uuid": "cf555d26-1aaf-4239-bbae-76af92e1dab2", "value": "768:l0m5OXs2geJzHyArNPJWgc5akMWk3IXAxS3hh4gVfUGEAjikwLBt8YvS7o5:l0m5O82BJzHyArNPQ7Yk1k0Ax6KGEAOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786134681, "uuid": "4fba917c-8371-4a79-aaa8-47902b6e6816", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786134681, "uuid": "8b123740-4333-4c68-b09d-f4885fdb1fef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134681, "uuid": "649c9b34-ea7a-415d-b0fd-e6c3114d0a9d", "value": "main.armebv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d31e40-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118575, "uuid": "efd0c04b-1ecc-4b35-a8a7-d47c0ab67cd2", "comment": "Malware payload", "value": "283fd50cb6372ffe68acafb33dc29cad", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118575, "uuid": "eaed5946-90ee-434b-baab-0f7b05864cdf", "comment": "Malware payload", "value": "5fa116e699f23e230c6c17a47d499feae725069ec5186196df24a7346e0f77f5", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118575, "uuid": "239135f5-3eb9-4ff7-8924-6f1b7425fecc", "comment": "Malware payload", "value": "69ddf331e79555e556ae446ecf2407b4ace15156", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118575, "uuid": "5c9a5b5b-9196-4117-9235-9f1c92cf3859", "comment": "Malware payload", "value": "152c3baf48f1e5cce087396ec41cb5ffc9d6e0ba1475c46c260f46fd8183f4e81745f268102d1697ba6006df16fd4468", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118575, "uuid": "828ea179-0fa3-4323-9536-a7ca790bf449", "value": "T16E46F77137E45D2AE35E0C7491A3D53512F1E51BB624CB9713C8AAFF2E23B019910BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118575, "uuid": "e7b37636-d604-4c1a-afa0-21b637c6977e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118575, "uuid": "7af595dc-9105-4054-9201-2ca2bde0ac8e", "value": "49152:Kc03+z0+x9SWaD0/C5XowAzFPMGTqfeDStqiVAloN7:KGzZxBf6ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118575, "uuid": "2f96f524-8f95-42ee-83a2-820d0678d34c", "value": 5662208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118575, "uuid": "1b03154f-7e6d-4c0d-9914-2bc9d9b60e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118575, "uuid": "ae59c172-8d93-4720-9eb1-aa904cdc6159", "value": "loader_stage3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020322e2-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097339, "uuid": "6b830c90-ded7-4198-9163-a9cc914c5157", "comment": "Malware payload", "value": "dd6a9e48e92cc863fad7d019f28af900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097339, "uuid": "46edd44e-9f4c-4b42-be7e-ee2344deca3f", "comment": "Malware payload", "value": "5ff9064cedfad0ca1c7dddd455808c706e3903855718953f5ce33e1c92af165b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097339, "uuid": "f5147bc1-ce70-44eb-979c-6fdc53c99081", "comment": "Malware payload", "value": "bbdd3c46cb6ab645390fc35ba4cdd8e694b3da7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097339, "uuid": "ea2e3392-3b02-478d-b14b-c5d7c089bd97", "comment": "Malware payload", "value": "455b9ba1b63cbde3e1f3b0976fd8fab0ce96ba77523358fcc4fdf869417ab3f9f2d6da295c8a882444ef6543354ce90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097339, "uuid": "170d27db-e75f-4c78-afec-7670ada43e0f", "value": "T134D523C668F515B5D87BC7B2CF43E86DB16A3B994A158CABF6CC65001F222842D37372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097339, "uuid": "49d26476-34f1-4fb3-998c-cc7c9de0e022", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097339, "uuid": "78a1d1c2-04a7-47a5-a568-fd264ffbab4e", "value": "49152:G8KrnnB4H+DxpbZbK5ymx2imu3NnWEKBPL0eKOIMs3VXLs3HhI:cnJbIys2cNeBD0tMuVY3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097339, "uuid": "89e3260b-bb93-4c09-8249-db694cba5be4", "value": 2927104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097339, "uuid": "fd1044cc-33d1-4eea-9e01-4ebddc18bd80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097339, "uuid": "2df86b3a-6d63-455a-b712-144c3f6364e6", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f72991c-92bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786146754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786146754, "uuid": "9cc700e3-01af-4ea6-b0a1-a7885d67e92d", "comment": "Malware payload", "value": "e964a5e37ad3c1c0478ff13ac5b32c65", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786146754, "uuid": "95bc947b-6fd5-4b4a-a9be-d0edd01e9243", "comment": "Malware payload", "value": "604540e8f61d04ed0bde2678ace8d1d9a43461e0a2b8533d371891d6bf4089a2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786146754, "uuid": "9462a0a6-271a-419c-8c5c-6341282ba1d5", "comment": "Malware payload", "value": "53f5dc9f1f5b05d38f927b11145a4fb93351324b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786146754, "uuid": "743fa979-08bc-4b09-82f3-3eb1906de8ea", "comment": "Malware payload", "value": "b7b32079c7b4e6b59b000fe887789f3f75cd6d5fdef4a1a9fa7145613e2cf8b5f926507e3918a7d549a13792dfe64415", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786146754, "uuid": "fac6e63d-301d-494e-93ec-3de0f5d0da7c", "value": "T198E6336C6A9022FFFAB3503CECD24278967874A85371CD9B07D857A56E531E0C93C7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786146754, "uuid": "fb25fc64-9249-425a-9b5a-8d85153580c5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786146754, "uuid": "736faff9-9a2c-4907-9b92-0ec03eb5721e", "value": "393216:4YGmy0DB/d4cBls/PregDxXMCHWUjvcuI3/PGTAI:ZGwQnlxXMb8kH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786146754, "uuid": "44795828-0b0a-4863-b228-365c9a006353", "value": 14264078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786146754, "uuid": "8630d128-d340-4595-9f6a-dcb87786bcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786146754, "uuid": "b066ae35-2494-4b6d-902c-52029de69c92", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadd2e55-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130264, "uuid": "71c1644b-4e92-4ca0-b412-af1b574cfafa", "comment": "Malware payload (Mirai)", "value": "215ee0d58e09a614ca921e7736eed300", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130264, "uuid": "7c33faf1-c55a-43c9-a0fb-0348f27b0c76", "comment": "Malware payload (Mirai)", "value": "613653f1239aad42b142b4d8c99e000330ad7b9fa3f9c224821299f4fa2e4b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130264, "uuid": "85c6a1ea-33fd-4b10-bfbc-37897b583a06", "comment": "Malware payload (Mirai)", "value": "89331956107b804c83aecd7da0795c31afbc5d14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130264, "uuid": "7a344bcb-e701-48ad-9f09-948e2ef7b57c", "comment": "Malware payload (Mirai)", "value": "ea4b96f28e0d40460d7dcb14836201c62f4b33ed0ae27670a2c8a218c3d3cbfda301fc63cce46a46b02a3e6db626a5e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130264, "uuid": "c2566ba3-f5fb-4a74-abb9-c64f39ee144a", "value": "T10D042A5F7720CF61C729C53009B3CB4656E926522AE19889F31CDE08BE64349B96FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130264, "uuid": "8259f9e9-91a3-4753-8cd3-ae3400eb9c48", "value": "3072:kvYC54+WIwP8M5EOb9GcPUzgqMLZw1DUEqDd82+/il1D4jek:uvSUy2ifxviiT6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130264, "uuid": "e11a5341-325b-4207-839c-eca37b72c5d9", "value": 185240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130264, "uuid": "4e5df323-66ca-43a5-86d7-45a569972358", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130264, "uuid": "306dd5f0-18b9-49e4-8b6e-fff748d5618e", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05b1573-9245-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786096343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096343, "uuid": "0407063a-2271-4160-ad3a-63ea26201d22", "comment": "Malware payload (SalatStealer)", "value": "6ab8540db2cc96cd482583c84b2bac2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096343, "uuid": "3668eb81-7a1a-4d0e-8dd5-29f453004670", "comment": "Malware payload (SalatStealer)", "value": "615a472ec89ed0f34c7c4a51131e19ee154b2e49d70bf51f04119de521c05d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096343, "uuid": "63be40f8-6bdc-4ce9-becd-1d5e8a70a340", "comment": "Malware payload (SalatStealer)", "value": "d3d7deaac01485bff55d6e6d1553bbcfaa45554f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096343, "uuid": "21b64df5-b294-44ed-861a-34e1374499b8", "comment": "Malware payload (SalatStealer)", "value": "0237d8051393efcce7be5bd6721cba2f25dd698a800c53ded97d64f42ec166d0b35742ff7e45a24cd1d34f0ff5c0be7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096343, "uuid": "596e5b79-09ce-4ec0-9378-3df2473293cc", "value": "T1B2F533F424720DBBDB273F76315C2A6C8A68D5085DEEC752A6FAC13642F799D86CD020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096343, "uuid": "11dde26b-2c18-4f31-b92c-889e633abef3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096343, "uuid": "242fa274-5626-4bf4-8d52-bbd5f4170273", "value": "49152:2+hK9nqU1FB3RTF010bXAXQezk9a86eH10sgAVxmxfFEHsG8h6bgW3tZpw:2+hY9/Suwgc86G10MLudJX6bgW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096343, "uuid": "67ca77d1-feaa-4d07-a38c-1838e32a79e7", "value": 3587584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096343, "uuid": "79f60a32-5735-4847-87d2-9ffc80840191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096343, "uuid": "f2de8fb3-6a14-4f9a-8fe8-57127da26c91", "value": "6ab8540db2cc96cd482583c84b2bac2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2973aa8b-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133483, "uuid": "bb931ffc-2c48-4687-8a3d-ded5bad597ff", "comment": "Malware payload", "value": "fdfba871c0eae3a5d2796130351e3839", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133483, "uuid": "c66e8144-94bb-4006-b625-5d68108b5a1e", "comment": "Malware payload", "value": "61ba1a0e43e061fc00224e3d2c3f4fcb269b7830eb7dff8059e12b69de42c4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133483, "uuid": "68a001a6-fc81-44a8-87bb-11e6cec7f5b7", "comment": "Malware payload", "value": "557ccf65d13b4c77490e75890385d91a2083b74c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133483, "uuid": "eb0c3fa8-7ef7-4b32-bb84-fc098a2f8873", "comment": "Malware payload", "value": "448d9c62813ec273b4fe7cd9b4f9458f8438a0e212c4a4eea58821545fe526b5574c3ab834e1fc4c53c8039da3156ac2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133483, "uuid": "9d767db9-ba7e-49bf-9cc8-8c67f23ea08c", "value": "T1A823F798F944D635CAE071BAF61E02DD33030FBCD2E631159E216A347BB79194E3BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133483, "uuid": "c74bf282-394e-4274-989d-69844cc8b7d8", "value": "768:tFpyPbys3IJdXlxnCpA2J5Pjffwz3Pc8O5Q2Kv2a7vmUEbLQ32nRrMP3Sg9Qktlt:tFpyPbys4JdXlxnCpA2J9Df43tOm2Kv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133483, "uuid": "8c7cadfc-aa2e-44a7-a922-d0770862e5e6", "value": 45964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133483, "uuid": "5a8f7d16-869a-41bb-bee4-8d76d230aea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133483, "uuid": "8ab619d8-f6c8-4356-b268-1b9c23dd6830", "value": "main.armv6-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e80c07-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130892, "uuid": "e11d447c-88b8-41ce-9b9b-aff3f50380f5", "comment": "Malware payload", "value": "0d69259c5651e0b83b671a44d4a28d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130892, "uuid": "6439649c-e541-410b-8914-98fac0c08d92", "comment": "Malware payload", "value": "62777784d0ae13dd67a9694ee724aac773d8413eb48bd8fa27638ed685a7d395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130892, "uuid": "b8566bb1-d2e1-4577-806f-7af677adc4ed", "comment": "Malware payload", "value": "e1b9c326132eaf0b84087370994d91fdaee2d8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130892, "uuid": "f6ba99eb-fb94-42e6-bacb-f2ac1380456d", "comment": "Malware payload", "value": "552a144aac1b79f270cdb6c2704fee4f08800e39a841f2db5dc28a07823dc5f599e11b605eb2bbc40db39088f346cfb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130892, "uuid": "991acc52-0397-4963-ae8d-b424aabff786", "value": "T10143E83CCF4D7C38A264A615783EA6565A120F8AC5133EAE2178425533D1B3079FEEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130892, "uuid": "c3bc1bb2-6946-4720-92fe-85a4457eebc4", "value": "192:/6XMQOB1zyr5cHdxU+pfdlkmkvzjm4gQMT4QUWwfoFCd0mBYAPE:/0ckuco1fQ6qW9tmaAPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130892, "uuid": "22fdf163-c532-4fe0-a71d-0c5de045f642", "value": 55842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130892, "uuid": "5d840e8a-9489-4415-a181-860d85153062", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130892, "uuid": "f80d9c4f-9cad-44f5-b0ea-564fd61fcaad", "value": "DOCUMENTO ESCANEADO.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbea14c5-9245-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786096362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096362, "uuid": "56135a33-c272-49b6-b648-8b2f1f5e7836", "comment": "Malware payload (RemusStealer)", "value": "9d30b8f55df5cd82604271e8ee6f727d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096362, "uuid": "84eebd4c-16ae-4500-a37c-7bd8437d80a4", "comment": "Malware payload (RemusStealer)", "value": "644667c869b560afdd523a5c2dae1e4a6753481f7b155df378cd59377e4b2b55", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096362, "uuid": "2f6c487f-0da8-4917-a4b7-d5001de42d50", "comment": "Malware payload (RemusStealer)", "value": "b6406eecefa66d9fbfbe721d1bb3c38c1ddbc91a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096362, "uuid": "2ad1f751-be13-40b1-ae98-26ff0e52f83b", "comment": "Malware payload (RemusStealer)", "value": "6d8baa2accf4cc2d519f1630c611f94421a73fce5764dc86a110894e1c68fb0e0d381bddf88e83bb9ae602b2004ba4d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096362, "uuid": "253a5a8c-b6a9-4a19-a956-a9cbbd8c0708", "value": "T16486231A53E480B1E460DB789DA2819B5931BC616F79A7EF3228774F2F33AC4A174317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096362, "uuid": "379ea89d-7646-4871-a23f-06abe1b894ab", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096362, "uuid": "233e8907-d226-4b76-83cd-bdb4275554e5", "value": "24576:xd+DXaYg2jEgC1ziUSOY4e+VtX+rAmwZB0Z+wJlozzu:SDNEg+ziUS4e+V4AmOB0Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096362, "uuid": "ca6455ab-e4ce-4046-8bb7-ceb52960d18d", "value": 8388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096362, "uuid": "62c12564-ebd9-4c77-9070-fadc4887e957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096362, "uuid": "786777ad-bc25-4d89-853e-84112000d943", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626dbf03-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097930, "uuid": "ec0714b5-53c8-4faf-a6d3-57de6a6c561c", "comment": "Malware payload (XWorm)", "value": "b164e801029be42825cc154ba0c2f721", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097930, "uuid": "985bcb5c-5fe5-4467-8612-a86df39a57ea", "comment": "Malware payload (XWorm)", "value": "64e4881678cb0bdd236213ed78942e00dce7d55ce551b2989f521ed191f48c2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097930, "uuid": "5445a306-de0e-42ab-99ac-0b917533d772", "comment": "Malware payload (XWorm)", "value": "63f76b435fbf0c521a88ec02005d365ee9c09a6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097930, "uuid": "f2371902-7932-4448-bbd0-9cb2131b6d4c", "comment": "Malware payload (XWorm)", "value": "64c31b42a91e306180f9ab2e6c5f6f4a4121ccef2b7834156b022911e28d5d0e6804d0de7ab887152cff7ee00fc2be9f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097930, "uuid": "6856468a-6846-4176-bedb-3949c9201be0", "value": "T128249E064279862D8CAC00783E29028564CCFEB55C9CF4A6F399FC63F5C9E2589F5B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097930, "uuid": "29a1df6c-0626-4a61-9791-d4b110bb53b6", "value": "6144:YkkT0GliZCsERqN/LJjCZChE0hDQf09+Fro:Yk+zliMskCjVCZChE0hEf09+Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097930, "uuid": "97a7be02-24e8-4d20-88bf-c851d0831ec9", "value": 212965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097930, "uuid": "f946ee2e-032f-417f-8a42-781ba7a62995", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097930, "uuid": "729a859c-5ddd-4dad-95f3-9cdf54c56278", "value": "ReservationDetails.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f094d297-9292-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129522, "uuid": "88117c62-39b6-46b9-9694-9e6a30a423a8", "comment": "Malware payload (Mirai)", "value": "34fc4e2e82360f7fa06246dd5c682944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129522, "uuid": "0ca36721-8340-475c-b36b-1c5cf7679085", "comment": "Malware payload (Mirai)", "value": "6541f01db9d973067724ca3e3c50ac96e8defe8584febc47b3212cbe5979b324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129522, "uuid": "bc73f3ad-c81f-4e91-a04a-891137a5713f", "comment": "Malware payload (Mirai)", "value": "ee8c8f8c19211465cd18f061dc71e082d806cb92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129522, "uuid": "e0b8a431-4781-49c7-9d41-f7a5a17e1c88", "comment": "Malware payload (Mirai)", "value": "2588b6f0a45726bb64e5e9b730c55b33f87cbecc876190b1826cdc172f8ee6e9a82d81433838419e66a5168eaed79a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129522, "uuid": "a6437622-2ee9-4e24-92e5-cc96237d3f8e", "value": "T1E743010240056C75FA711FF8D8248750191FEDB8FB3DB961580B9A28FF826D677F8668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129522, "uuid": "b8fd162f-6bef-4f0a-b54c-d226a6a0e3f3", "value": "1536:rvSjITxfWMovH0oZpsaaaZa7H3K/MlPYMeSAwfL:7SjmOMQ0oZp4aZaH6EBYMeRwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129522, "uuid": "47bf1459-bf12-460f-b087-8ace47cc0947", "value": 56560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129522, "uuid": "f3499126-6a35-45db-90cd-470f1128b712", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129522, "uuid": "b83ec17d-2dc4-431d-a122-9ebe07ecbbdb", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e562f1-9243-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1786095339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095339, "uuid": "08be33d5-48e0-4202-b1b9-f53b313fe87d", "comment": "Malware payload (AdaptixC2)", "value": "fe720b7550466baa14994a090eed156d", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095339, "uuid": "ba60ef2c-5344-4274-a103-358feba9b416", "comment": "Malware payload (AdaptixC2)", "value": "664c8ea6640f0e3f8bd5ba3429656635d59f8272e37e0cdf646a1613efda9d8f", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095339, "uuid": "acabfffc-238f-416d-8a75-0f23d5d90800", "comment": "Malware payload (AdaptixC2)", "value": "68a6877be539bdc70f6956c2b3f2aabe095b9d3a", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095339, "uuid": "38f03b3e-6174-468f-9d6f-6dbffa837500", "comment": "Malware payload (AdaptixC2)", "value": "ea215b771da43da1183eb76a84f4d38e68ff30e8721a58492fd8976bac2ec4cd8f7e3fc796b51a90e0681fbd6d6dfd20", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095339, "uuid": "bc1b7dc3-2b8e-4947-ba2f-a8577bb1f011", "value": "T11C938335D3A3D0ADC45F8578AF9358B3A9F07C2C8630A235479966213B5FDB81FBA190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095339, "uuid": "f0e35087-d0da-4e9f-b6a0-502407248335", "value": "1536:p8Ji32GjqTUKc68n1TJRb0N3Q1q1FspS2tG9vPVSePGFhk9cY2du2EuymSvvtdvE:b2Ge9opS2QRk9wNhEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786095339, "uuid": "9ba72cb0-6a09-49c8-bc45-40f87e88451a", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786095339, "uuid": "52c1aa71-0c07-47f2-8fbf-50c597fb718b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095339, "uuid": "6c9c983d-45b5-4938-9588-d10dcecb4ae7", "value": "fe720b7550466baa14994a090eed156d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981eaf75-9278-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786118207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118207, "uuid": "8eda8f6f-98e3-4f63-8c8f-d34e7102a22c", "comment": "Malware payload (ValleyRAT)", "value": "fd97ea4b8cfbe711cdeff06d6e8c502f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118207, "uuid": "3d5047d3-25bc-4dcb-a62c-65b52042a337", "comment": "Malware payload (ValleyRAT)", "value": "690b3aacb438e50788ca6018d18caa7bd1d18121e71649e7d2e36067919ca0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118207, "uuid": "bbf88168-6201-4db2-b6fe-32c5a692f44d", "comment": "Malware payload (ValleyRAT)", "value": "e4dc5c08c21d06255cab4b527b36a4a3c834028d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118207, "uuid": "786684f4-0df7-48d1-acc1-d8b059988a52", "comment": "Malware payload (ValleyRAT)", "value": "8edb5626800f00f0b44458d9f903876bca6925a2d8f11ea8acf45683339c73e1bb1762bdcf4246972eccae9fc22ad98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118207, "uuid": "b8a4c897-5ce6-4ae4-a1c8-b5c896a51576", "value": "T1D2F5CD20BDBA811DD067FEB83DECF99FE9EB66191506646B001703478666AC0CF4B1BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118207, "uuid": "c30425a7-a7bb-4470-a5d0-22b856ca6419", "value": "c79422941602e7c6d569fe537f2ec235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118207, "uuid": "b5190a68-247b-4904-a0ed-7f7d52142d35", "value": "12288:VAwD8FiThnt1gpsWzob3OPvqaNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTXF:VAwqgLXb3OaL/kA9sNF0lPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118207, "uuid": "b23c27d4-8ba8-4ea4-a5bc-8391344fd674", "value": 3328344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118207, "uuid": "d18ec2ee-a6cf-4741-8570-504ab61e6378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118207, "uuid": "af8a477d-4fb2-40df-87cd-e29d810878e6", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b608388-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786097918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097918, "uuid": "120efedf-5f24-46b8-bc50-32f114f94b47", "comment": "Malware payload (MassLogger)", "value": "e0265624af6c791700e7e6d8a585c5aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097918, "uuid": "08d9ec1e-a3a4-44a7-b880-d1212869b315", "comment": "Malware payload (MassLogger)", "value": "690fec775cd64557e5dd6e930f3c7b073a89129baf5ca8e4fa92262cd2930bf9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097918, "uuid": "fe972f34-0f20-4056-b53d-4d0ea66a9af7", "comment": "Malware payload (MassLogger)", "value": "217576319eab691c7ed5b8473b6251a8305a20b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097918, "uuid": "546c61c2-3d7a-452b-b041-094630a09d52", "comment": "Malware payload (MassLogger)", "value": "56106764e0e273c2e2bb150b57b8a0e870a3b320a71aac43133a4dd02f2a09fc8920202b8efa9262fea80212fe514f87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097918, "uuid": "6409b393-5f90-49f9-b29f-f848af53f967", "value": "T1A3252ADBB371035C184872CACABC6ECD2865FE92D114E76AFCB83787D20D659A181F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097918, "uuid": "57d8c757-a31a-4d58-9260-e3c2baaa2523", "value": "1536:TGv6BPd5cPTyhCzh0exdCEpkBFQZ1FoahM7Pa:TGylhkhBNyBF+/M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097918, "uuid": "c33b2e93-08c3-40aa-909f-227727c7f7f6", "value": 1030052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097918, "uuid": "e83554de-6b8b-4c5c-8941-a5d59155a574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097918, "uuid": "34d9f084-53c7-407d-91b5-7cda5ce0fb30", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0c251-9291-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786128896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128896, "uuid": "0b7c3499-a3cf-41b2-bc0e-07b475ce82b8", "comment": "Malware payload", "value": "94b66baa87e921afc28ee7eda084f602", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128896, "uuid": "0bf7dba3-7be0-4179-a28f-a1c4da3f1f2d", "comment": "Malware payload", "value": "6be297553f7f63f4d32b4c8618052324ce0c3161f4c3fac77eca42cd29d9b577", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128896, "uuid": "68f62aa7-b6d7-4d2d-a170-acaca53d9c16", "comment": "Malware payload", "value": "af3d1394ea90373626d835975dcdba9b6b9152ae", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128896, "uuid": "acfdd732-9803-4940-a7f8-c01260ecfb20", "comment": "Malware payload", "value": "ec6cdd97a1f5060d0c10d967f7a26e53498e9839e8e2fdf16c7ecf2179c1d86d781ac258f0cb65f459141453c1a89332", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128896, "uuid": "8722db23-3e4c-4626-abf1-072e8c252bca", "value": "T102D523587DB659B4D47ACBB6CE42E0AEB029779407B48E5B37CC29008E539888D3D37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128896, "uuid": "8e25f749-6b50-4a7f-978b-28b386f1805e", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128896, "uuid": "e1748eab-f72d-4d70-80c2-3cc62a48cb3c", "value": "49152:frvOeBbC5PIJqvLkucMbZ5Ip+ls9VgdBQ3UYCQt94jUv7GmKag5bwl:u5PIJpwtsYCUlQb0SZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786128896, "uuid": "574b7a63-c743-4b07-98d6-e2fbdd23078c", "value": 3002880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786128896, "uuid": "3bab1a0a-074f-4527-86f1-688f09a0a110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128896, "uuid": "176f546b-2ab8-4c10-8f24-8f2a1db13781", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0032b8-9236-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786089704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786089704, "uuid": "f6aa1913-6f98-4de2-a1eb-5ce743a69e30", "comment": "Malware payload", "value": "9665a9e060cd96a5c0307992f36443e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786089704, "uuid": "8a6f82b3-e16d-455a-aa67-6b00c4e2bce6", "comment": "Malware payload", "value": "6cc85324c1a7895b0544d0d8f910d3326a54c91e84c3a1c956f616f2cf876c27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786089704, "uuid": "76d23036-4248-4fd8-a9ee-5d0c12cdb7cd", "comment": "Malware payload", "value": "b4c9cb0fd68e0ed6eaebba8f9604df8fc2919610", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786089704, "uuid": "dab7fa3a-0ea0-43c1-bb68-fbd9d2e57029", "comment": "Malware payload", "value": "65ffddefd3c6c23b031695431990944c2cc06af5289f9a7f6b9ead919fbcdb5aa41b7bb58641dee31ebf9c2bd7d3de4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786089704, "uuid": "40952ee3-6c7d-4847-9672-4bc38792f927", "value": "T181235C5126857C14AA98C8371D7F2F0CB9A943E6324452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786089704, "uuid": "f938b4dc-ed9f-4746-8e71-e3226f010f61", "value": "768:16FWzZx5o9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ckzLcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786089704, "uuid": "af45e81a-2752-426f-b35c-6c04b7c9421b", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786089704, "uuid": "2d62dfaf-79a5-47cf-8e24-a7ac02f2bd8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786089704, "uuid": "543654bf-f5b4-4594-b8e3-20f560367f91", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ae5a81-920e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786072594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786072594, "uuid": "a9ca05a0-cefe-4a81-8ef4-f70dd061dc0d", "comment": "Malware payload (Formbook)", "value": "a302cbeb7321e30c866cea3d47fd664f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786072594, "uuid": "4052df8b-e751-4877-afa6-76d33deeb1a0", "comment": "Malware payload (Formbook)", "value": "6e383213ab698d95c19ba53e6fac6388883139934a91e4c816ee86ff33c0de33", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786072594, "uuid": "a8c65f48-4574-4de0-bf76-e28b15bc8f34", "comment": "Malware payload (Formbook)", "value": "ba1f81bc47ed9029a8e6d047dd343ed046e2017b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786072594, "uuid": "b6cdd7f9-3b5f-42c4-b4ef-560b66297add", "comment": "Malware payload (Formbook)", "value": "574e6bed10ac096bf65198079e9512093049ca009f0e6d5b1b2cf51241458d61b26a1c62252ef6216775f2e7a941c003", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786072594, "uuid": "ca659bf0-8343-41b0-ac06-a15041dd6353", "value": "T13CE5C6B12BCDAA160C0A726FE90D3D980E5A94712ED2D49879EF42D0B24F45D6FD087F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786072594, "uuid": "4860bcff-8753-44a6-a012-50023450d1fb", "value": "24576:bl+YXwu1a146N9EwghlvRB8EbCc9d1CeuFB0TKRtAI8VOauR+uqvjxpoPwzCAZG9:bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786072594, "uuid": "4cc05419-4a4d-400a-b902-c79871890d73", "value": 3133253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786072594, "uuid": "46d7ad4f-6180-45b5-a6cb-6d84a88175cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786072594, "uuid": "bbf802b4-e14a-4b33-8181-33b7567d675b", "value": "New_Shipment_0285_Detail_Specificationpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c48f68-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137911, "uuid": "ee70de4e-eb84-4415-ad59-f6c30f2e79ee", "comment": "Malware payload", "value": "b93d9e06b145dbbcd1adc6ea508953c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137911, "uuid": "32280357-17f5-4b11-814a-9dcbf9d55da4", "comment": "Malware payload", "value": "6f4cb391752d2a60c5e55a0c4512aad680e71d26b0606a2b43196c63c0170be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137911, "uuid": "11cd83d0-05a6-4952-94c8-8dcb8bcf35ed", "comment": "Malware payload", "value": "66fc428572a1353b166e780ddf755ab3d34782ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137911, "uuid": "1624fc74-e02e-434b-8e15-60dc79fd3896", "comment": "Malware payload", "value": "c2794ca65f65f3372bf9124de7db3e52d01cb45096ea77d50c6c691caf1137c483b22dcfa221520f140ca03cfc12d1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137911, "uuid": "39668dc9-64f1-42fd-9ff7-d4c511f98a9b", "value": "T1A663F903EE926AF7C45ECD70452DC24A11DE5CBE92E9511B71F8C98CBBBD3194AD3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137911, "uuid": "00774de9-d05a-4b23-80e9-28e42cdda9b3", "value": "1536:Vh2RfSKH5r/hSspPXXE1WvtqFc3kJ5snFVCQ8EXb:j+qKH5tXEYFI5sFVC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137911, "uuid": "bb5cbe9a-2aff-49b2-be8c-53c95b936b04", "value": 72836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137911, "uuid": "bdf5b651-51f9-4b9b-bdd5-4795dc2e5b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137911, "uuid": "378d13c5-9446-4af1-a8a2-05e27e1e7303", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c37020c-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786133004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133004, "uuid": "9f6f890b-615b-4ba1-bb19-54f3306cefe5", "comment": "Malware payload (Mirai)", "value": "92c8896539b471d1b16aaa7bbedc204e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133004, "uuid": "aae319ac-3f50-4c6a-b6b3-a96eb2828646", "comment": "Malware payload (Mirai)", "value": "6ff2f877668649928a1a510d79e961e5f13408c729f648bd45cf24f22b011509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133004, "uuid": "e3aec4b8-9e79-4963-8723-d4ccf2e4bd2c", "comment": "Malware payload (Mirai)", "value": "64d1457ba453305cd8a35b67cee7e84aa586beaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133004, "uuid": "4e6b17b9-e77b-4237-bd12-419343d42f74", "comment": "Malware payload (Mirai)", "value": "4531a8c5821300f8c5ea4178dbb707f283d6f8508db4f3833ee268bac1742f125b9299cf2985ac378f9b2836522c7f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133004, "uuid": "22b596f4-8000-4a25-9656-c10671cb0795", "value": "T1915302EDD0DB6CDEDC20867904B68198399E1F44F617934C16AB81F3981ED02F85FB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133004, "uuid": "ef77f0cc-aeb5-4e45-8667-a4828054edfa", "value": "1536:nydummH09WI1OWUSXEkX7P1jCQuCOVvA2O2:nZtZSXE2PFCQudi2O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133004, "uuid": "c14a109b-36bd-4d28-ad80-3a1b95cf46de", "value": 61208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133004, "uuid": "98bf404f-3764-436e-a3f8-5042c030373e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133004, "uuid": "41e19f9b-d501-450c-b80b-126f60527b22", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f89af30-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097925, "uuid": "52ed75ae-71c8-4823-89af-7d61d8b177e3", "comment": "Malware payload (AgentTesla)", "value": "51741fb6a164b682ea8e49a7a51aef74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097925, "uuid": "06a08048-55a0-4776-9ec2-b90cbd20bffb", "comment": "Malware payload (AgentTesla)", "value": "707c9077934fbbf80229b6c018dcbff068352d78f765b0187adfda25198f31ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097925, "uuid": "0f212647-a713-47e3-8b31-16ec3c33ffc4", "comment": "Malware payload (AgentTesla)", "value": "a50e0fb4bed3a2a69e407df9d406f38c5a346614", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097925, "uuid": "0ddcce86-2772-45eb-b017-ae829dd74903", "comment": "Malware payload (AgentTesla)", "value": "31074852b511d6ed80ef3f011421d42f970afc1b8f92011e21594b3d74c37cd8d67adaafb1320fba83b29c6dac41959f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097925, "uuid": "6006d017-a63b-4dc2-8759-a491bfb197c6", "value": "T1CC83B91518967480533727BFB62BA8D0E776072B02402917BA7CB454DFF1E09EED4DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097925, "uuid": "32c881a0-108b-4e41-8f64-b368f16f8564", "value": "768:bJRGFH9zmmDrxZikiOJ1XBf3jU7SGc2GY2aa5geTrVxprk03/DRvxFxobvgdsltD:bJcFdzDPm+owqOgyPvwR+ldcDZzeHBrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097925, "uuid": "9e2263cd-1f2b-4c87-89a3-cdd4c063eb9a", "value": 84243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097925, "uuid": "a3e738e5-4820-42da-ab94-f5db964d3bfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097925, "uuid": "2c9bff2c-4907-4e67-9a48-556f051d4989", "value": "Nomina 08.6.2026.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c9131e-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133717, "uuid": "c6e8c4d1-72c5-4818-a603-1ed6d4776bf4", "comment": "Malware payload", "value": "89010b4bdd5247e7a182471ff797152e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133717, "uuid": "52cc7f67-4732-4cc3-9155-0baeb27c20e2", "comment": "Malware payload", "value": "7099805ddc0647122cfd66d28fcd68c462e8d1c9fe9869221d6e0fe4129d820e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133717, "uuid": "5e0e16db-0916-46c4-984f-8fe83bf801e7", "comment": "Malware payload", "value": "37013ab1071cb60f819a599ee95b4ea7e74d3b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133717, "uuid": "84050e66-4dfe-4d42-8807-0c9335afe7b6", "comment": "Malware payload", "value": "2d195393a6c2aa1beed8ef10b5a914f0297b1dda7d20f509751cc7fd7ed2b49461880e828bb9c42fbc5d286b52c3a15b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133717, "uuid": "dfa10c3a-47bd-4430-8593-aa311d29d404", "value": "T10923D694F9409B39C7D074BAF95E42DD33130FA8E2EA31159E216B313BF79194A37A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133717, "uuid": "8ff49081-98d7-47b1-8b47-dac024eec167", "value": "768:viZXnppnxvdw/z9M7kfpL1ZFWSPGZhTHUD7fhDHOmXBw4AOpOUO9Ok57YUQVaR5/:viZXnppntdw/z9M7kBBZFlevTABXK4A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133717, "uuid": "14377d34-f9b8-40ef-ad26-b0cdba781b0d", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133717, "uuid": "b4fc608e-5507-4fbf-8b22-6622d3ee3c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133717, "uuid": "09dfd5fd-39a0-495b-8b3a-acf62e56cd22", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21b8bd2-9260-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786108050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786108050, "uuid": "385decf8-177d-4569-a592-c79ada0df7a5", "comment": "Malware payload", "value": "36d90d1d9f7f072601c131717bb4c7d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786108050, "uuid": "43db9573-6981-4e7b-b526-55bf25815dd5", "comment": "Malware payload", "value": "70b1dc8f5bf0d374212006af81dec75f8ffbd7781c63b05df7d3df1e5ad62d5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786108050, "uuid": "f47ff8d2-f9ae-4d98-b319-aeb48fe9e2ac", "comment": "Malware payload", "value": "a3b19b838de263b9c5e504e3f026073faa396b24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786108050, "uuid": "4fcbff8f-584f-4a83-a4ea-4770208b9229", "comment": "Malware payload", "value": "7c03b1608d74f3238f75eb8c5d2724470b3a5c45fb96245cafca74821bd38568c8737982addc650765f32f63104f799b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786108050, "uuid": "b03de745-3017-4a92-a12c-34b50b4bb728", "value": "T14F236C652A817C14AA98D4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69D920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786108050, "uuid": "76269264-2d9a-441e-b6a1-0388772f835d", "value": "768:JXOGVvfW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:1LXTcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786108050, "uuid": "68a88f3f-612e-4d8f-b087-0dd3a3604df2", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786108050, "uuid": "446c11b1-a508-49d1-84b5-36e12dffc930", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786108050, "uuid": "d1503f84-0521-47ed-a218-e38f5ca8f569", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a9e6e7-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080575, "uuid": "440b9389-5c58-4fcb-8e46-8a183a19b51b", "comment": "Malware payload (Mirai)", "value": "13c6d3d3f924e51172da98636247e201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080575, "uuid": "b38448b6-e288-4e5c-a9cc-3694c179763b", "comment": "Malware payload (Mirai)", "value": "710c437ee32768f6f883e050f4911fa1fa275c6f9dc48d2d655ffa5e041af532", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080575, "uuid": "9a2d4fe8-eff3-4e35-9b02-64776939e028", "comment": "Malware payload (Mirai)", "value": "76f2251915d7f9a5d8a300b9d34a7e92b19bccfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080575, "uuid": "5662d325-0f2e-48e7-a2f2-3bca54ec6938", "comment": "Malware payload (Mirai)", "value": "62038b594f4314dd09b8c790a80353d8a08abd16f6b876f42e4885a2771192eb44ce7dfa83118c77bc9ff4d5d0cb9a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080575, "uuid": "598c5585-9458-418a-93ec-a859cd349b6a", "value": "T1C8C32AA9F890DE52C6C52676FB4E418C33231778D3DE7105CE249E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080575, "uuid": "3ff81b7c-5635-4a6b-981d-076392f9f5fc", "value": "3072:L+tC/Hvx/9eY24fUpoIiacYEEU5/cMWNNwhik6IwPnONvF3Q0uFf1Dl:L3fhx0ovacYEEU5/cMWbwD5wPYA/F95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080575, "uuid": "c36475f9-80e4-499b-b6d7-7c648309cd3b", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080575, "uuid": "d38d602e-c8ab-4338-97e7-714ebcaab968", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080575, "uuid": "a638caad-5bd6-402d-b2a6-d1a1d97217ff", "value": "46cc2f7d004090d35756b38ea28a5d0e62e82b3ac7758c054b48aa993c94b8ff.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83efd8a-9299-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786132488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132488, "uuid": "0b0c0adc-ad56-48b7-a05e-ef191cb266ff", "comment": "Malware payload", "value": "6be95e109e6f6f1acf4875759964d96f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132488, "uuid": "84af22b4-7d68-446a-a57a-b254c33eef72", "comment": "Malware payload", "value": "7201a98d0eaa5130d7c0adf714492ff6617a676293cadfda66a241a3c1515e71", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132488, "uuid": "53285d73-556a-4e27-a1ac-0fbbb185f5e7", "comment": "Malware payload", "value": "74f358d22a8dfcc85ac4bee4c42521aa6e8fba72", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132488, "uuid": "33827c57-3b86-45aa-bb29-93f64766d0b9", "comment": "Malware payload", "value": "b6c02fd6a8f8eb301d3e9007e9e3985344c61bfdfce3fea3b2c830f2fa80497884a45fcf8428627aa7fb7e6919d1f3f8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132488, "uuid": "b7f1d50b-38ff-44a5-9c91-3c380dcfe887", "value": "T14C266A43BD9148FAC0D5A73188A75356BB31BC0D1B3623D32E60ABB42E767D15E36B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132488, "uuid": "a22e7a18-bbe6-4a46-960f-33788f52b674", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132488, "uuid": "b2c0e7b5-1bbd-4dd7-b22d-ee2cb7800617", "value": "49152:6Y2rie/Ic5aU6NkwlcMlM2Itt9YTlSVfSUgSOVyT9VgM2QXsVoXpzcYGV:6/KNkwNI6AyZVQ9VgM2QXBXaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786132488, "uuid": "8c63604a-9df4-4e45-bf90-79c849d9cfa4", "value": 4523896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786132488, "uuid": "44623321-a5b2-454c-9c43-e2896327f188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132488, "uuid": "c9d42f89-8018-4a2e-a39e-a9ad8a30f06a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ae0961-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786081432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081432, "uuid": "97c66ef3-ccda-478f-823c-f43f2256adeb", "comment": "Malware payload (CoinMiner)", "value": "91dddfbe6ec0216a43e4266acd65e7c7", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081432, "uuid": "43529378-a192-447d-9199-20c7fe3c54fa", "comment": "Malware payload (CoinMiner)", "value": "72b0ee76e31527fa94e063ef15580037a2148bf59d6f981faab92a82f5403d58", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081432, "uuid": "9c42f954-0599-4e61-be43-eeacafb0a916", "comment": "Malware payload (CoinMiner)", "value": "474b10003a3ba9ecca035757c37570df3529bcc5", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081432, "uuid": "0251ee01-a08e-4d68-9bc2-e27e806c017b", "comment": "Malware payload (CoinMiner)", "value": "351cd832f56bbf8b96122db8030c16295f2fb25b7e6317230517d45bb70a76f519ebd8f539808280d9e608cece459e02", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081432, "uuid": "33ea7e5e-ec0c-4f2a-ba63-f66d3860f186", "value": "T1E33633856DC24570E852CBF483A3712EB37A77E5C528BC9B3ADD66004E5BF14293A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081432, "uuid": "b889534a-ba6b-42f8-a341-a6c5fcd18f18", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081432, "uuid": "de772489-8dc1-4fcf-b599-5a2c9f3bd32a", "value": "98304:TqRIZGS1eLq5nxMI5j0LMMMrLMcjjDz23oeM82Ac3NJKJeqOdI+XyfEYdMI:2qZYmmIEMMfcP23oh8lGJ4eDC+sVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081432, "uuid": "33f0e09b-6b54-4fa0-996f-1ac1d06e098c", "value": 5273088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081432, "uuid": "d6a40312-14c1-4f19-965b-08ce601c41f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081432, "uuid": "11d8644d-8e69-4401-a35b-4692b0d5021a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88c32a4-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135844, "uuid": "d154b846-2923-4765-88bb-0f2d8e085cba", "comment": "Malware payload", "value": "c879a354dd67eeb6b4f05d80e2ffa801", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135844, "uuid": "f1457d8d-eb28-407d-b3d7-668186c21a08", "comment": "Malware payload", "value": "731a24357717027f186b142b5efb8b5aea73071245b70ce5883f69f5c8bb13d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135844, "uuid": "24e78ab2-bb1a-45d5-a1ec-0d605cd42cb4", "comment": "Malware payload", "value": "90ace25a1351470cb8d29ddcd0ad29c4a400bd19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135844, "uuid": "f2237f9b-b85c-4e39-b2e6-2916a198c92d", "comment": "Malware payload", "value": "e738ef3a7831154a2f9eee9e4e61fecbc7305f1bae73a811759a76154aa5a584c32ee0da859bcde321c130d1998cfb64", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135844, "uuid": "a769be03-553c-4767-aa81-614f7ad4420b", "value": "T17501ABCAD154484050AE886C32E76594F430C3CB2A8A4F69FF6CA63D9B98E00B07AF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135844, "uuid": "6521704a-d368-4286-a196-858cbd86c210", "value": "24:kXCKysE2hi0ziQvZohaxjXIjFMmVI5nqK+jRX:e9Qp+Msxj45fIN3+lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135844, "uuid": "05da9b8d-71d7-419a-99d8-d8f66dc7fca9", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135844, "uuid": "774f78c3-d42d-4bde-99d9-0f4e26bc617b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135844, "uuid": "d01ab9b1-5641-439b-a801-3148af10a868", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb251209-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786097730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097730, "uuid": "da9a3a1e-d41a-4f53-bb40-75568fde0ea4", "comment": "Malware payload (PhantomStealer)", "value": "d0cef10e703fb09acf910909e3861793", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097730, "uuid": "eb11a46d-a7bb-46c7-b3ca-0e2a7ca03ab5", "comment": "Malware payload (PhantomStealer)", "value": "7400338612e9710bb38d4d135df92793c6e68a3311dd0e9f8c36172a4efb882b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097730, "uuid": "9e53a778-3bfc-4cb2-af1c-1f9fa27156d9", "comment": "Malware payload (PhantomStealer)", "value": "61c0ddf0719bff064b386f6198004f8809097cf0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097730, "uuid": "7954966c-0bdb-4284-999b-d8ac541116cb", "comment": "Malware payload (PhantomStealer)", "value": "253037cde050efbb3a22c12b7a0750a5eab5c38f33f6a8dea0fffc2309cd96387db6135da9844a99f6d4e5729e64f3f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097730, "uuid": "19d92ffa-24bb-4963-b242-b15e465e8d64", "value": "T13566B9F57B9EA606AF2D325C548D6EC8472F819C2E41F1D4B0CB9AD4060F08AA6D1F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097730, "uuid": "01c5c1b6-d724-4256-ad27-d3dbe0dac66c", "value": "12288:XcHoQlyZVBNxSfBxjY2Mzw3EZfpaKrreR5f34X2QpPWWxYa+KqCkApFG/WEi+Rfc:eoO8BxSfLjYTzipf2dbfcuFf8v85j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097730, "uuid": "56c0208b-1e09-48e3-a8f5-71e2e37b1364", "value": 6688095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097730, "uuid": "3f51253f-d29c-47c9-8c06-e960db388539", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097730, "uuid": "01154b84-0def-4e9a-9358-d549169e1e2f", "value": "doc00226520260804141635.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f44c181-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129573, "uuid": "4f1dab28-8774-4525-9889-9aa990524f0c", "comment": "Malware payload (Mirai)", "value": "d18a92122d51443dd73810e1fff1084d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129573, "uuid": "e2424197-cf9c-4fb4-8566-15c8ff81bd81", "comment": "Malware payload (Mirai)", "value": "7499a8dfd8c3ae2e562c3152c869715b5e17d995da0be09ae053e885c4432e76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129573, "uuid": "a2cf024e-43e4-4a53-af19-30b5db50ac2a", "comment": "Malware payload (Mirai)", "value": "67ba14166ffa7c7b763dbe9e0e30d52ab3e124bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129573, "uuid": "12be46d0-deac-4071-b3cb-6a340d9aa86f", "comment": "Malware payload (Mirai)", "value": "470f7a4dd31fe3116c3901893747230c3b16b48b4bfee91ba960b463b6e2f7fe4d166d2d01529527630641a876f2917a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129573, "uuid": "588812da-3989-450b-a544-cd2cfe57903f", "value": "T1A8C329A9F890DE52C6C52676FB4E418C33231778D3DA7105CE249E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129573, "uuid": "e60a864c-4aed-4f1c-8be5-b48298174369", "value": "3072:Is3MwjVxhyC400VIUccYEEUQPOMWG6NwhQBmBkPLfHNwFCmluUf1Dl:I7K4VlccYEEUQPOMWGswwkkPLmV0U95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129573, "uuid": "056bf2cb-d6fd-42e6-b4e0-8dccfad62c67", "value": 124348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129573, "uuid": "f6d59832-2e0d-4a4d-a740-2e08d28c9b71", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129573, "uuid": "ee75a195-e33f-4856-869c-548b47fc1421", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9078560c-9234-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786088988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088988, "uuid": "c2238be8-8ae7-40c0-8684-3ab0f3b890be", "comment": "Malware payload", "value": "2af734754983465c72a9f3a0c012ac6e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "COM-hijack", "colour": "#15D9A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088988, "uuid": "20b570b3-ed07-437b-b07a-33f6e5f21724", "comment": "Malware payload", "value": "75581ce98d1b37d26e52ee2fa4157ca248e5ce9ef32969489995db44f47e070d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "COM-hijack", "colour": "#15D9A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088988, "uuid": "d2c05e5c-3f23-45b5-9213-7c18b85815c1", "comment": "Malware payload", "value": "d9021ad3ef4d77765a45fb31f47d9784b52248ed", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "COM-hijack", "colour": "#15D9A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786088988, "uuid": "bcafd737-45d6-49d8-9885-33e2b6fa2ac4", "comment": "Malware payload", "value": "74aad36fc1c82b5ca991b105c88b97611ac126fb25f4080d7482fda9a115bd976f198e46c76d2918625f54d8881ff9b3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "COM-hijack", "colour": "#15D9A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088988, "uuid": "b3e1376c-5273-46f5-9091-c10c4ece9370", "value": "T1AAE2830F5F198665EC3E267951BA8DC2F378B2644331C8EB6D80981E0D52BCBD735AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088988, "uuid": "b5d1b242-3ca3-49b1-b83c-43e8b1efcb9c", "value": "485ce3f49821aaa7db064aeec957f67a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088988, "uuid": "bd8f8718-b1b3-4963-a47d-68a7ed660304", "value": "768:p9LmcVk9iCPqXmnZzBeWUjuESb90sngUg/ijhAYMPQ:1k9iCynHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786088988, "uuid": "11287277-60a3-4654-a7d3-6f20b7269f27", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786088988, "uuid": "478fd8c5-b99b-44fe-821c-dc90ade9bb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786088988, "uuid": "e0797e15-5174-4d4b-a483-1d2a7e598b0e", "value": "75581ce98d1b37d26e52ee2fa4157ca248e5ce9ef32969489995db44f47e070d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba8d4c2-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129648, "uuid": "38308cbe-0b74-49aa-86d6-5433bf2e2634", "comment": "Malware payload", "value": "df9e90c7caf9325e8df916cd4ce6dcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129648, "uuid": "b972a091-fb3f-4009-855e-7e7ecf89a78e", "comment": "Malware payload", "value": "768c5c2828833e39165481991695391f999c99139c21879b24a3fdebcafc25be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129648, "uuid": "f11a3c7b-e912-45a9-9768-737f2556cc9d", "comment": "Malware payload", "value": "ed911389d89143c222e8bc5408792d19f4461c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129648, "uuid": "a8714d41-be79-494b-9248-189782c8f5ed", "comment": "Malware payload", "value": "b77c6f4ee6ac01db1e1d157fc255881adf65d377d167cc5ffcf8e5eb7615357736e391026764ed1ebb65e96b81690a12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129648, "uuid": "7e784aaf-376f-4597-9eed-ae001231eb35", "value": "T19503E847631D0657C05B2AF03A736BF19BAEBDA202F49140521ABFC05375AF42192FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129648, "uuid": "3042328f-b3da-415d-b1f4-2a76d47f9c90", "value": "768:55/NlNvN5R5291TqnkAT0z89VDsmNDQ+/:7//M1Psk8nNDf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129648, "uuid": "c19df195-725e-45f8-9e4d-b6c341635028", "value": 40196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129648, "uuid": "948f2d0b-7c94-4b11-8055-58fe08e9decd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129648, "uuid": "59f6ac69-2682-4f9e-b50a-694be2daeee1", "value": "main.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3ca332-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137915, "uuid": "7eb7c177-49df-44f5-8073-15924869ec81", "comment": "Malware payload", "value": "6f5bcfa79ceb4480b77a0ac9615b38a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137915, "uuid": "65ade7e0-ec21-4af4-b47c-d63e72388bb3", "comment": "Malware payload", "value": "77581bb0c0240474d2674a2401faa2d2d0f7f63a5f74713661d40b19b0f265e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137915, "uuid": "d3e073f3-ecee-46e6-891f-18d6f580f522", "comment": "Malware payload", "value": "b0a021cd056b7d773e18863c5afa2ebc1cb58cae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137915, "uuid": "1a51d83d-4aae-46c9-9622-b1ee2252cebb", "comment": "Malware payload", "value": "5ceca6d0988be75ed65cf91848dc97240815478e8da83f00b84b5bd284f49fb5146c93e8e1ebecf796d78553d8bb52e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137915, "uuid": "1f383cac-84ff-427e-8578-0fef73091224", "value": "T10BD308177A270D22F4D14135A2FF43E2BFE583CB25784E97B65209C9AF276A074832B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137915, "uuid": "5d392fef-6180-4072-87ae-26bb72adcdbd", "value": "1536:BNJHcQN8e3BDlsM0E9JR6238UC5t7rk+n5p5L1lPZ:BNJ888Q/sMj9GUWpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137915, "uuid": "99477c10-ceb7-4c4b-9805-fdb8bf7b0e8a", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137915, "uuid": "50286a0d-e32a-4462-9b06-a7ab0e755d89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137915, "uuid": "e6bbcf87-5242-40c9-8c78-d2dbfbbbafce", "value": "main.sparcv8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853293f8-9268-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786111303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111303, "uuid": "e25aa5c8-e4e8-4a41-8c46-67d91bca8b3a", "comment": "Malware payload (Mirai)", "value": "c116bdb2ce9bd1dc919f4ed009eae099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111303, "uuid": "34208f1e-484b-4e3c-be0a-e0d3667551b3", "comment": "Malware payload (Mirai)", "value": "77d7c20d8f3bb2c10c84a5cd0b402f0a636ed292a9379c2f60bc49514c15b27d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111303, "uuid": "14405f0b-5491-4ed7-8225-c78b063fb734", "comment": "Malware payload (Mirai)", "value": "c6b0705a7e047c7609893b72abeddaffc58d8525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111303, "uuid": "b2de8f26-f1e5-41e2-a8f8-738d9acba18a", "comment": "Malware payload (Mirai)", "value": "076f59b92ffd45b407c2c03c8541b882ea1c5cbd1c36c82489bf3b1b058440e2dbe8d1868a3a6434449d7511b5b9004e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111303, "uuid": "ae080a08-8cbe-4dd6-84b5-7fb472759b4f", "value": "T17B043A4F7710CF61D729C93009B3CB5666E926622AD28989F35CDE04BE6434DA82FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111303, "uuid": "20c33e27-122f-4a3c-be0b-3ab595c4f716", "value": "3072:yZXh8gxVnPcNMTRug5T6B3PDoC1tm9GGon1Dzju:Wx8SlkN6oEErFvUVo1Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111303, "uuid": "d79e9c89-45a5-452f-9bb5-dc14a6eb12b2", "value": 181592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111303, "uuid": "27e4bdac-c84a-40c2-854c-59af3f10d708", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111303, "uuid": "ee7e28a1-0973-44ec-9ad9-387d7afc0752", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc847c11-92aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786139850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139850, "uuid": "fdd45c96-6546-4e52-b896-c799d04c01ab", "comment": "Malware payload", "value": "326e607e62c25fb7dee34c95fc404c45", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139850, "uuid": "8c529c21-811b-43bb-8351-c1f3a56af3c8", "comment": "Malware payload", "value": "7834f2efa3912d964764357bbf96752ba2f4ea2712c814664a1bd32ee95616e3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139850, "uuid": "fd81d623-e9e2-4657-af03-4d17ca459b98", "comment": "Malware payload", "value": "5f282b55912913f79c1688efde6fc4a1fb33a490", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139850, "uuid": "bcf99eca-8f45-474b-a274-1d3ee19cc578", "comment": "Malware payload", "value": "e6df4542acf6ac90ca094f739783b5369309ad15986d162f0b62240b85e2eea7c20457a3cfb6aa93d42d72f6f8fb6100", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139850, "uuid": "cbc60e55-007b-4c8d-bf2d-659a0746a579", "value": "T12976128FEF136EA4D4CD65358CBA2F49BB7D169EA3405B0B43B1E130ADCB6D50069A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139850, "uuid": "82dfa40f-7d53-4dd8-babe-d3443c59fe09", "value": "98304:riQTRMN6xgFSJvrTxZ4a4xQoeapcZ6DonUZnq5Ia843faHX:riQTRMN6xgFSJjHd4SDaKZ68UZnqQ4fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786139850, "uuid": "edccd99b-6f13-43f7-b218-213e4f131375", "value": 7131363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786139850, "uuid": "d9ea8a51-7283-4b1d-b49b-461c79d07766", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139850, "uuid": "3c224cf3-c245-4421-b88f-1211a1ef8e9d", "value": "7834f2efa3912d964764357bbf96752ba2f4ea2712c814664a1bd32ee95616e3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee86949-9268-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786111212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111212, "uuid": "d61b8f7d-dea7-4a00-9f50-6894c08df009", "comment": "Malware payload (DCRat)", "value": "0a9f93b87901a403fa1f1b1362455f13", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111212, "uuid": "232c557d-ae83-4147-9e10-5a6d1782dd3a", "comment": "Malware payload (DCRat)", "value": "78efb35e7b51882913109c68e386b0bd2941901a451a35022bf5e5a2f018dfcb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111212, "uuid": "d72abd49-182c-46f9-b71e-774997ee9250", "comment": "Malware payload (DCRat)", "value": "997e7cf6edd424e6346a791ad82702ebb3e2ca9c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111212, "uuid": "5b2dacfd-bcde-475b-bd33-2cc9a37fbe5d", "comment": "Malware payload (DCRat)", "value": "a3f062920525d345bee29900304dd4887eb556a749731cd5df0645f3bfa178c0cc883e5d646d58e800611b70e5d5c098", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111212, "uuid": "ae0b3b75-2fd3-4376-8ff7-0288c6b6f038", "value": "T1A005F802BE44CE01F0191633D2EF454847B0A9516AEAEB2B7DBA377D591239B7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111212, "uuid": "3055c9c3-bcec-462c-ab5b-5d45372850f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111212, "uuid": "80f44e72-0230-40e4-b6c5-5dc423564e32", "value": "12288:FqMPq1MAcWCBKkzRclNKAlL6NBCY+B+HIjNd1rJYCzcl:O1MAcGAClNy7iUcT1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111212, "uuid": "f269868c-2584-40a0-a411-b138be762f7a", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111212, "uuid": "7f723da9-708f-426c-993b-7b77fe2a049c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111212, "uuid": "cf8edf76-7a95-4aa9-9a23-77a5e5fec14f", "value": "0a9f93b87901a403fa1f1b1362455f13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afa3749-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126264, "uuid": "4aa8dc0b-27d5-4395-ba8d-e0725899eee7", "comment": "Malware payload (SilentNet)", "value": "b2b2892d82ad4f1739ae6bf1a2135318", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126264, "uuid": "8a95aa9c-2d74-4b70-846d-28c18049388c", "comment": "Malware payload (SilentNet)", "value": "78f21013f805a76acd9e2f81e6c8fc90145f3cb06bf1ca6d6a086931d7ec7e66", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126264, "uuid": "43b8981e-f265-4c14-ab84-83a61fb6376e", "comment": "Malware payload (SilentNet)", "value": "a6fa77789051e696524f10221325d27551679bc2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126264, "uuid": "b385d8ac-659c-4d64-aee8-67c0aa80ff85", "comment": "Malware payload (SilentNet)", "value": "179f2fa15c89696d4ca14206b5da67dfc906437efc018cc05f4160ae6c052f9a80f7e37c962bc5e8f30282edeee4c9ea", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126264, "uuid": "9c7a20ad-d876-442a-a176-07279560a14f", "value": "T1A14523029418193ACF7B377F93463FD1AEACAF52D85AF6DE013C3E12645416767222A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126264, "uuid": "e3470ea9-bc51-4d96-9b3f-f1547a5edb13", "value": "24576:l8704RW5aFK95IEYWVeP0gizDvafl22bOBFyqT2r4BO:u7hRV2WEYSQizDveldbO642sBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126264, "uuid": "b8ca944c-b401-4edc-9dba-719931c537e8", "value": 1177650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126264, "uuid": "487f019e-fd4c-41ab-94df-4fb45c6fb813", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126264, "uuid": "0553c9b8-0fa0-418d-b7d0-46df70a78e36", "value": "appleskin-fabric-mc1.21.3-3.0.6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3f3796-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097650, "uuid": "506cf9ea-863c-43df-9724-32640d765ba0", "comment": "Malware payload", "value": "53bb942bbde6c5d74939f78ea637694d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097650, "uuid": "4f6c239c-16c7-414a-a39c-63dee339de86", "comment": "Malware payload", "value": "79e3f0d3f1527538660528242a3349e5f638ad0952ad2ecac2c43754f31d7bf1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097650, "uuid": "7f0d3644-c176-4ecd-aba6-dc8b40b933ec", "comment": "Malware payload", "value": "05ce4513a051743130acc54a4264c0bb091ddfaa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097650, "uuid": "68567b98-156d-43b8-b5c2-a5bae19dea7e", "comment": "Malware payload", "value": "4261d721d3ecc2b8d49831e507d77c9bb483efd1d01a33197ec14ac4b80e839b14bcccf553538456d818836c4e664a74", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097650, "uuid": "38d8bb99-cc17-482b-acb0-7385afb14af1", "value": "T1EF15DF8226E80300F1B6FE39CE7A9B85083BBA80ED75D7AC8A50CC1C5554615FA75F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097650, "uuid": "738a94e2-2658-4c2f-85f4-041b6357b65a", "value": "24:8d/aqWHIxRiqX+yDW9KT62TS6BxU/n9qcMQoRrGUuu:8laaQqXFDW9l5SUF3K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097650, "uuid": "abc5f607-6572-494f-99d3-8b98236260e5", "value": 929504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097650, "uuid": "dc003ae3-5e70-49f9-a4ff-0f633249cd87", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097650, "uuid": "cc3d746d-631a-49e6-bbc8-3851c3170fd9", "value": "JPG_013.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11bcabf-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133361, "uuid": "d43dbcfd-ee92-4f75-a9ba-2832c2c03c7b", "comment": "Malware payload", "value": "94010dd77b300345a17068387030fde3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133361, "uuid": "4efdf29f-ca95-4555-9ee0-d74706a97316", "comment": "Malware payload", "value": "7a23ed995778d3080036322c53b859ea91a149c656fe900328b7d5814ff42aa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133361, "uuid": "d6d58e12-2b71-4b18-a6a4-f1a89e3b3dfb", "comment": "Malware payload", "value": "634ddb536d4e9e1df73b6e957d83aff4ad0b4f6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133361, "uuid": "885f9a66-600f-4e30-adad-10e5c3ff8963", "comment": "Malware payload", "value": "33a0c487ffd8b6628de46b5754d110f06198441cb32de15a0126f2288d74539681e34a675eb2fddc573c9e59ce6a23f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133361, "uuid": "28a4c6b4-1802-4705-9f55-df8fb1c87513", "value": "T197030A42E9519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133361, "uuid": "f1d71ca7-161c-457d-96f6-75f4f1f706e4", "value": "768:yGnDfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdzR2:yGnDfD+gTFvhM74jMQ0MCiNB2YwDXR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133361, "uuid": "c124fd81-4d92-45b3-ae8a-131d568cc032", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133361, "uuid": "baa66d62-e262-418e-aac2-f76959e5c06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133361, "uuid": "86974303-f43c-4c75-8c38-af4a25fe2ff9", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7b288c-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129968, "uuid": "4da14f56-4a21-4116-96ce-7cf986e16395", "comment": "Malware payload (Mirai)", "value": "8e36a9b4460ac233b12a3343c606e7d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129968, "uuid": "f381f3a4-ca90-4dc0-a9c9-5b704f664066", "comment": "Malware payload (Mirai)", "value": "7af02432edb01f5a4f117dd0faa2133207eb54a2ee7b0a2a3e06339b1eff3827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129968, "uuid": "63718db3-d225-46c4-b874-e0648c28677e", "comment": "Malware payload (Mirai)", "value": "47fde671fa3a00ef539d51299ecb410f2cdb275a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129968, "uuid": "e61b199f-0755-4723-aa26-b2dbafdd42ff", "comment": "Malware payload (Mirai)", "value": "f82be311e91e7dd0a52a4101b696045df8ac135eead103adf229d3fbf0d808ad6244bf17ace5c4965c9b12fd0f73c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129968, "uuid": "00feb93a-3492-42b6-b609-ec0be715ae84", "value": "T1EDE36B49FA9BD0F0D6D340F5462BEBAA963B99116133F4F1FF563661F8B1301288626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129968, "uuid": "9f0b994a-e95f-4437-aa67-e53e7034dec1", "value": "3072:CL6LQbrYixv9c0eB85PcGaVXjaKWIR70yY1/x:NQ3YSaK5EHeKjO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129968, "uuid": "f236795a-4257-4e6d-8e9b-3395853d50b6", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129968, "uuid": "70c20a50-cc30-4e98-84b9-563ea3ba7404", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129968, "uuid": "0408a582-535e-42e4-bed9-cbbc9b535557", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cf513f-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097914, "uuid": "07f42633-33b6-4df1-9b97-33b48f061054", "comment": "Malware payload (AgentTesla)", "value": "a9c0cf123596030dd274ac36136b606a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097914, "uuid": "050bd56c-29e3-4bba-b661-6bc6cdda4e35", "comment": "Malware payload (AgentTesla)", "value": "7bd02f6e1de477b261c0725c9dd7d6570bc96ce767d23b778cb6ea8a47a4d611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097914, "uuid": "8acfc309-7173-4987-bdb4-e1d35042a4e9", "comment": "Malware payload (AgentTesla)", "value": "500a09d444a6ae88470382c8375a737d4c1a4547", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097914, "uuid": "8030397b-d410-4ffa-b2fe-406aa1fb0802", "comment": "Malware payload (AgentTesla)", "value": "222f31628e257e8bb4a5cb505f5b0f439c97fdec2479462731695d403960d0026068130fc38224999b53496c518620d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097914, "uuid": "618751d7-be61-43f4-a9e7-a38e944193bd", "value": "T1CDE6E537193B62E79F9BE6D00A720B133297DB50CD9F63C8E2898456D35188260F7DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097914, "uuid": "33a8404d-7abc-461d-b0cf-7fd258d862ea", "value": "384:vzYftqA0hmEC2ppFAkcg6ZViVusmXKlpuG0/qXe6aCMGvv30700F6Ns8jCZHbdSB:DcBPAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097914, "uuid": "133e0de0-2e88-43ed-ad5e-ec1090e867b7", "value": 14697992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097914, "uuid": "bf049ca4-38bf-4bf9-896b-7a95e8fa4ca1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097914, "uuid": "a7065e33-1930-4bb1-804f-b59ab78bf765", "value": "transferencia-98758.0000001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f33d686-9266-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786110461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110461, "uuid": "15714ee3-93b3-4ab3-9a2d-6de20daa1990", "comment": "Malware payload", "value": "bd9a74ae43bf387fd8224c0274bdc5b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110461, "uuid": "17ef92ac-b756-4ec3-91cc-29d4b1a2d903", "comment": "Malware payload", "value": "7bd8fe1b674c1f03a77e881d06d0daa6632b8e9cfb349db97e5453fd00afa551", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110461, "uuid": "c695bbec-ba3c-407e-aa7e-c7b6b0215dd8", "comment": "Malware payload", "value": "e34a431f95c8d346b3cd6532a9712173ccd8944b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110461, "uuid": "4bb87d78-5ea1-458a-8ab9-00e95bcd7e85", "comment": "Malware payload", "value": "a5d1b5dd47996473948afa5099fc5236a499a1c8cc7064ccd587bedd20f7239da365eb72207f3ea255761ebd18ee94fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110461, "uuid": "03a1df5e-c3ca-4c5b-b6cc-f5f3475aeeae", "value": "T1CB11B1D9E8D64C323F095C2B64180CC6F2C5152B00F91DD5A25DA9635F0C6A566B6F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110461, "uuid": "e8058f71-35c1-4102-8502-72cc1d641db6", "value": "24:KKtD9jWijWr5jW2Fr7jN/F5haHifMDsxVexjJjCmYDYXmYRYdUQljfYm:Jd9jpjY5jPnjN/zACfMDqeN1BGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110461, "uuid": "2961a4bd-42dd-4eb3-a146-2514be5828dc", "value": 896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110461, "uuid": "fdf4c7e6-cb66-4f40-8425-22fae7890881", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110461, "uuid": "0fa85dc2-90bf-43a9-a976-70fba1993d5a", "value": "sensi_hk.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56ebf4f-923a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786091600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091600, "uuid": "83911a94-72ac-4019-9a55-5ea245b2a31c", "comment": "Malware payload (RemusStealer)", "value": "2af59df51773ab85d855e54abf3832ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091600, "uuid": "1fb22b9f-239e-4136-a75a-a2d60cdc22af", "comment": "Malware payload (RemusStealer)", "value": "7e1e424f3c184c3c037235494158be38a9e7b15e0bd4a97c7f854ab03a1f09ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091600, "uuid": "f292d4aa-40b5-487b-aab1-00cca151f383", "comment": "Malware payload (RemusStealer)", "value": "f36d28dcd12a3995f0d1b95530720f5dbf4a974c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091600, "uuid": "ef54434b-08fd-43be-85f5-e3cbcd65bfd5", "comment": "Malware payload (RemusStealer)", "value": "c379681182dddbb6549bcad111eae1c1df612b78a1c86d188b821017a8022bd7a58c249b31ee488b7e978ff8638a5860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091600, "uuid": "616710b8-8f53-469f-88e3-82333e416339", "value": "T133164A17AE9448F5C099E735C8BB5255BA70B84D8B3133D32E916E782F327D1AE39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091600, "uuid": "371479ff-68fd-41d1-adfa-76aacbe39547", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091600, "uuid": "79ca9b6c-70e6-4663-888f-77631267410f", "value": "49152:ZR4BeGpGbb+SZbdFsq262mlnwZUs+9kP7et2ub98+F89Yw3PFspLX6nU5Srn6vPP:Z/Gm24MGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786091600, "uuid": "607aeb9f-d36c-45ba-9373-9b8a96812c25", "value": 4038480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786091600, "uuid": "cf1bf3a1-c64a-4a07-a44a-0b95f1467ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091600, "uuid": "9a01ec65-c685-4d65-87a4-ddf7ba9117f2", "value": "2af59df51773ab85d855e54abf3832ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00592e2-92a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135534, "uuid": "0dbd7e72-9946-4658-ad01-a8be3584cf94", "comment": "Malware payload", "value": "ed737662652daac313618aff6e994975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135534, "uuid": "46180ee1-dd3d-4e3b-a5fb-a6459bad24ca", "comment": "Malware payload", "value": "7e6815495d078bff962365cd929cdcf8f0c25f24b9de5ee89bebec4af778d76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135534, "uuid": "7ca15708-39bb-4dd5-a3d3-33509568a998", "comment": "Malware payload", "value": "094e1a1da47df8b7d75e969854cd955b29de5e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135534, "uuid": "f451d931-9ef3-40f6-8f00-320b65d9ded5", "comment": "Malware payload", "value": "d641f8df8ec38206f4655463cfb8068a6abc98f1a04a0ecf665a5f74622deec3765bbfe1f926df061930c0f31faa0284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135534, "uuid": "87a1a3e7-2370-4dcf-a357-e78761272283", "value": "T191D5239928B50EB4D877C7728F43F1BEB0697B854F655D47B78C19408C22AA4AC3B378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135534, "uuid": "84f867c0-1b7c-4321-be56-4594a47580e8", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135534, "uuid": "fd09a126-e012-4ac7-9729-7b999d6e6433", "value": "49152:E0pDIE5NvwSmpma1FtDwTBP2N2/qo8AUwC2heC57UueBAVKtbiF+2sSKDHkYO4cj:E0D5BwL4ajth2/qtXqv1eBASig2TKDHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135534, "uuid": "5cb44585-ef96-486b-b2d0-587b2adda3ff", "value": 2911232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135534, "uuid": "2eaaba09-5c11-449a-a00e-d4cec92d79a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135534, "uuid": "7d1609f1-1c77-4d51-8c21-f12b30025aa8", "value": "7e6815495d078bff962365cd929cdcf8f0c25f24b9de5ee89bebec4af778d76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f6ba34-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786096010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096010, "uuid": "a494811a-b9ee-4ff7-be33-45919e2af4e1", "comment": "Malware payload", "value": "783e2d6de57faedc511d3a76040dc912", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096010, "uuid": "80e29921-b52a-437c-8bde-68ffe28380bb", "comment": "Malware payload", "value": "7e8b04a5331275ab6154539494b11185b30a3952f472b714ba6d2f95cd19c7de", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096010, "uuid": "cab0bf1d-fe7e-4fde-b4ff-0fadd972b579", "comment": "Malware payload", "value": "1855f198439eadfb32c21d6dc44ecc29918d5f0b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096010, "uuid": "77c7a1f4-87e8-4529-871a-3acedafaedf7", "comment": "Malware payload", "value": "7dcb7665edc1b47d457dc8afa5903f2954332a747e40193093a97328dda8da160ec3ea430e9a1d3c8511a380c1615881", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096010, "uuid": "7094a57f-362f-4c51-96b7-fe35e8d27c1e", "value": "T199451214FF418D3AC852923507E7B1E1C61ABC776E124E4F23457339A973AB0D672E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096010, "uuid": "7deeb88f-d2a1-4238-bca2-5381a5ccee09", "value": "24576:XKpt1QRT/64rm0rizKRj3g/5qYjTTwWXRtm10t5Q9BlVT8Cget:XKptmB6ari+9s9h4aQ338C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096010, "uuid": "34cffebb-f377-4055-9776-e4217e8978f8", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096010, "uuid": "424cb73f-099d-45e6-9248-dc9005365505", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096010, "uuid": "47dea0b8-8b19-409b-8097-4f7c198b09c2", "value": "WIRE PAYMENT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52f8c9e-9288-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786125154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786125154, "uuid": "7250218c-e055-44a8-b027-c40eff1df180", "comment": "Malware payload (Stealc)", "value": "a7896d977fe660b80c214495486f1f4d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786125154, "uuid": "d9b9c170-b3a9-47ec-bb61-19967789a7fb", "comment": "Malware payload (Stealc)", "value": "7fe1c82d5a257a35d527e78f05d35592c015f0dd8de1956d1e7f02ca70462f4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786125154, "uuid": "fefe6eee-4cba-40ad-b2d5-c7bdddf463fb", "comment": "Malware payload (Stealc)", "value": "b8601376c42b9ffdd0c599fa9650ab4f64674007", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786125154, "uuid": "b38e987a-64ad-41de-96a3-86e4fd803e5c", "comment": "Malware payload (Stealc)", "value": "c2d189e8368e3091eb3f02d2b77550a2568da363b4e3924ca290a2282de1dbefc1c1e07add62e3013d43a33a6de4a840", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786125154, "uuid": "922b26d0-9bad-4bc2-a1ad-e13cea9d2894", "value": "T136165A03AC9648FAC0A5A331C9B75256BA64BC0C9B3133D72E60BEB82F727D16D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786125154, "uuid": "3e3225ca-399b-4677-ad24-819ad885fab9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786125154, "uuid": "9718278f-3e52-4a42-9755-f8c020a3622c", "value": "49152:HoGo0hPviuu35seiNkWFdcBSl6SWI7vcgV7G0Oa:H4AKSASPc67GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786125154, "uuid": "7978ef21-712f-4396-8fdf-2ff1ea4e273a", "value": 4219256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786125154, "uuid": "b76d85d9-b7f6-4ed2-9a71-c01d697120e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786125154, "uuid": "4547bd29-63ab-465e-b546-e4669bb460d3", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6676787b-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126284, "uuid": "7c8244c0-5c69-4934-b1b4-6cad0415cca7", "comment": "Malware payload (SilentNet)", "value": "51b8e4439fa97d37a3be14fc6dc4621b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126284, "uuid": "901f5c75-218c-416d-9cfa-f82974e13e5b", "comment": "Malware payload (SilentNet)", "value": "7fe7ac744947ca3cd8f177a1050465f67449d972d077e97b168d07dc4955d60b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126284, "uuid": "f5bee71a-e7c7-45b2-8641-1f76ac6f9973", "comment": "Malware payload (SilentNet)", "value": "93efd640f81c010c17c67b08949eac8b708e6bb6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126284, "uuid": "622c5180-afc6-4087-b14c-ead9093b2239", "comment": "Malware payload (SilentNet)", "value": "953bf899e5faee535e718c34abbfe6752b930bb23668c28d91e77e0add7d6e23b7f0570ce44b89e11d67c5566ff8077c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126284, "uuid": "6e80992c-403d-4b6b-bc1d-772458cb17e7", "value": "T1A14523A7C1768D3DC87B723902A41AA3B96FAE11FD1CF15D5238101469CB7CB0F96E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126284, "uuid": "ce9facaa-1203-4f00-beaa-e71804843787", "value": "24576:kQRO/id/c8CkueEdNprxJvoFItZAihcZtUUdv3OkXtotlYdt:kF/id/ekSrxJ5ZAectUUvekXKtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126284, "uuid": "1ce9262f-7590-4399-a43b-044e151be0df", "value": 1236727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126284, "uuid": "2c19f009-eed4-4dbf-a284-a15103e714e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126284, "uuid": "f9d7ddc3-a936-4431-b21f-1c6cf629f944", "value": "tiers-0.7.3 1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58195ab-9254-11f1-bd95-42010a9c0009", "comment": "Malware payload (TELEPUZ)", "timestamp": 1786102875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102875, "uuid": "132dad18-0b11-4961-81f5-a86d18f5e23c", "comment": "Malware payload (TELEPUZ)", "value": "7544d0d40c63ea020416d01832a366e5", "object_relation": "md5", "Tag": [ { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102875, "uuid": "fd3e64fd-2e69-4fe9-b318-b84d5b35ae47", "comment": "Malware payload (TELEPUZ)", "value": "802dee2011a757a13f6afc236e66c6e8440bc733eb001d849286c22d43b0017e", "object_relation": "sha256", "Tag": [ { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102875, "uuid": "472baf24-ad20-43d9-9969-644db8a04b82", "comment": "Malware payload (TELEPUZ)", "value": "659986fef1ee9fb6f019304a435a69ffe9335082", "object_relation": "sha1", "Tag": [ { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102875, "uuid": "2adc514e-1b4c-4f6b-9080-c696bd426d7c", "comment": "Malware payload (TELEPUZ)", "value": "a7b937e194d419bd502e02a065adad96200892631fc6b49c475c09569d38ac89e08d49acd1251c026175c26e802d454b", "object_relation": "sha3-384", "Tag": [ { "name": "TELEPUZ", "colour": "#888A52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102875, "uuid": "8bfd57fc-0b26-49fa-a7ed-217a9b8698a2", "value": "T125741A59F183AEE4C4F7C335935612A3D9FCB80913349E3BABCC56252DC0620B6696ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102875, "uuid": "f3e07e01-54d6-4cc3-b1cf-f91191b9b521", "value": "2367deb0c3a7b072957833d712f34f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102875, "uuid": "0fe4f497-9079-489f-ab33-e3971159310f", "value": "6144:0eOHjRlJIZpruDTrOZeDCs+KGbWycxlAcXEkt4yZ/hsljanoIIrRdGC:vOtlGZ1wnOECXuycXAc5sl+nsrDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786102875, "uuid": "5a88ca34-f5a5-4d8c-a75f-a41c4e209939", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786102875, "uuid": "b2f7c2e7-c3fd-455a-ac34-421fd581e01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102875, "uuid": "ce62dedd-0348-4146-8a49-7a14e456155f", "value": "802dee2011a757a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1849c490-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099524, "uuid": "d31a6ff4-9be0-4b40-9ff3-9dcbac7766a6", "comment": "Malware payload (Mirai)", "value": "8af365044e437578be98e8df00ff8fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099524, "uuid": "0104c62c-57c7-42b5-b3d9-f2dde953a1a9", "comment": "Malware payload (Mirai)", "value": "8066879b9b5c06f9d81b2d0dd8b0f1bb554b93319e62c22d28d04de4cbe4d2e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099524, "uuid": "115e177e-1219-4281-98a7-f86c3ec09a47", "comment": "Malware payload (Mirai)", "value": "6e10041348fb586c70f8d3cd41769304e9311124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099524, "uuid": "0122c39d-236b-42b5-9963-e19b8d7c3b10", "comment": "Malware payload (Mirai)", "value": "43fb6169f57d668259dc8ca74974b1c5ec7d5092b50b196f3d5de814b080c5a6912397ddee60bc725e5f98e66fd60db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099524, "uuid": "b75bb38d-252b-46be-899e-c3f0a4251398", "value": "T18C435316ABA1DE77DC1FDD7305E8860124CCA49762A92B2B7170CA6CF75B88F09D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099524, "uuid": "88c45aad-ab61-4159-823c-6ac645df61c0", "value": "1536:a3Gi9vflsdMus5KEd9llnrQUFpVlzIlZj65ApLWg6wKIpjH:a2i9vNsdMus5ZJ9rQUjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099524, "uuid": "faccfab9-7c6a-4620-8ca3-61b4f5e14a73", "value": 59212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099524, "uuid": "232f0b59-ccea-44b8-9369-67976fc5b697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099524, "uuid": "1a4cb4ae-d654-43df-ae1b-7c7e383e0fbe", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487408.20741.22606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d68a42-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099538, "uuid": "309bfed4-4e4a-4729-93f5-883ece842446", "comment": "Malware payload", "value": "3d5066226c8fbce6c2d432a107f8ca71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099538, "uuid": "df7e5ac6-72a2-4ce6-a91c-1d28a6820782", "comment": "Malware payload", "value": "813499b8e97a01081c3154a4d083ee7b4aa10a1b623ddfb870f7b7d351fcbf65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099538, "uuid": "34706d62-a22c-406e-98ac-ebec15eabd57", "comment": "Malware payload", "value": "c6031fd54f9161142ef683e9e0bb5c85b48f8638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099538, "uuid": "7d8b8365-6d64-4f1d-9c64-108851d54966", "comment": "Malware payload", "value": "09fba8dd45067020d00ee5f06c09e788b00fe7dfd2a2a14432417c6c90068e984ef76b92a365f9649e372f34986b3a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099538, "uuid": "5d377fc9-fa6a-43e7-adb7-db37bdf3414a", "value": "T17F531B23FB0C0456D8D36EBC0E3B0BE68315AD5220FE9505750D6E9E1B36F315687BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099538, "uuid": "c9c45b44-d9c5-4c5d-906c-e6d3ec270c7e", "value": "1536:o7nZyaGqiqufV3/7BNH0y58TReNgShHq7/7A3jT184DMTW:o7nZyaGtdv1NUHeNfH2/7A988Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099538, "uuid": "05ec7cac-a2fc-4a94-bf58-c32b73811505", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099538, "uuid": "519829c5-eb96-45e9-bced-24a0fba0005c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099538, "uuid": "a8be1596-f31e-4069-9e80-ca37358b7a75", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487438.30806.10839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9e1650-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786097845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097845, "uuid": "6b319c80-929d-47ed-9fd5-38be4ce85419", "comment": "Malware payload (PureLogsStealer)", "value": "5b74f62315bd5dba42169868407fae94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097845, "uuid": "0b60b741-1af7-4b8c-88ac-1e7579343e14", "comment": "Malware payload (PureLogsStealer)", "value": "81875cf965875c6374ecc1d6730ba629f463f00fbb6b695be1587b3103f97659", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097845, "uuid": "de2a4eed-3cff-4d6e-81c3-1f73e090a46e", "comment": "Malware payload (PureLogsStealer)", "value": "1b427d8ef19e0165f66b8a80973cb35cef110dd1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097845, "uuid": "c34590be-9739-4790-8d42-d4682974d174", "comment": "Malware payload (PureLogsStealer)", "value": "67d0aaa17aaf46f8325fd4c00a2c02f8081d0b85bc3e3f711f20e326d29f0e30307cd15f0de1c0c1b3ab8b1c44b36676", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097845, "uuid": "2454831c-7f33-45c5-9740-de9383f46f4d", "value": "T1D4D5863A872A3D2A61F610A5ED1751C03F986C99D1A2C8B3D06C2B3324A75FDED93477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097845, "uuid": "95fcd7cf-2670-444a-b828-a4a34bfb19e5", "value": "24576:BgWjWfb8oeWrk9TqDs+5mQrdlvBJunH5Xd/9RG2aNjphFOrGhx0ZWmoXO96VL1z/:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097845, "uuid": "61dfe385-16b3-4350-b009-715767e3868b", "value": 2870833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097845, "uuid": "0a52871d-61cb-4a75-a893-9893d54a6f8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097845, "uuid": "cfcfe892-3476-4096-a04d-116810206a35", "value": "PO-0481664.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acac35ab-926c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786113087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113087, "uuid": "026202d7-a581-46f6-ac51-a7728e6a5e3a", "comment": "Malware payload", "value": "fc23841500f92c5ae673754152d1e3ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113087, "uuid": "82c5b17e-99d2-4f00-abc4-7ebe5740c75b", "comment": "Malware payload", "value": "831490c1148e6c282fccfd734771962d126829c7d2bf3a758d316af9a4592df4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113087, "uuid": "33760ea4-6b7c-4a17-ba82-5be08b525ea0", "comment": "Malware payload", "value": "9c81186d8245ccb4903047f4b24d2fe3ce8bc1bd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113087, "uuid": "8ca95605-ff52-4988-9dd1-6bc9e7b53e42", "comment": "Malware payload", "value": "e234d6f05163b1d374c7f50659522a2c24a389427da031000037e5d2f7c815684a8db3a165f17dcf303129b47a0c1041", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113087, "uuid": "3114e829-beb5-4204-9a6c-8e4db45aabfb", "value": "T158C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113087, "uuid": "f91d87a1-d866-4d38-ad90-e48254bb70aa", "value": "768:E8vCB+25j6es8RE29FYpMSUpi+20qUpi+20YQX:E8l25JEgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113087, "uuid": "5d0c0a0d-e315-4089-89c3-e59136fcaec1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113087, "uuid": "58c5daba-300b-4930-b9c6-2b39c86f4163", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113087, "uuid": "22190785-8bdb-488a-9cc2-c79dc8a37f04", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3daa06-929b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786133244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133244, "uuid": "9b088a72-dba5-448b-9119-e9edafb33847", "comment": "Malware payload (Mirai)", "value": "fa0e91a2b43f3c9b00629d4b9acdfc58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133244, "uuid": "d81fe128-a246-4419-b1c0-9594eb4f6b13", "comment": "Malware payload (Mirai)", "value": "8355b042d1d2e9e3276091ff1998ba3295304314ae54e5655bc9945693362cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133244, "uuid": "7e5286a8-f2bf-447a-a609-e5a4e56d14a1", "comment": "Malware payload (Mirai)", "value": "1a6f275f6fb4e11bdff8db0d94a4863d36247551", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133244, "uuid": "2d99a2b5-152a-487f-8e02-c015862023ba", "comment": "Malware payload (Mirai)", "value": "1e830a9643c577a4b762cb6184af4a3d1d6f6193306fcf7c35a73e0432dcfd7704a44741ce475b57ab7c151d399b2db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133244, "uuid": "955481f1-f6c8-4aed-8040-f378505537a3", "value": "T11A43F2424441ACB4FAB02FF8C8248310291FDDB4FF3E7961585B9679AF411977BF46A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133244, "uuid": "e1e4aa68-0fe5-4020-b622-5c274cae95a0", "value": "1536:rvSjITxfWMovH0oZpsaaaZa7H3K/MlPbuCQfB:7SjmOMQ0oZp4aZaH6EBbTQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133244, "uuid": "0afa64bd-155f-43a3-8da7-aa322d95e4c6", "value": 56560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133244, "uuid": "6169b1b4-e53f-4b70-8512-7d23d74beef6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133244, "uuid": "c84432e5-d504-4a7e-bc41-561bb694f964", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b87bc0-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137907, "uuid": "368bfeb5-ede1-45ae-931f-4d57bcd0604a", "comment": "Malware payload", "value": "7dd209e5fe97f7f73676441ad3a0e82b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137907, "uuid": "79647c8b-2686-469e-8229-7689daa69b4f", "comment": "Malware payload", "value": "83abdb13cedfd71e237b3ecb2ce8d88d0160098a0a3cefd5750c1d3412e69ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137907, "uuid": "3ef1c9e6-535c-41f6-9677-4d19bf8c31ab", "comment": "Malware payload", "value": "194e99268082cfdb319a58f0994406eaf59acb88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137907, "uuid": "3d37c47a-7f2b-41e2-a41a-34bc53a1b89c", "comment": "Malware payload", "value": "30f1b861aec5b26b8b80321242f8a5d7522b6c1bd8368669b368becd068e9a26d45375f7c34145ad37772b63e7b99201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137907, "uuid": "7bce2c8c-eb04-4fc6-b8b0-74c6f9dbfddc", "value": "T18D23D517B6A3B4BCC34BC0B45A9BD5F1B8317CE402253E3F97C9EA302E359116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137907, "uuid": "a88e63af-e470-4287-a650-de1e8ef870a5", "value": "768:FTfm+CmyF+mMEUU7UYBKMaScHw5eYtPwOkMO/Tlj4J:Jfm+C/KS9B3/cQ5eYtPmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137907, "uuid": "430435f3-98c5-4219-87e2-7f80b719bbdd", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137907, "uuid": "e98fe299-2c2b-4bd9-be4f-660115701037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137907, "uuid": "3b52a7c5-add6-4355-b4c2-00184c19ddd3", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f04e74-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786097825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097825, "uuid": "72348798-f8cc-4977-b95d-3c4bd5de5170", "comment": "Malware payload (LxBaseRAT)", "value": "7e9357fe8f0324b0516d32e75bf05754", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097825, "uuid": "63c2fc43-4e36-4640-868a-450097563a96", "comment": "Malware payload (LxBaseRAT)", "value": "83f653791490f197bfee667c341c853224fc297c54df067e51dca1a1d4126826", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097825, "uuid": "d1ffc1d1-7abf-402c-91d1-bb73cc7ef610", "comment": "Malware payload (LxBaseRAT)", "value": "d3bb34f29101c216c2aa4fbc49290585bfdc4031", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097825, "uuid": "6deff411-ee4d-4536-b232-21bfb1ae7419", "comment": "Malware payload (LxBaseRAT)", "value": "b70ee53336a19171edf9606712380b65f889a6bb2e9266986c43d35ce35e6357ebd23d1ece821235fead7b320595b029", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097825, "uuid": "e55e0987-536b-46aa-b443-de168f93730f", "value": "T1C0056DC941D6DB25169035BF2F8901D037D548CED0759E9CDDBA8EEE7A8C62A81F88F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097825, "uuid": "a51cd296-ad88-4278-89aa-894534177599", "value": "24576:PTzZD6GwSanTULTUrr1RzBVLqBmPXNj56EL:vZDRwXn4LTg1RzBVLKmP9j1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097825, "uuid": "05ea33e6-b13c-451e-8ce2-81cd7f4601e5", "value": 844448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097825, "uuid": "e115f1b8-82f7-4a63-bc69-26efd00c22ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097825, "uuid": "76b19c8b-9de3-4c8d-8468-ae650f089fab", "value": "Purchase Inquiry ( Prices ).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e316030-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099534, "uuid": "855a2fcb-86da-461f-a471-3213355411c3", "comment": "Malware payload", "value": "054d22e5a9da4ae82a24618ecb41a6e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099534, "uuid": "2fcf2161-ddda-4e42-adad-f1c2f3f4151e", "comment": "Malware payload", "value": "8453e6a7118ff16a38dd9fdbde7dc16af44c310bd53ec542e2d89d734e613267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099534, "uuid": "52f680f4-22b3-418a-8053-4908a598ad98", "comment": "Malware payload", "value": "1a3dd1d21dfb2fc48c8612305b413f2e38783d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099534, "uuid": "30208131-2ac2-4368-bdf7-75eb14146728", "comment": "Malware payload", "value": "317f1320a3dc3c781852cb940afa5d00a9f06f1eca61c8590dead93437459b76681eb481eaf32ec222e870c19ca61489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099534, "uuid": "bd06b5af-9b77-45cb-b9e7-c6562a880208", "value": "T1D463EA06EE926AF7C45FCE70552DC24A00DA5CBE92E9511E31F8D98CBBBD3064AD7C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099534, "uuid": "96fd04b4-15ce-45b0-93a3-9419d73f3b55", "value": "1536:g5v7AJfuCnu+1uhKsuzHBAI2nkkRqdLDW:IjMuCnFtA1Rqdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099534, "uuid": "3bf4d283-4669-4a6f-94f4-a53d52c3087c", "value": 72836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099534, "uuid": "9be16c56-a688-4f9a-b039-91b3d102d305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099534, "uuid": "ec8a2715-8d64-4057-92ba-6bde6561a646", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487424.16250.10869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6de885-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137914, "uuid": "ef3dd8fa-327a-4cfc-9f50-757192b12736", "comment": "Malware payload", "value": "d52075dd350cae4bfab4100c72f92b51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137914, "uuid": "e7a1425e-a881-4e6f-bf69-dd2252443019", "comment": "Malware payload", "value": "84798233fabd3ce3ad0fc51625578c42445838385078062cc5e9cfd1efc81c0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137914, "uuid": "ca83e5ec-0449-4085-b62a-c37f326dc8db", "comment": "Malware payload", "value": "c640147077aa344efed1a9a8520d7058e52ba7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137914, "uuid": "28de544b-8278-41f4-90b6-88baeabecf90", "comment": "Malware payload", "value": "b84f2022c5670c837702987c1ff3d5b645a8c5511dcf254b6785dcae0b178a129a1791ed172ba39e87f2ced55e663d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137914, "uuid": "330cab22-27a0-4245-a457-cb04bde62fd2", "value": "T18D530A51EF0CA817C9666639A5372FA9F3A0B8D11170CD11B3053B6F16F3632AC87E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137914, "uuid": "2a597f90-3ab2-4da5-b84f-05df013981ea", "value": "1536:T4pJZ76lYMNn67lUAhvFahOQs/AtgsLShOPMpefoFH:T4pClYnlUAhvF5/Atgnhkgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137914, "uuid": "195e9e0a-b64f-4be9-90eb-0e6f2697a6f3", "value": 66608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137914, "uuid": "ee040e77-35ab-4fcd-8a35-89fa345820aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137914, "uuid": "12f82f87-7883-468b-9df7-2807d381736b", "value": "main.e6500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5d3c1f-9252-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786101762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101762, "uuid": "0f1a0a85-2c3e-4581-bab0-8e6e38057c5d", "comment": "Malware payload", "value": "5fc2d7080062d81b8b5c8722c4b1a84a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101762, "uuid": "c2dcc514-d9c2-4751-8b5c-f3b9b25038cf", "comment": "Malware payload", "value": "84843c8d447edf5253df7903713d158106dc4a7833bba85ecdaf7dbef7d5a1c9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101762, "uuid": "790dd990-3907-431a-9d76-c6e417eab5f3", "comment": "Malware payload", "value": "ec27f5355568a8126ff8c8d263e1ca68185fa558", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101762, "uuid": "79441dec-65d2-48a1-8281-10416557b661", "comment": "Malware payload", "value": "a70a315ac8c69e24d66fed796ccddf7fcfac05e214784e335eb2e81675b72a5ef467c7ee365cfaaec3de6a694a18de94", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101762, "uuid": "638eba80-cdd4-415c-b08c-a42a6b019421", "value": "T19A236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCB3CF28C4AAAD920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101762, "uuid": "543c3e8a-a378-45b3-81d3-6b04e59a9708", "value": "768:g9NyXsZztCf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:gHusZ1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786101762, "uuid": "c77c4ffe-4fb0-485e-814f-acd368880aa9", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786101762, "uuid": "35a5ba67-f4b3-41b2-a332-7f422ec4c075", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101762, "uuid": "00cc8dfc-f674-4f34-b254-ae20672915ad", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcf7f74-9203-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786067780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067780, "uuid": "f4ea8f06-f378-4c65-aaad-498e176d687e", "comment": "Malware payload (RemusStealer)", "value": "066dab36fbf44cfa930929d002a07cb3", "object_relation": "md5", "Tag": [ { "name": "37412fcd9a39df7667b49f4bab671219", "colour": "#D3B662", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Vidar", "colour": "#589218", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067780, "uuid": "15fd51d6-6f9f-4dd4-904d-e14389b55a7b", "comment": "Malware payload (RemusStealer)", "value": "84b8ec2f3b29a10f88d21fc7617cdfecac1c2c76303086b41471beb5f563f65c", "object_relation": "sha256", "Tag": [ { "name": "37412fcd9a39df7667b49f4bab671219", "colour": "#D3B662", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Vidar", "colour": "#589218", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067780, "uuid": "cce13ab5-4c28-417f-9526-fe0de365cdef", "comment": "Malware payload (RemusStealer)", "value": "9ba5a8bf9564e71f333406b3e4962cac35e33a38", "object_relation": "sha1", "Tag": [ { "name": "37412fcd9a39df7667b49f4bab671219", "colour": "#D3B662", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Vidar", "colour": "#589218", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067780, "uuid": "f98c338f-19bd-4045-af07-223cc7cb9161", "comment": "Malware payload (RemusStealer)", "value": "d962943afadfbf3b4819cae11afb6e44a505c60bf1fa2a7bc567be60fc37b4c02a479ca8f67699e18ff503736e32b3da", "object_relation": "sha3-384", "Tag": [ { "name": "37412fcd9a39df7667b49f4bab671219", "colour": "#D3B662", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Vidar", "colour": "#589218", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067780, "uuid": "08801701-d6fb-46e6-a255-fa8f1b6bc9aa", "value": "T1F064C005BB6710ECE1778978C8581662FB773E614350AB6F0360B676BF336A17C29B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067780, "uuid": "94a5827d-ac07-48d0-b2ae-cd5795fd5b9e", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067780, "uuid": "27aad993-36b1-4c26-90d2-beb80095ce0e", "value": "6144:rQxVrl4fkcCYDHElcLjm+WgUqeIw5mMVDMbEwV19ohTNwyEtSo4V:UVrl4fk9YjhLjWgPw0ADMh/SkX4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067780, "uuid": "547a628f-b5aa-4744-9dd2-8bd5720f58e1", "value": 336792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067780, "uuid": "7d1b6368-f19c-4bca-a38d-67e830e4ad44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067780, "uuid": "7cfdf6da-437d-4786-9e45-720218ab8c21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db6a8b6-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137892, "uuid": "f54c452d-a27e-49f0-8404-b65ed8aed38f", "comment": "Malware payload", "value": "1d38e5cbd1bd843e73feeb6904ccffc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137892, "uuid": "56223c56-00be-4720-bcc4-19fa3cc2e8ac", "comment": "Malware payload", "value": "84ebfb4b1c8c375ed9feb70c75651a4fc49feaa8c4acabd0a39048a0b2f0b4ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137892, "uuid": "2535d728-e18a-4f95-aac1-dfc908b14bcb", "comment": "Malware payload", "value": "0b38f4794c90bebdea8178bbbb2a67ec1870db73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137892, "uuid": "3e0f6b39-3391-4b88-a202-3f1ea241aec8", "comment": "Malware payload", "value": "1a2d0859ef244461825f7aa58e7a21a636479ca611cbdd2522e737d8215a407bf4c3bc6e4fe90c5a916d4428d70fcd4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137892, "uuid": "0da03eaa-e47f-4274-9eee-dd4310611e09", "value": "T130230885F653C1B0E18392F008A7C7EA9634DE37505BE6EAEB8E3921FC313418D9656D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137892, "uuid": "c55712c9-f3e5-45fc-99e9-76a9d0041d00", "value": "768:2rL4//mD+rVkX4dMQKGMUAAW6BNcEgxvPSOSSgpKcV:2rLA/mD+CoMQKlA3kPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137892, "uuid": "a26de270-9866-4095-8a70-5f69f089f565", "value": 45860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137892, "uuid": "47d6e4ef-a30f-41e9-90ce-1fda7f51af99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137892, "uuid": "fc4bb3b1-ee7c-4aac-aef7-574e316ef987", "value": "main.x86-i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97432ca-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786097700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097700, "uuid": "db984d73-5186-40eb-a336-0c208b472a00", "comment": "Malware payload (PhantomStealer)", "value": "b507b83b386fd8f3913b4a69b099a183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097700, "uuid": "9bc5ef51-c1ba-475a-8898-a90bceea2958", "comment": "Malware payload (PhantomStealer)", "value": "8512bee0bc7e85ec6218b1ae5083babae6198d48e7503b5da6990757adc3b745", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097700, "uuid": "a0fe6ff0-afbc-40ee-8f3a-18642d14031d", "comment": "Malware payload (PhantomStealer)", "value": "6c484d465a14aa8eb2f387de951ca2c9b011c857", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097700, "uuid": "ed188539-0803-4fd2-af0e-c96cb100e14b", "comment": "Malware payload (PhantomStealer)", "value": "ca35ce1516513d385bfa12db59505c5d8e0677ab0d33e73b90fe69c107b94edb79e76163ba2389617c34be9339857aef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097700, "uuid": "cd6dc3ee-d2cd-46c0-9b8c-056c2b7d448e", "value": "T1FBE3DE520DC67469237767BE622BB4E1E76A4A274244291B783CF440DFF3A0ADED0D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097700, "uuid": "9a6b899a-28b9-40d1-b5fc-0a828e1b0445", "value": "1536:pMM/0j4IWWRrJFY83a2SfABvkkHvzorFm3mkshGaMSEOpIhZ8Y0SgYgTv7jt/u3i:r/08YZY466mIAhkTBBfssuL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097700, "uuid": "2f2b0273-957d-4d59-b221-4ec8ae77f597", "value": 145289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097700, "uuid": "adabea4c-0bff-4881-bb0c-16ab5994156b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097700, "uuid": "e13b1482-f8ec-470d-9117-a923a0e4276b", "value": "JUSTIFICANTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cc477a-9267-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786110873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110873, "uuid": "4fd2741e-1c2d-426a-9b80-c0315a715afd", "comment": "Malware payload (Mirai)", "value": "9de2fba4e0eee15c76aef78ae5f4c1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110873, "uuid": "ea333f87-2e5e-4cbc-852e-cdf0e380350e", "comment": "Malware payload (Mirai)", "value": "8528ad198c42b80a0ec5e6c352d61b244ae66ac79b6f97acc5fa53f9ca8dc74c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110873, "uuid": "97dd443b-feab-49b2-a748-1999b04686a1", "comment": "Malware payload (Mirai)", "value": "ef1d0bc96b7073be7f72ad3ffaff027915ef2766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786110873, "uuid": "f7339b53-6151-4a8b-ae20-14465e631ef3", "comment": "Malware payload (Mirai)", "value": "313d514ed2b84cefaa12a581fbfbef67daee454a818deffd5e9d60c2a33819145594536ee4ffb1285d4685ccad328195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110873, "uuid": "f1983872-e170-4eaa-8de1-cb3d707625a3", "value": "T1FDC43955F8809F61C6C53976F64E42AC73070BB9D3EB72069E145B343BEB86B0B3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110873, "uuid": "34515fe1-a4c0-46b8-a9b8-e2f6cb522124", "value": "12288:Fbtfdgkwg/OGS0Xl4/xXbBDWcXtaWpmCy8pLZ/292:p7wg/W/xVDoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786110873, "uuid": "20eb4b93-7f57-4fc0-b96f-5183ed56ad41", "value": 596268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786110873, "uuid": "4b0569b2-1017-428d-9b68-c254c480246a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786110873, "uuid": "8d33393d-33b4-485a-8361-5ad5dd948678", "value": "xd.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75545d4-929f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135009, "uuid": "7886c0d3-569f-490d-872a-c6d985bf1786", "comment": "Malware payload", "value": "f3099419fd31e65cfd1e84f57e4d2ba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135009, "uuid": "9c037440-a2e7-4671-b1aa-5ee605bb8317", "comment": "Malware payload", "value": "85e137cce38fd043ff723f80610d52adae34db5b2a4d528273308225efa0688f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135009, "uuid": "6c7b1eb7-d125-4fbb-a32d-6d10ebba20c1", "comment": "Malware payload", "value": "182c3222e4fa05bb453d8106acec821b440c9046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135009, "uuid": "1295f346-844d-476d-802a-9fae4b0dbbc5", "comment": "Malware payload", "value": "0789f8f8ec00e21d1c91019feed78de477d497ea40ac9c29cc1ef1d2ebfbb74dfbb9fa675122ee7cee2ae2a2bedb20a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135009, "uuid": "1cf6ffe1-28d9-4d81-be46-4d102258c842", "value": "T175230998F8449B39CBD475FAF50E43DD33020FA8E6E671118E219B313BB79194A3B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135009, "uuid": "4231b5da-53d8-465c-946f-68f9257d185b", "value": "768:e165UO1K+wRsvX3lsWK0kSf+9iGUAl3pZtV96c0YSWfwRJAVLxiyrEx:e165Up+qsvXVsVfSfaiZe3pPVH07ReVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135009, "uuid": "a5c728b8-9cc6-4b7f-8880-915e0d0970d7", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135009, "uuid": "e9481aca-2167-4157-840c-ddf0ca03fbee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135009, "uuid": "6ea7f35d-efb9-47c2-85d8-fd74afe8f7b0", "value": "main.armv7-eabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f987aa1-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080262, "uuid": "07167a76-f89d-4173-a0b4-1383fbba2aa3", "comment": "Malware payload (Mirai)", "value": "b3376c0695d563b9ae8742a1fb5f32fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080262, "uuid": "0f357dd2-4f12-4b1b-8551-9ae7bb44fe46", "comment": "Malware payload (Mirai)", "value": "85e1a80169274231655e552d930cf915c297b9a2077bd495b3572d2b3b269a2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080262, "uuid": "21f1120e-c1ed-459b-bbc1-aabb648f9c89", "comment": "Malware payload (Mirai)", "value": "22cb03bd4edd5e0f52f31bade53dd15ccce11dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080262, "uuid": "6712aa05-4c73-4edf-868d-5d5f683acc6b", "comment": "Malware payload (Mirai)", "value": "d30b4ee5c78ac372424db541d28eeddd753b45e2a44867ab5e4fa5cca5f61823f8dbd57e8d36f81427984c8a67cbd2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080262, "uuid": "daeb158d-38ee-47ac-9061-40984d2caa90", "value": "T1E153025551C2FDB8F5EDE0F659BA3D268620960607056B42D4BCB5348E70BF223BB4B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080262, "uuid": "42085c85-3b1b-46d8-adec-557f0862b0cd", "value": "1536:eEQHcRBH1sLwyjIVOlv5G30seIJu4/pW0z6jpnouy8DMT3:4EU64levuUp2j5outDMT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080262, "uuid": "75b8239d-d2d1-42e4-8230-2c9bffa2b7fe", "value": 62012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080262, "uuid": "1827a04b-d93b-4d5f-a1ba-b27d9a90d756", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080262, "uuid": "1d120d51-b62d-44ae-9fac-05e772248bdd", "value": "85e1a80169274231655e552d930cf915c297b9a2077bd495b3572d2b3b269a2c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8841081f-92a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135360, "uuid": "bb8d4338-e3fb-4fa3-9716-cdc9f307fc47", "comment": "Malware payload", "value": "c469c6fca01a124a937fd30006b26025", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135360, "uuid": "07019a68-10d3-473d-816a-3e740ec27675", "comment": "Malware payload", "value": "86c285b71638c91f36b35eb40b282f997396f6015d9821a2e446bf677703c8c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135360, "uuid": "558843f8-bf63-43ff-890b-6e5ecffb25c6", "comment": "Malware payload", "value": "5e4e45308c48e6c701418ae90fbafbc6693558e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135360, "uuid": "e0e223d2-bc4f-46ca-b79b-ea5d3da87836", "comment": "Malware payload", "value": "196723239ce7090612a1072f2b2fc12b445af60f41b1f184325d71f1e3b91ce03cdbd700f1bd1c80b66bb414d6f852e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135360, "uuid": "19764f54-6193-4cf0-a5ad-f401ff7d0fb3", "value": "T1AC1171E5A8D648326F095C27741C5C97B281042B00F92DD5A25DA9636E0CAB96679F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135360, "uuid": "5f1e21e3-6a76-4139-8f28-8a66402720de", "value": "24:aotD9jWijWr5jW2Fr7jN/F5haHifMDsxVexUQjjJjCmYXmYRYCYJ:aod9jpjY5jPnjN/zACfMDqe6g1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135360, "uuid": "bc827a14-aae3-4ee9-a46b-8a0e0b2d2276", "value": 894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135360, "uuid": "ab3c2067-7ad8-48ec-ba15-3ad5028b67c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135360, "uuid": "5d942ed6-77db-432c-b2d3-bf85ba670519", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1595c76-9297-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786131563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131563, "uuid": "9307dc34-2d0c-45e5-b8e3-a0728bce1f06", "comment": "Malware payload (Mirai)", "value": "b6dba5ca2ad53b691d3e723aa8577de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131563, "uuid": "1bf560a4-5a75-4523-b1c5-705dc190739f", "comment": "Malware payload (Mirai)", "value": "8720838f066ff9e52f05805c239c77eb2c849dbf10ae801082922f86730223a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131563, "uuid": "d713e6da-17a7-44b7-bb73-9d61e5bc2cce", "comment": "Malware payload (Mirai)", "value": "c8e2d93ee16edc3fdcf85adb04491f4c4cdba20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131563, "uuid": "d5f73bdd-f8df-4830-a1ce-c1b6f068d9a3", "comment": "Malware payload (Mirai)", "value": "dc0078c937aa7b53c3ab74712676a6766b77be49519f4631c17525cbd7bc6bf6b42a268cfd7e7d9bcea382afe0f53a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131563, "uuid": "e7b49b89-2d15-46e3-a3fb-28e1d3293ae0", "value": "T1AF83025F469D27CDD650D2B377A7442D2A382B3F27FFD29A208D8C50AE215979118533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131563, "uuid": "861f5810-903e-41bd-9e8e-4724b3982b54", "value": "1536:e1akWEQlm4HCi7pMiDN4IhQWM6f4YskVkLV1RW/jn/FCXZCK3kdMkNk7qU1Ltg7k:SfQIi9N9/M6Ac6RWbN2p0djkOU1LU0fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131563, "uuid": "1c0a639a-065a-433e-9901-88cd9fe38fd0", "value": 83616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131563, "uuid": "abdff109-b656-4765-8746-6e054ac0a68a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131563, "uuid": "b9f90dba-8c2a-4dc9-9429-e2d4415e9fc8", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fca7a8-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099548, "uuid": "c687d7a4-271f-4728-a226-43b21ac5d44e", "comment": "Malware payload (Mirai)", "value": "c63d38302911b883f437fd2f472c316c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099548, "uuid": "ace3bbcf-e573-47d1-b032-0585f7246b1c", "comment": "Malware payload (Mirai)", "value": "8780afada200484e3e872d16a8f09696ab9b214f59bcde4b13f5b016243fac6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099548, "uuid": "72ee8b71-7c60-458e-a7f9-6ff30b9faa2b", "comment": "Malware payload (Mirai)", "value": "e2a499fa11a0f0edf72f3a6492faf4a21206fbbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099548, "uuid": "130bac02-4daf-4d84-82aa-8443bc1aa6bd", "comment": "Malware payload (Mirai)", "value": "7fdf6714368edaf3faa6659eb0712613a860aeadeb966f1c1046076d0180d91b4bb7950f057af0ea0feffec7ef611ed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099548, "uuid": "cce7770b-079c-436e-9de7-e0d332ed1fd6", "value": "T11F03E882FE1A8607C2C273FBF75D428C7B2A6EA8B3F932155A306FF133865D11526161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099548, "uuid": "ab82de8a-0ff0-4311-b58b-a20c2370bc1d", "value": "768:HN777c3DLaPZRaPyOhaadPbUk/V7FQFGPpLIvQ8DKHBjxD6:F7Af2KhxV4k/QFYLIIVh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099548, "uuid": "00005a92-27b3-4bc5-9c82-473260745ce5", "value": 40144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099548, "uuid": "d1afecae-0003-439c-8cb6-23f5d73848fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099548, "uuid": "0340af24-2f8a-41b4-93f3-583a3b9f0e08", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487423.15297.6000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ade9f9-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126262, "uuid": "88a729c8-f78d-4475-9286-eee27de8c2b6", "comment": "Malware payload (SilentNet)", "value": "5bd008c055afc5a561d74eef480557ca", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126262, "uuid": "55fe45d2-685c-4869-b05d-6b3f43da0071", "comment": "Malware payload (SilentNet)", "value": "8805e88908e6af8d7ab80870872cf5d29fcf5c5a05f30a3dca3293c665a3ba20", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126262, "uuid": "b2165bea-74be-43ac-a214-caa70e014e1b", "comment": "Malware payload (SilentNet)", "value": "3a18be038e8eb8fc9c88dc46f6e268d6f34297c1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126262, "uuid": "030b7e5f-f150-4a29-a959-0e7b78129b4f", "comment": "Malware payload (SilentNet)", "value": "2554ed24a5dc0ebb79278dcc6f92c6d3fc623b1560f1648b419ee98acf2ec22deda846d4c6a5be3f4bbdac37511cd2b5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126262, "uuid": "53c76e94-8b97-4fcb-985d-4a239142964d", "value": "T1A85533F76909B06DCD939B3348459ED8B1C1FF2A60C531A91D215DBB2183FED6F608A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126262, "uuid": "e6400989-169a-4f8a-94cb-ed4d18c899a9", "value": "24576:2Y6lcbj5PzjFN7L3177UvmXzOFV1mx2eTn4snqyzXY9QeZ1/Yx8tDGRZy:2R6bBNtc9VMxJTn4/QS1/2aDG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126262, "uuid": "1931b813-4186-4160-8893-05242a874f58", "value": 1387567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126262, "uuid": "5c30a5a5-0a7a-4f4c-aac4-01d8a524882c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126262, "uuid": "0223092a-df88-4508-b3f3-b3427d6100b6", "value": "AnchorOptimizer-1.2.0-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fff9ecd-9202-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067486, "uuid": "4f6d0ab5-2a86-4437-b693-a4bfd89ff90b", "comment": "Malware payload (Mirai)", "value": "a4019ba627e220caabbe0e84f19fc8d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067486, "uuid": "25b33ed7-adb0-4ed0-9546-17e874824aab", "comment": "Malware payload (Mirai)", "value": "88b5109d8eb8b053819ea7b488ff317c7ec584b4e1223398b8a500bd8a04bd5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067486, "uuid": "a05458ad-1e0e-4c41-89c9-d518d75b637a", "comment": "Malware payload (Mirai)", "value": "3e964a61b9d721edbf40dc8d9c9fe9459439f1f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067486, "uuid": "a5a32cc7-70fa-422d-8ce9-2d386763033c", "comment": "Malware payload (Mirai)", "value": "fb1a2e59990a81c5905d9c86859ad810ed3eedba539b13f2e2c46abdef8aee37c6db0d9b1d90a929e512bdfab16d56da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067486, "uuid": "155d3bd0-4a11-4017-87d6-acbc330d59cc", "value": "T134E30845FD459F57CAC255BBFB4E428C7B2A0768D3EE720389256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067486, "uuid": "cb12e849-7e48-44a6-a466-4961dd324c30", "value": "3072:OKMO5X40Dt23/8ur/BcLiwDrjnbWMpHh4CBf+hHQ:OKM+0v80/BcLiwDrXWCH6Qf+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067486, "uuid": "74078f56-9eb7-4644-875d-9301fdb9f370", "value": 144504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067486, "uuid": "944c69a0-13cd-4cd0-be1d-8dee5ea05842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067486, "uuid": "2c61cb6f-92a9-4979-86d4-c01b794278d6", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814ef651-9206-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786069206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069206, "uuid": "f9cae0ba-a8f9-444d-b903-2f483b904804", "comment": "Malware payload (NanoCore)", "value": "09683b2cb19f16818d0a60264663cac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069206, "uuid": "d9554e6e-11f8-4d98-a181-c103ebd73b3d", "comment": "Malware payload (NanoCore)", "value": "89c3ba702d5c424a14c58c3809897b9fc0a66a84c9e4becd4363972e4077756b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069206, "uuid": "c3ec9960-2d8a-4460-8d7c-5560760577a9", "comment": "Malware payload (NanoCore)", "value": "0b77288fca4555e501c9cb4474cd689bee669c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069206, "uuid": "134da12a-2353-4d5d-b3fa-1fa18adbd330", "comment": "Malware payload (NanoCore)", "value": "c2b10186c476f96807c19f8f58f58541a363a817fb0041b876ce8c2ed7c675968d19b7fd218d46c782d63e5210f2b063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069206, "uuid": "7b8b6deb-3519-4503-b12d-734a2791f305", "value": "T11814CF5677A84A2FE2DE867D611212169379C2E39CC3F3EE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069206, "uuid": "9573b9a6-5c08-4e7c-bebe-229b0d3848bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069206, "uuid": "4ed596cd-aadc-4cde-b235-18b713e6c195", "value": "6144:MLV6Bta6dtJmakIM5o6V2qhLyNPYTbEjP:MLV6BtpmkbM2uL4YTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786069206, "uuid": "53a83917-c59b-4ee9-baa3-22f8a783a6a9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786069206, "uuid": "8690b319-e067-435c-a618-5a5e9eba73e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069206, "uuid": "0c032cc9-0fd2-4956-9857-6e5d3320aded", "value": "09683b2cb19f16818d0a60264663cac2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e10c19-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137904, "uuid": "cf1cf4d0-89d5-4e5a-8d31-b15eb6b88535", "comment": "Malware payload", "value": "4e940582331226833360d34f1ba6a807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137904, "uuid": "076f99bb-0eb3-4fcb-a748-a2e47ec5bb96", "comment": "Malware payload", "value": "8a9432a29d1dc5ee40e7b0381aa03c92d1a299817d780ef8d4259537d2f384af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137904, "uuid": "9dd1b476-39aa-457e-be06-53a7df358190", "comment": "Malware payload", "value": "85c5361531bd0b28aff461910c2ce8546c639335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137904, "uuid": "6dc9ff57-7e75-4525-aea4-f22609088c63", "comment": "Malware payload", "value": "f7c9156ee0ca0b6764b46fe97f171ed410e4237047577770f4986e061f9508cfe8890be0a9ca07e2fa5ce0a5ae722aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137904, "uuid": "9c2b4099-f552-43fc-acf0-47e2a1407450", "value": "T1E053A4133348BA9ADF47AC3F95C7BA117392BD94125145A2BB00110FAB77B26CF0EB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137904, "uuid": "6ffc87c8-d3e1-4f0d-bb49-f56bbf0f88cf", "value": "768:1VpP4Ch2YYbrtJi4clS+Q6cE9Jn0VJq/fy4balAionhvXY9YUcNi1SrDyHfaa319:6TYa1UamXYKUcNv3yHd1kPVO7SD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137904, "uuid": "4149fff6-67d2-4f4e-aef5-2b572d538b82", "value": 66608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137904, "uuid": "e04bf51c-d201-44f7-9f10-f431a618b5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137904, "uuid": "1df438c9-492f-479d-b3aa-d3d4c3faf7a7", "value": "main.power8le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f7d449-923c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786092433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092433, "uuid": "6be849a2-7c0d-48f7-8804-094a102317a1", "comment": "Malware payload", "value": "e55290e3a3f50fd778163fbc8bc3e289", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092433, "uuid": "3745907e-76dc-46ff-b977-98adfe7355f4", "comment": "Malware payload", "value": "8b6ebd944442d5fe56f92ebf505b6ab3210a9e49382ac71dd240918e99344531", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092433, "uuid": "b169da71-b46f-48f3-903c-581df81c4d60", "comment": "Malware payload", "value": "c3ede395097c44c3a0cf46ba1e0c64858a4d0f36", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092433, "uuid": "48d0d2bd-8d1a-428d-9047-5c38dbf1d693", "comment": "Malware payload", "value": "dfa844dc9d3bb2bc8c21415dce4d874e60ea180c9f9e4c5acfd386a77a94434ccd08781e8877edec917b09a98e6c61af", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092433, "uuid": "893da964-62a5-4277-bdd1-1b71d253fe90", "value": "T1B3D5239A78F66AB4D4B6C7B38F43F47EB06977514A358E46B98D3A008C935482C3B770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092433, "uuid": "00fba0d4-53d2-477a-aa43-e85d5c65ec9b", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092433, "uuid": "b820353b-2d57-4cc7-aa17-9c1a2ea5c4ee", "value": "49152:zftTrzlM2pJ5yJO0l2BGw3N1nj2YTdbF0ei+Ha8MVGYKIAGMDS9WeAuup5zsgJ7i:DP9YnlAGWfnSYTdB5HAltMDOWWuggJ7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786092433, "uuid": "32c04348-bde3-48f8-9800-47c068df169c", "value": 2921984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786092433, "uuid": "71bf8ce5-0e00-4a8c-846e-111e627bf3ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092433, "uuid": "63a350f6-5427-425f-af60-28a8e2a2a513", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae2ac74-923f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786093757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093757, "uuid": "d599c06b-4ac5-4679-988c-5e57655bfe84", "comment": "Malware payload", "value": "5045bd6408b3319d3478ead9ce8d7187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093757, "uuid": "4f5775b9-4b3f-464d-81b7-2099dbc256d3", "comment": "Malware payload", "value": "8cb48c18c1b8e09e4d4cf12025599f61dcfff3b77adc96668e32cd47eae51a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093757, "uuid": "5d395cf7-b781-42d8-ba4a-2833cbe6d420", "comment": "Malware payload", "value": "d1b4034359647ac83f9dbb72090a98516e397da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093757, "uuid": "75d91431-6064-440c-91fe-e9d81a27db67", "comment": "Malware payload", "value": "2a0eb24f6cbb853161ea29fae23f8b28843d9a6c0f4c53d3bfea984232f1852a1a59ee21b9eb91c163861fa1dc637a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093757, "uuid": "010e9c6e-7fbb-4b90-b5b8-9010c7fc21f7", "value": "T1DF11E1E8A4D64C322F099C2774181CD7B281083B00F52DD5A35DA9236F0C6F561BAF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093757, "uuid": "ac4ee381-4ff6-4260-a4f7-756be26c7711", "value": "24:sPpF9tD9jWijWr5jW2Fr7jN/F5haHifMDsxVexjJjCmYDYXmYRYdUQljfYK:sBLd9jpjY5jPnjN/zACfMDqeN1BGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786093757, "uuid": "3f7aa909-484c-48bb-9bbb-e8d10dad34b1", "value": 933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786093757, "uuid": "68200ac8-1228-410d-803d-957d0b96f9ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093757, "uuid": "09a0fec5-353c-4666-a5c9-28e6d586abe2", "value": "8cb48c18c1b8e09e4d4cf12025599f61dcfff3b77adc96668e32cd47eae51a07.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f001722-9260-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786107669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107669, "uuid": "c92c9a9d-199a-43de-8c3b-92fb8f1b9261", "comment": "Malware payload", "value": "b426a480de03b7a15e739cf07f7fac88", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107669, "uuid": "30654c55-d326-4baa-b77b-bc27c92d1725", "comment": "Malware payload", "value": "8d945e37a9d8f4f68fb34b623e628aed9cce8c8ea6593a8e2bbcbba33e166537", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107669, "uuid": "45549e7b-c34c-4ac3-964d-468e27158401", "comment": "Malware payload", "value": "b30bbd5be515a837e21a3c9ac34afab886f67d59", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107669, "uuid": "c7cf3df1-8c08-4f1a-bd52-e6b4c52b5805", "comment": "Malware payload", "value": "188059cc3ec70810dee71bd5cbae86f362d8ba474f41c7f78c362e04d05653bff5684a58a539249bf5a5aab8f314a429", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107669, "uuid": "a969e405-3715-4e73-bb5b-191a10f33f70", "value": "T164748E19F7A418F9D667C17CC9524906E6727C174361ABCF23A04AA72F336E09E3EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107669, "uuid": "98ad8231-00de-421f-a0ed-1df6de7362e3", "value": "dea51d2f7467730ef2c02e1ce731fccc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107669, "uuid": "14dcca7c-21fd-42d2-ad0c-3dfcfa66dbd4", "value": "6144:pwguC3xuU0tOOwpxRK3XHPNGdlk3oMea:MCwU0tgbwPNGs1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786107669, "uuid": "6374ea8e-a9de-4991-b4cc-6017b056c75f", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786107669, "uuid": "32254f35-ae5e-408b-abd4-11849eb53331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107669, "uuid": "5745e504-fc9d-48cb-b308-bea79e5622b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1db4ffd-9275-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786116961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116961, "uuid": "34018bb5-cc91-4915-a5a5-bb02db2da846", "comment": "Malware payload", "value": "ad9860884fe7d7c1df36260713f4a6c1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116961, "uuid": "b8d796b0-93c7-46a3-a3d5-bcec219fe969", "comment": "Malware payload", "value": "8d9a8edde0f4615113949a0b6b7535d5a12b87bdd8124c9412cb61ca8f8f687c", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116961, "uuid": "b057bd94-0160-4385-9b30-af58061a1c91", "comment": "Malware payload", "value": "341f114731d7413071f9d92b3470615d33643984", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786116961, "uuid": "aa35307b-0dce-416e-9c86-071f11c431c7", "comment": "Malware payload", "value": "5d6381f39a616ca5f38bd59aab5ecfc23d330bdc6b0a7d9f389956dd3dda28e3d01b1175769c5e84e3f4d1a7356d647c", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116961, "uuid": "b22e34b0-2c2b-43d5-abe3-017ff846087d", "value": "T1B0067C03AD9148F5C0A9B731C8B742527A61BC089B3237E72E61BBB86F727C09D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116961, "uuid": "e80fe105-e85d-4f2b-a2d2-f67bdb361e03", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116961, "uuid": "eecaff65-c6a7-4dcd-b4ef-0b951e054817", "value": "98304:uWeERU48ECtpGYifF+cqotlXXYrrJEmPhatsGHWY/gOGUiK1YAcjoKopnexS:uQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786116961, "uuid": "6444f96f-7808-46f6-aea1-c1cde2c7881f", "value": 3729792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786116961, "uuid": "77f93345-e9cd-40f0-8bbe-ecc8deacf1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786116961, "uuid": "db31adc9-5581-4f4d-95ad-d62a0d6cb2f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c186b8-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080274, "uuid": "01448e14-aa35-427c-ad6f-05c7acb5c74d", "comment": "Malware payload (Mirai)", "value": "c7b41125f85df643f57f6f7354d2bba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080274, "uuid": "5d691e45-f991-4d3c-b371-ccff98864a0a", "comment": "Malware payload (Mirai)", "value": "8daff8e3d93e9ec7eb2376abafb2736674d037b845c618629d76037d13f5d5d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080274, "uuid": "e3850a3c-2673-4b44-9574-8c3f4940d01e", "comment": "Malware payload (Mirai)", "value": "c4d7002b0b42679c2e8a0550eb648927c901b45d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080274, "uuid": "b01b1528-f77b-4ab2-a538-8c3e8609e15b", "comment": "Malware payload (Mirai)", "value": "1a9cb77f94f0fee1ba79d63cfb6a3773e89c7cb858cf2ec1ea2cad5a375273e394632c63aef24966e1aa776b535effab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080274, "uuid": "92d142a0-0da8-48b4-a17e-348d045d3f56", "value": "T148E36B59FA5BD0F0E6D340F0052BEBAA963B99516233F1B1FF563671F8B1301688626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080274, "uuid": "35d9e0a3-d165-4233-b126-bbaa64eb02d7", "value": "3072:uFQBgMQY8TRz3vXKNXQt3arBSKWITUQ4bPKsRpz:eUQvTZKXgC8K574bPKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080274, "uuid": "b107f05d-0fdb-44d7-a4f0-460a19170e4b", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080274, "uuid": "185eb25e-1609-4169-8fb0-7d0d04ddeb61", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080274, "uuid": "8cf9f17f-0980-4352-8d0d-0e9e951a3937", "value": "85e1a80169274231655e552d930cf915c297b9a2077bd495b3572d2b3b269a2c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d261121-9255-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786103022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786103022, "uuid": "ba074ddb-15c0-45f3-a51b-fa3dd41e6eb6", "comment": "Malware payload", "value": "ee885be1526612eea6170f2b41f855d5", "object_relation": "md5", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786103022, "uuid": "278f77f6-a5b0-40b8-89b5-d6144f99dba2", "comment": "Malware payload", "value": "8e1a49fcf2383b31cc172ea86e1b3661e006b6882f32e1beefb0dd9dfb6c1790", "object_relation": "sha256", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786103022, "uuid": "b9bc1935-987e-41e6-b401-534e947ee553", "comment": "Malware payload", "value": "0bbf95b353dfb108a0f42d4edb3c03e359a0232c", "object_relation": "sha1", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786103022, "uuid": "a9ab6058-2acd-43d7-a2d9-b2f3c9d814f6", "comment": "Malware payload", "value": "b234456530b64f1c4525229996e0f66ca0fbdaed5aae0d0cf7ef234f506d03ac0d347c2103d90445fc00bd8e774c49ac", "object_relation": "sha3-384", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786103022, "uuid": "00dae8ff-e8d8-4b54-8cba-70c445c3c79d", "value": "T1B4473326BDEAE938D85745BF99C2C152712A1ADEE80FC02F0EE009854D75D4A431AFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786103022, "uuid": "285d7caa-540f-48a0-a427-51ee6c7a4349", "value": "786432:NJM1u257AJXgufCtY94Ngh38hUKcm8Eo01ZVbZO0G2:HM1j0tgOIg4NgShFo01rdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786103022, "uuid": "53324dc4-bddd-4a65-89a7-59fcaff05e2c", "value": 26445300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786103022, "uuid": "a73547da-660f-40da-909d-42d8b29fcf3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786103022, "uuid": "c5431ec6-589e-4a10-92ab-ef6d63a06336", "value": "bd73841f8314.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4012c459-9269-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786111616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111616, "uuid": "a6582cbd-8b4e-40b9-af74-2a3a72808603", "comment": "Malware payload", "value": "b601dadf54aff161861e5a5e56b989bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111616, "uuid": "203a3765-05d8-4364-b5b7-7322b20cb32a", "comment": "Malware payload", "value": "8eb42e2f5c124fa30d0bec21b381068d7b2cbadad03146c17cd8817cc365305f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111616, "uuid": "f0abe374-24be-4db4-9ca7-3d6c70ff5714", "comment": "Malware payload", "value": "3b9e27b09f4bc61779be4d1f6c223b1ac223c8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111616, "uuid": "377d3f9c-97e1-4b0c-8693-0fb29fb11d7f", "comment": "Malware payload", "value": "fcffa0b94a594e778527051cd0ef3f8b8407b9aac5103d85cdc529608186999e22a89e1e45b9d0458d157d543bed7269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111616, "uuid": "8a9dd643-a0e9-423b-8e63-6e24a5f70e2e", "value": "T178C3532D2E229F7EF278833147F35E70976922D626E1D784D2ACC1105E7428E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111616, "uuid": "b0eab1b1-4157-426d-abbb-42aeb7f72317", "value": "1536:QJYNODC6KtBxJXmva5rH2mqKRmyDpnKe6GqOZKxEl4gDkXMSjrWgsfMBnzCEyiWG:sx7e6Yk5fWg4MBnzVyiWa+hLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111616, "uuid": "328b26d6-1e01-4033-9945-04206194b786", "value": 119169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111616, "uuid": "4191cb66-65e6-49b4-8627-bbfefe92e7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111616, "uuid": "e99d7abf-238c-4fea-85c9-acb39b914dc4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cd46d6-924a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786098500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098500, "uuid": "47a052c7-4595-498e-a6fe-ff1afaf75bb7", "comment": "Malware payload (Mirai)", "value": "963d1544553b0b3b3e31c0f1d7647b78", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098500, "uuid": "aaa0aadc-1eba-4f43-bfc4-da5a5023af4c", "comment": "Malware payload (Mirai)", "value": "90e9e3a30900c7b246fc661e57bff95c8abf759007e830f24f17d4615c87d388", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098500, "uuid": "5e28f54a-f8c7-400a-b5e9-5957b2d30b46", "comment": "Malware payload (Mirai)", "value": "91db9fa6a37c75807eb43fbab7e613e97c439f18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786098500, "uuid": "6d7c1ef8-4768-4577-b5a0-72826179b8ae", "comment": "Malware payload (Mirai)", "value": "533380cab9ecf00b95d9fcbb1e86d4d9971e475749aed12a6f218e4242968c6ad2419038d2b296223f8829210fd2b062", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098500, "uuid": "21feabc8-1faf-4173-8d4f-969a41ad8ec0", "value": "T1BD215CA929707E20428EDF5D71E546E49206F5C3B1A35BF2E5835D25A8CAF40B81AB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098500, "uuid": "23b7b217-d983-48ff-81c5-63c587e469bb", "value": "12:7kft0dt6hbNaKjT6dODOqaDU8fGMGTK1zk1ZhVbcVb1LBqhN0/N0KvtIfse77X3:4fCc3FHDwjYKxkpCe2/2MtcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786098500, "uuid": "776a51d5-ee01-4516-974e-075286aead8e", "value": 1218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786098500, "uuid": "031b144e-66fc-4c86-81ae-c89b1d8a8896", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786098500, "uuid": "5587b6c8-20d1-4c28-af4d-8fb9274ec6e3", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d51d1c-922f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786086871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086871, "uuid": "5518d6e3-b203-4664-a8c3-9a6bfd5783b7", "comment": "Malware payload (Mirai)", "value": "e2b55d00f8fe8d40aed9e9804025275e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086871, "uuid": "6d88540b-5cc6-4e0c-98c1-322cf89f12d3", "comment": "Malware payload (Mirai)", "value": "916d56279264af5a509ec8b223253201464624de98c0769d4720ec16ff665b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086871, "uuid": "26cc30a3-8322-4637-a816-1cd47d6f93eb", "comment": "Malware payload (Mirai)", "value": "d1de286447f2b199c25fad8c4fcb369078146758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086871, "uuid": "4c49a8e8-6b64-45bc-8986-a6f380780efe", "comment": "Malware payload (Mirai)", "value": "e1d173f4c3b20873ab56db19ed230f11439bbe25a44e175d31ff762c17e8ac79210c06d39b590f36c7b6f87fa3890eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086871, "uuid": "72dbf45e-d8bf-4093-95aa-0d78a42ba831", "value": "T125D34B12A58080FDC49AD170879FD237FB32F88912347B1F2B946F612D3AF616B5A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086871, "uuid": "5c4477c9-25d4-4672-bd18-813240b19688", "value": "3072:n3F0znx9aEJ7t//NZEimDb04fh3wb6ZHKN7zb0JJ:n3kpB03J332/b0JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086871, "uuid": "196164b3-ef45-41bc-9406-7db519110e5a", "value": 137288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086871, "uuid": "e468e8f6-ba6a-4d7b-9002-22c449ae03e7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086871, "uuid": "424bccbf-39cd-4cb5-baf0-f0103e4df6c2", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700ba027-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126300, "uuid": "de8e2a15-4e00-4053-ba7c-527de1f4f604", "comment": "Malware payload (SilentNet)", "value": "5cf7ca552b04d98130b310a409ba8645", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126300, "uuid": "8cc8d2be-5437-44e2-b7f1-5eb893fbab6c", "comment": "Malware payload (SilentNet)", "value": "9175f272eee3a353b521c7c55c92ae76dc77f601e402800296481377524a5f3e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126300, "uuid": "92b9f044-3df6-4cee-b190-3b4167146bfb", "comment": "Malware payload (SilentNet)", "value": "cca5e2f646d4686b0b95f1a7a5a4b44e94538b09", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126300, "uuid": "b3ffa79f-4aee-4603-a846-c15c275d58dc", "comment": "Malware payload (SilentNet)", "value": "6d7ac8f5a0e2e85a59208a1381553c6cdc1227b6e0615b8c2b4d14a0724fff9c27a939481692846e8e06661ece21163b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126300, "uuid": "42662c2a-bdda-4150-b2f3-65d110b52be7", "value": "T1C8F41297BA982830D803F671B121DE66B90F4280D451F2AF96B4844B3CF76ED1F6B61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126300, "uuid": "25709f60-7928-4a38-a6bb-12d8547ef445", "value": "12288:8hljYJQ1BRAjkUBpJiJjVZZzFLY0ApyKqZW0HuHDnYDGR9+AFsB90bT:4lvcHiXTY8Kqo0HuEDGR9BF890P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126300, "uuid": "4847bba7-d6e2-4e0b-819e-8e42a2af0a24", "value": 743607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126300, "uuid": "62599f14-d0d7-43d6-8922-0899ebea61c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126300, "uuid": "3179b287-c0b4-44fc-8589-ed3c424143d2", "value": "WaterClient-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ff41fd-9202-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067660, "uuid": "10cc6aa2-d1e1-470c-ae75-26fd67b9cd4a", "comment": "Malware payload (Mirai)", "value": "b61b9a10e78a527e1760f8f487675baa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067660, "uuid": "2f74fdf7-44aa-46b4-aa84-24cd83d769a4", "comment": "Malware payload (Mirai)", "value": "924194012db5ee8721227fa456bff10954996a7c519bac33babd4236e987c941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067660, "uuid": "83740207-3a5e-4d5d-8242-d759e65990ee", "comment": "Malware payload (Mirai)", "value": "6f2434b6d4d3b9f088977eefed68975272b4a707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067660, "uuid": "04a42767-6920-45cf-9862-6404c1b25e19", "comment": "Malware payload (Mirai)", "value": "022e1b58a5a0caaee74e794a0af8f2843b28017a203fcbd0af71d35b51f3ef5487d93b5ce41daa0af3ffd2d7f378593b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067660, "uuid": "f151215d-30a2-4f7a-924d-47e9b5729627", "value": "T1BDE30855F980DF22CAC1267ABB9E428D33131778D3EA7102CD205F3577EE95A4B3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067660, "uuid": "9de88cf0-b0dd-4aa3-b6d8-4982649f68c7", "value": "3072:yTWMcfdhPDLEgXiWfDKeOoL8Znx3rqXRMEGB19CR0Q0pZarR:yTWMoPDLEgXiWfDKvJZnBqXRMEGB1oKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067660, "uuid": "0e7f4b24-cb0a-44bb-95ce-f8c7111191d5", "value": 153156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067660, "uuid": "3b97e7a8-aa10-4ea5-9c55-585c146b17cd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067660, "uuid": "5b8035b6-532c-4ebe-bd74-27b238ec46df", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9642cb9-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097620, "uuid": "edbe6cc2-073d-4fd8-9226-80a7f8fb4785", "comment": "Malware payload (AgentTesla)", "value": "1d649fb973bf0588f6e77422e6de1c58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097620, "uuid": "1c0e0e23-b7c7-4bb0-97d3-4360d8581baa", "comment": "Malware payload (AgentTesla)", "value": "925f55d345cd70293de26d2e56a6471013f0d531ad98230b9ff36ae7404e5555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097620, "uuid": "788784b4-cf1a-44a9-b9ba-fb811372732d", "comment": "Malware payload (AgentTesla)", "value": "27ed13d282633fc081d578f2ba19d16c7fdf3dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097620, "uuid": "91dd0a7f-ead2-440b-8fc1-4f013fae001e", "comment": "Malware payload (AgentTesla)", "value": "e46db9bd7b6699d1989d9ba8d313c3b6b4007d032f874da56f3345464406748dffb51770a66a648dc7207accdbfb0775", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097620, "uuid": "950494ca-6206-4ec9-a174-36be83f6d139", "value": "T121F5B5412BC5D5327726ABBD423A8930D529528314C5CB36307CDA287BBDD0A976CBFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097620, "uuid": "3ba66272-0347-42e1-8bca-e6b6802472a7", "value": "98304:P5UHs6ph3SVjQMOnXukXvKA4Ywl5u6lxChYumrbqPhZ5k8Ux3vFm:P5UHs6ph3SV0MOnXukXvKbB5u6lxCObW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097620, "uuid": "f48e44e4-f579-4fee-b48e-f0111c122dfa", "value": 3328412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097620, "uuid": "7ec75377-60ee-45c1-8dea-2ebe0abc917f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097620, "uuid": "928aa7f3-7c58-4f59-9427-4e60d0cb6aff", "value": "Sevkiyat Belgeleri Ektedir L\u00fctfen Kontrol Edip Onaylay\u0131n\u0131z pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf6b305-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137916, "uuid": "fe22e041-8eef-4002-aefb-7fda4e2b7c6e", "comment": "Malware payload", "value": "d1e337556b001a4f75cbf0df6d5a1375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137916, "uuid": "3dd98ef2-e269-458b-b77f-56905f7ea4c4", "comment": "Malware payload", "value": "932d3d78df3a50c022caecb3a4cce6731e3416ece00ac2a4f596b3335a3930b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137916, "uuid": "0f964d56-cf7e-4170-8de4-c554c2cf82f9", "comment": "Malware payload", "value": "bd1bfd055de38f330a492e4331bff62d0573f4ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137916, "uuid": "e6d8c2db-e855-4d8f-afd0-7a7babb3e500", "comment": "Malware payload", "value": "22c098e146e3148c64210455a909053e9947bdf3b98bcd86a64d1832c0f7f4f54c9ed6ad1372f2f86869f1877e3aa9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137916, "uuid": "16b77174-caea-4ba2-9258-0d5e73ee9820", "value": "T126531A11DF0C6826CD726AB595F72BA1B791B8D01030CD2177053B6F1973A36AC8BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137916, "uuid": "d1f7e8dc-8d40-49de-a2c9-f55ef82e4433", "value": "1536:KoQUZsWBplZZ6gzvHNtARFHBIrcW4e+TUYrcUYTOTy:KoQQBpBVltaFHBIrcW4JTUYrEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137916, "uuid": "28fa6c00-b841-4c2c-879f-6d265879e7fb", "value": 66608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137916, "uuid": "0d0a4f32-915e-45c7-b3cb-3b995ce251a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137916, "uuid": "83a7263b-c142-482f-97b5-7e6771616d2a", "value": "main.power8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0b4d6c-9237-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1786090081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786090081, "uuid": "3bd71e5e-e0c7-47ae-955d-1289ec4819d1", "comment": "Malware payload (AdaptixC2)", "value": "8ef70ff2c501ca4e271dd549e29d1ad1", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786090081, "uuid": "850c6f98-2bc3-4b99-888c-60258900c108", "comment": "Malware payload (AdaptixC2)", "value": "93fedc7b3f885aa9741fe7bbe171baded81188a5aeee3fecc636f3721587b702", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786090081, "uuid": "dd577e5a-a9e3-4d1c-9df5-22e933df5588", "comment": "Malware payload (AdaptixC2)", "value": "bf8d02a3f3c536fcf917fb4327060979d1f75509", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786090081, "uuid": "05527426-bec5-4fc2-bc96-b91c5645e842", "comment": "Malware payload (AdaptixC2)", "value": "2316be75f8e4398a271c01f0686c8f070207d82876c05fb230b19da82d8962854e42216d59bdbcc6fb915efb57efa78c", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786090081, "uuid": "6996bf5a-d7bc-4bdd-871a-b0c60e0c6cc0", "value": "T1DE453B2167FA59D9C12ED27446473C19B9EA381693F016CBF39DDB00AF22AF5067B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786090081, "uuid": "33666716-5631-488b-8555-c11126ee224f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786090081, "uuid": "ad249280-ebd2-47d6-ad1e-0f757b64ef2d", "value": "24576:Ji/eW8QHldnjz+G+7myopCemVyIZ19A5+ulAl:M/eW843n3+VBHSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786090081, "uuid": "de272af5-6887-4343-bab8-3aad054e57c0", "value": 1232232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786090081, "uuid": "d5b032ca-b14d-4c23-86d4-58e7e31bb472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786090081, "uuid": "0f22db4a-c5e0-4245-b189-cbf2fed60fd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70243647-91f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786062305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786062305, "uuid": "8f755357-738c-47cd-8def-1242f5591d46", "comment": "Malware payload (NanoCore)", "value": "f32f66f210c25ea6dd97348034bb698b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786062305, "uuid": "dc4becb3-8748-46ab-a2b5-bce1818ff0d4", "comment": "Malware payload (NanoCore)", "value": "94c78e0d80e3364e1c90d6f5311e6e4104bfa8e831d3351ba8cb875620d0dc64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786062305, "uuid": "7d2e557d-c549-4e39-92af-3f2fe4080b8d", "comment": "Malware payload (NanoCore)", "value": "717d84b07335ef125dd27c00ef3341933ae2a508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786062305, "uuid": "bec9fa75-67f9-426f-8585-8f666c836e91", "comment": "Malware payload (NanoCore)", "value": "48c0950e9a6676f1db449ff51c107f22fd8bf841a2de4254ce59016d8003df59e740b8b60d978531b5f03ef90a52205b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786062305, "uuid": "7202c2e1-e596-431c-a08e-1c6d8bfd915c", "value": "T19114CF267BF98A2FE2DE86B9611212028379C2E399C3F3DE18D455B34F267E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786062305, "uuid": "62aff1b9-3971-469e-8e21-a22ec72dcca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786062305, "uuid": "cbe71218-256f-4a1d-ad1d-cc324d627943", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIJuP+1Nda82N+xdkv9iRLGeQLe:MLV6Bta6dtJmakIM5zkAgNp/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786062305, "uuid": "aaaff549-1520-44cb-b506-803b339181fa", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786062305, "uuid": "912be6c8-9273-4976-aad6-8d90c820bfef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786062305, "uuid": "728b9900-1851-4864-9183-94ddef29ba2c", "value": "F32F66F210C25EA6DD97348034BB698B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca712d8-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097625, "uuid": "b7dd4367-b4b9-4f83-a08e-12236622ca5f", "comment": "Malware payload (Formbook)", "value": "fb67bab3636ca443f7c220b887e5e8cb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097625, "uuid": "2f315b4f-5a40-452d-8c5a-d5f0a34f845d", "comment": "Malware payload (Formbook)", "value": "94e2bbcbdbdb5c786a9a16d496089b8ff711c44824d4a83865b8792ec47c0112", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097625, "uuid": "95c4eb17-fa4a-4057-b5c6-e8495aed6ac2", "comment": "Malware payload (Formbook)", "value": "ab14188af42cc9a465c3fb68dac88a2b0bc80c86", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097625, "uuid": "0df2c5e8-b558-4260-b3f1-d0aefd5e136b", "comment": "Malware payload (Formbook)", "value": "51c38516b924e9f89ffc405bb49a1bd65b61c7a7818516ca4722bc9a8d00aa3afdbb1d41ac1fae29c650dd264efdd6de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097625, "uuid": "53ca2712-38e4-4d4d-a799-9deca5807aa1", "value": "T11C93FB055897B4806376B7BFB72B98E4E7A657270240291BB83C6440EFF2D09DDD0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097625, "uuid": "4b952100-d9a1-4dab-8faf-e34db587a078", "value": "768:kOkUqKsY4NeXpBoU0Bt4+mhHEZzHWwWbEZ5UJ0ege7JObsqS2f+yjipIjUzwun/N:rk7AobFmIgWuFtT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097625, "uuid": "0bc79bd0-a018-4172-b476-ee7bb74da5d0", "value": 90629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097625, "uuid": "6a94212f-3aec-4b4c-b27f-fed57a025e9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097625, "uuid": "905b560d-625d-4fa5-b2dc-59d4fa7f1ffd", "value": "PERMOHONAN DOKUMEN SOKONGAN BAYARAN - SEKSYEN 81 AKTA CUKAI PENDAPATAN 1967.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5b2d72-9283-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786122908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122908, "uuid": "28f88898-6c4d-405d-bb80-c2ba9e1d558d", "comment": "Malware payload", "value": "85ffd3ab8ed16a565046b0dd1dfe88a1", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "LaunchDaemon", "colour": "#51C5CD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet-replacement", "colour": "#6AD081", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122908, "uuid": "2b867bbc-bbdb-4ea4-84d1-50189fe96727", "comment": "Malware payload", "value": "95ab5a61a0970410ada36ba843e55e270f38cb8e2eebf79254434948e11c870f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "LaunchDaemon", "colour": "#51C5CD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet-replacement", "colour": "#6AD081", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122908, "uuid": "7a025c08-6ee9-4e30-8265-f4ac6496303e", "comment": "Malware payload", "value": "35e97f92d4ed6eb3f8cdc181ed8ffb37d3faccbe", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "LaunchDaemon", "colour": "#51C5CD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet-replacement", "colour": "#6AD081", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122908, "uuid": "efdc0b63-d61e-4819-ab84-e416b2339b3f", "comment": "Malware payload", "value": "decf2ca60fc0c44dc704b4393485680806b6909fd1424f75f83005c484b06e640d7b4c889f22e0850f57921fcadc4282", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Dante", "colour": "#CF4A54", "exportable": true, "hide_tag": false }, { "name": "LaunchDaemon", "colour": "#51C5CD", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "run-only", "colour": "#5278C7", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet-replacement", "colour": "#6AD081", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122908, "uuid": "5437b399-b1c0-45ad-a22b-0f0d33c512a6", "value": "T117631D12B3FA2249F9F39A797DF556D48E7FFC30A926912C4468210A4E61FC28D50B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122908, "uuid": "79bb52c9-8d15-43ee-822c-a97ee60509ed", "value": "768:cQZMQ0/apbOcP8XpSFGlesYDys3WaRLJGzs9t4JNU3z4sOtxAE3we45RRaf90QHb:fMYiX0rDyMBeUKL0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786122908, "uuid": "2f56e4d4-6798-4e7b-bc43-796626d7c5b1", "value": 68988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786122908, "uuid": "94e8d459-2bf9-439c-8ebc-c9e2b8bdc9dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122908, "uuid": "9fbb7d9f-4c3b-4f2c-9508-bb8074335cc6", "value": "stage4_payload_95ab5a61.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4c3cd9-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786113870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113870, "uuid": "44cfca59-768c-453a-9b76-f57aa4fa7aa1", "comment": "Malware payload (CoinMiner)", "value": "c7f29deef6de0b2079c7651855fcdad0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113870, "uuid": "96e0f3ad-1a9e-4197-8012-cc9b290935e1", "comment": "Malware payload (CoinMiner)", "value": "96000ea06d9c60f12db32c005400fab457443b2ee57a9fa1dad28816cf3fa2ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113870, "uuid": "2ae3faf4-e9b8-4b41-8cfb-6ee67e659664", "comment": "Malware payload (CoinMiner)", "value": "2eccdb5dec5d8b1189e2d5a4c5310638fa33a82c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113870, "uuid": "5cdb514a-992a-4401-af86-ded1ec692c7f", "comment": "Malware payload (CoinMiner)", "value": "89bc8dead7b09380062d4d299732f111d251bc4436715be20d0a6ac96ed30dd1b6ff4a57d16c40a133a9c07c484abe8a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113870, "uuid": "3180c71b-052e-439a-905a-fbc1c009b127", "value": "T17836338A28C62530D056D7E85622213DF239B7D286A17C8773ED6A059DE7F08A57F3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113870, "uuid": "20d80d87-6e01-45f5-8283-1bd9714e3dc9", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113870, "uuid": "d4ec792a-d170-445a-9757-d3b9b2f638d3", "value": "98304:Kc9/igkcZXrjexOXyUnOtnhJMjMEAk9vSK4JaLbVD4L/UCbye:Ri6jexOXyUnasXoJaLBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113870, "uuid": "82d871e2-b25f-4e00-9197-a5950e34a0fe", "value": 5241856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113870, "uuid": "cd4de19a-5d47-49d1-8eb8-ded117ad9d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113870, "uuid": "2e3b561e-a074-44b2-bf0b-53dda2f1fa91", "value": "96000ea06d9c60f12db32c005400fab457443b2ee57a9fa1dad28816cf3fa2ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b78a8c-926d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786113309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113309, "uuid": "5642f2fc-841e-415b-b546-f7de43c6652d", "comment": "Malware payload (ValleyRAT)", "value": "2ab61292e17ca7d65cbc94c6efd000bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113309, "uuid": "cef7a35c-579e-4c0d-9daf-6029791b0568", "comment": "Malware payload (ValleyRAT)", "value": "960ae7aabae262723177420c318c5e1d834f081ba917f044cc52c9bf39fa4e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113309, "uuid": "758ad710-3e7c-498f-b29d-2718b0594e62", "comment": "Malware payload (ValleyRAT)", "value": "a93025d59b1a913d257062e6770f6ea1e186b073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113309, "uuid": "e14449c0-69be-46d6-9872-964f1a350b04", "comment": "Malware payload (ValleyRAT)", "value": "c367a349a191bb16d7a930b36e38279b0e936e5e8a3b48d65b6211a87c981fa441cbe1b71ab67a5e97d9eb0903966d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113309, "uuid": "942694e2-7ca1-4891-8bca-4cfec6453bf9", "value": "T185837C4778D1C8B1E9721D3054A0DAB19E3FB9215E64CDAB3354067E0F306D1AE39E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113309, "uuid": "3d4184bb-8ebb-423c-af4c-e25e54552ac1", "value": "cb0963d7af94a8254e6e0073f9137c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113309, "uuid": "378e5d45-dbc3-4912-a892-d7ab436aaf7e", "value": "1536:ByKJEtANm3o9+YgIwqxumbuF7p0UwLYv3Z/sWPcdhdnS983Y68trgU:XJNmY9+CumbuF7p0Uf3Ghdng83Yh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113309, "uuid": "8313285a-033b-4ef4-bd54-88aa5fddf955", "value": 88048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113309, "uuid": "8b1c1cb9-fc7d-4bde-8555-cc14e73cb167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113309, "uuid": "21992a4d-6f40-443f-8fd8-beeff9eef7ed", "value": "2AB61292E17CA7D65CBC94C6EFD000BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83dafd9-922d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786086156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086156, "uuid": "f553dd70-7679-4488-be4d-a5870291f46e", "comment": "Malware payload (Mirai)", "value": "b5bd68dcb7a31fbff76120d8aa310e8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086156, "uuid": "755c5efb-be4e-4d59-99f5-9d1fed80a283", "comment": "Malware payload (Mirai)", "value": "9827b8530aa6dc9c94a305a1e299fe041ef9b56996dd56985f44d9b8618e2c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086156, "uuid": "9ce28ab2-407a-491b-964f-3138e96c77b6", "comment": "Malware payload (Mirai)", "value": "4994af643da26212661b367bcce3d289dfdd6031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086156, "uuid": "91cb2d55-50b7-4d74-a16d-62fe6402878d", "comment": "Malware payload (Mirai)", "value": "ea40eed7b011a82856024a2ed61491b765f7ee345facaeb45524421247e2f0a76f9ba998aed606b4a6bea9bf8b7601a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086156, "uuid": "0fec84af-6a98-4e24-93a0-94a71e63c3f0", "value": "T1FC345B4BA7508FA1E379DA7006F34B67AAA9228217D38545D37DDE107F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086156, "uuid": "8a17dcad-1cb1-4889-ba53-0831afe7758b", "value": "6144:CHvftdypMTFfM2nHAg5SdMheQdf9lzWvnjeU/lEpv:CXtIOFk/dQTWq9pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086156, "uuid": "fb211779-9282-4caf-af85-0cd71aaf53cc", "value": 237108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086156, "uuid": "c02a395c-24c4-43e8-93ab-3b7abde80de3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086156, "uuid": "b7fae270-5a6f-4f6e-8c0f-831dd85e1f41", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade2aea9-9298-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786131987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131987, "uuid": "f5e095c4-3d16-4e39-abbc-16f510e572f2", "comment": "Malware payload", "value": "4593d827cbadff3fb18093c59a4d39dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131987, "uuid": "efdb7b21-1f6f-42dd-ae89-3544b4525f65", "comment": "Malware payload", "value": "991f3fb45785c912467422763df681873893b3c44012681383c79cf7acd3bf1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131987, "uuid": "a08872a7-63b4-47e3-8822-3f47f8ee4fa8", "comment": "Malware payload", "value": "4f207c1ff4650fc9fa4f7dd21f895634b3a1358d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131987, "uuid": "e6b2c912-dd73-4a14-8b32-0cd87da8d325", "comment": "Malware payload", "value": "27db2c4d5acfe9f7a52ea63c7c401ffb2e8cccf7c6e4039ee5e3640dba3e354a8061552f7e5912384c496fb4f5802887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131987, "uuid": "bb28b014-e613-425b-8d24-75142c3a0044", "value": "T11943935133079D6FFD6A17B48AE28AF0B3C5BD9634B14696E226BB8C0F300ED5D4C685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131987, "uuid": "84ff17b8-e736-4506-9d74-598b5fa4400f", "value": "1536:kdPDMXMvBqQKrG7CMWdz4n2B1u/AYDXbRRFaL51B1sw/APf53HXiUaHEHRyXMnkv:kdPO4ZDXZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131987, "uuid": "4beece4c-a377-4781-a6af-db91c782df56", "value": 60576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131987, "uuid": "f841c062-1414-4bdb-b80a-c53ed3b6b981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131987, "uuid": "3f0c5e7c-c074-4f43-9112-8bd81c48813c", "value": "main.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c83f69-9202-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067661, "uuid": "43bf931b-584e-4489-8499-e6d1d8e7b24e", "comment": "Malware payload (Mirai)", "value": "dca56af4e9d5780b89bbc8fa2c06f7e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067661, "uuid": "10c3f932-eb4f-4b78-b465-11696d403f2f", "comment": "Malware payload (Mirai)", "value": "996cab13bc21cff4f38ba7cbbcadd4cd31b6fe8b1fb45251d3923ca3498b3df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067661, "uuid": "5516823c-966f-47ab-995c-a61546ca1fad", "comment": "Malware payload (Mirai)", "value": "2d935c39061ddb2efbf106517e8447516303f93a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067661, "uuid": "275cd95c-dc7c-417a-9dab-0eddeb43918c", "comment": "Malware payload (Mirai)", "value": "e54034c192dc9f20f46c9850fc938c550f3e899311c8fa244bb8c28ca2b947699c12c1823ddcecd4790683d3e800f8e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067661, "uuid": "12d11568-2701-469c-bd84-5f7b5fb06854", "value": "T1D4E42955F8809F61C6C529B6F65D42AC73074BB9D3EB72069A144B343BEB86B0F3A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067661, "uuid": "a83a99dd-9224-4448-92ef-6eb6f1c09e5c", "value": "12288:6kWAxr4qaC5aKIjQIH86MzJyRWEmdkaRK3vFD9qC6rd8S8pqP8qbt:6k/EC5SDHTMFyRWLd/w/l6rbbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067661, "uuid": "9e69f9d8-5d82-47bb-92a6-c2e421f81536", "value": 669972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067661, "uuid": "e0caa83b-47ba-4a8b-b23f-e65889357427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067661, "uuid": "82cbcd4d-2b84-472d-b8f3-91a9ec2eb7a7", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a819d-9221-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080865, "uuid": "34b495bb-d980-4705-872c-9fb2daf12792", "comment": "Malware payload (Mirai)", "value": "31602f7ea070c95aa9e760a458ea475d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080865, "uuid": "75cd7e9c-1e07-4297-b2c4-9167a2cc3322", "comment": "Malware payload (Mirai)", "value": "9b2f44e712a494e1b28f3046e8c79031dd87ea92d6ed69c59aeea2bc4b566589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080865, "uuid": "97e954c6-b46e-4e7c-8e77-c31f0656fe8c", "comment": "Malware payload (Mirai)", "value": "9a365a6774b041013f61c5aeb5a6a8fd934154fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080865, "uuid": "873d59e7-99b9-4909-b516-66960ce94586", "comment": "Malware payload (Mirai)", "value": "1389b21b3f6678831b5975fa2a540c1153b33987a0b83cd6ce827824bf8722653400708eed9254eed7fe176076c6cc10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080865, "uuid": "de2a9411-c585-44aa-9303-8eccd3264218", "value": "T13853F186523FFB74E3712B34DD7159D0E263B138128D2B571E6462BFAC6B28D3E14252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080865, "uuid": "dc063eb3-e2b2-4404-b9dc-a33862d906f3", "value": "1536:ubHrQwC2ynpYy4SH0Wsnxpvuuv/T4xsecFXpteYrP:ubHrR6pYy44omDhcFZteYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080865, "uuid": "7f57c386-4685-40a7-805a-ced468baa325", "value": 60968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080865, "uuid": "dd3f9199-abe0-4fc1-92f6-6369829cf3b9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080865, "uuid": "b3a85eb7-6bc4-4b4d-979b-dc70a4db76cc", "value": "9b2f44e712a494e1b28f3046e8c79031dd87ea92d6ed69c59aeea2bc4b566589.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73767911-9206-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786069182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069182, "uuid": "01b0d4b3-f666-42e4-86a4-42dcb3792696", "comment": "Malware payload (Mirai)", "value": "3407d84a0294de2555d3fd77d2014dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069182, "uuid": "8e6cabfa-d340-4401-9231-921a7c681778", "comment": "Malware payload (Mirai)", "value": "9b96004da936de55cbd9a2dd86f0f1670a6807a6009a8ae1087684d8527b8af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069182, "uuid": "0f894e25-84c7-4898-9ef1-b935c6f43285", "comment": "Malware payload (Mirai)", "value": "258443c498cb3fb39619e46e3664d4daf9ab9e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069182, "uuid": "5347aa89-9f5f-4ca7-b2c4-6e3c4e2c0375", "comment": "Malware payload (Mirai)", "value": "84fe36887a8509b4337adfd806ba52064cb8b2e17d547720051564e387ecc9b94bf2a19b7baa18017a4e29c8841acdb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069182, "uuid": "64b20761-b15f-4bbc-b778-433c0a3bff19", "value": "T1C8D30659FD41AB11E5D635FEFE4E028973530B6CE3FE7101AA245B2123CAA6B0F7A105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069182, "uuid": "79f8e499-6dd1-43a2-8c94-7f02e9d9fc51", "value": "3072:H8X2fWwy/OAK1cNLASZclani8XIqBJRf4WKUaKWUJjpCmuHY:HOrJ84LDalaicIqBJRwQaKrJjpCm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786069182, "uuid": "18312926-a87a-4143-a898-e92f36466326", "value": 132832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786069182, "uuid": "8661bc8c-c317-48cc-86ea-7b50b70eb946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069182, "uuid": "26818488-2dff-4134-9be6-3e7315c62af8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e8e3fb-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099552, "uuid": "258a5397-251b-4fad-8040-e156b4871308", "comment": "Malware payload (Mirai)", "value": "534034ecde9e18274d988e2bd0b50600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099552, "uuid": "c5416f2e-6535-433d-a28f-a612321cc18a", "comment": "Malware payload (Mirai)", "value": "9bc058b9077d1af108376c5db2b4782d1e8ce9bbb3b900ee48ea2b832b224d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099552, "uuid": "79c199dd-0fcc-4872-8d31-f289d1245fe3", "comment": "Malware payload (Mirai)", "value": "9bc662fb8031d2303a72699ddd41a398514a2000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099552, "uuid": "88d01637-c418-460f-86e7-5887c3de7809", "comment": "Malware payload (Mirai)", "value": "ca125c0d298e1e1899d884e79443e7e77e04cc2cc673e46d07a1219a9fd9e93f55fa2c5305d6f984eb4434e08eb3b7d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099552, "uuid": "41a519b9-e429-4b7a-be24-63b4b6261f7b", "value": "T15703E723CF65F42EE08F93B05BDF96219523B8FA133E6006A3E1FF645E45680DE95252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099552, "uuid": "8618d293-4b2b-4a80-b3d0-fe3e6b066ab0", "value": "768:xfprBPD4oA62Ib7AAJGCfbMjgb5vNt6CgCf/amkwPrqd:DBPD4k5XJJGCYq5JgXFwPrqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099552, "uuid": "b094f371-4111-4fd2-ae8c-ed8ead141954", "value": 39296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099552, "uuid": "930388d5-46ae-4304-8b5c-51bbebde141b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099552, "uuid": "833ece71-b148-4d1d-ab9b-c3d9ad03a79f", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487417.1880.18880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a21a3dc-9291-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786128813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128813, "uuid": "e8c5aaca-113a-45fa-a610-9d337749f6f4", "comment": "Malware payload (Mirai)", "value": "4fc0ed4e061f6f3f227e4ab8682dc9a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128813, "uuid": "35a287d4-8d9f-49de-912c-b40f5dd98f18", "comment": "Malware payload (Mirai)", "value": "9bf6f26d2f9357bf851d1344b0abec1a532005df2b3ae6da3c033967917d7ba7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128813, "uuid": "c5b0465f-63c3-46b9-b86a-34dac56a4627", "comment": "Malware payload (Mirai)", "value": "ddc56c893421a4fd512fee9fd0bc91daf864b04f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128813, "uuid": "8dbad8ab-94ff-4aae-b876-0331d77af7b3", "comment": "Malware payload (Mirai)", "value": "6469a0c5464817e6087d5cec003e2f35cf3d3d996e3049d90690968bd81a3b4ad8519461c1472333bf2b21d03f5664fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128813, "uuid": "446e4fd9-a42f-4e86-9c79-ecbb51901e33", "value": "T19DC32B99FC90DE52C6D52675FA5E418C332313B8D3DA7106CE209E34F7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128813, "uuid": "48fda492-2393-4c9d-b87b-a7baa8431941", "value": "3072:eEvTPobiEG0tPUQ4g8OLCeiuMaUYSrF/9sU/f1Dl:eEIltPUQ4g8OmeiuGrF/R/95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786128813, "uuid": "5118ae5c-bec9-40d9-914e-618437a63f57", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786128813, "uuid": "a76402bb-19b6-4914-87b4-2c79c8e445ea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128813, "uuid": "71330bf9-068f-4463-bb24-1e60ed165e31", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada4fae6-926c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786113089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113089, "uuid": "467d7c61-2525-431f-a95a-1e31eb084f21", "comment": "Malware payload (Mirai)", "value": "dfbbf96df412f2d3d1358aaae94e1123", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113089, "uuid": "d2813484-1432-4f22-81d5-5896cf4f6a21", "comment": "Malware payload (Mirai)", "value": "9cbe35b1d10f55d712738644c60c2cc47eac13e06f23ba849abb1bbdbdfdc5f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113089, "uuid": "c8efabb0-cc7a-40ed-a3f5-c3639be282df", "comment": "Malware payload (Mirai)", "value": "6a53354adb09fb16d146c9d5a2b6c30e4ab1b6bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113089, "uuid": "5ee469a8-75f9-410f-a415-20b260d2f19d", "comment": "Malware payload (Mirai)", "value": "36e01afb4007f8a694425145b2ff592f7713606b7002c98b350ac66f6fa5bba61849e8dd39920e83fc11691d02d36757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113089, "uuid": "1200833d-8c12-4677-ac06-9e0f960669cd", "value": "T114B42B51F8419BA6C6D12ABFFF5E828C732317B8E2DE71129D195B3073DB85A0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113089, "uuid": "c4d128ad-cb89-40d8-986f-2159983f18cc", "value": "12288:JwnKB7xQvyfU7wpeDKecldiIz5xcNgKLPdB43YZatkNe:+IQqne6zKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113089, "uuid": "06275951-099d-4d4d-b0d9-f0cd45422c5b", "value": 510624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113089, "uuid": "067bfa09-97f3-4f43-8bfa-e01e1254382b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113089, "uuid": "bf52049a-fba2-40f7-b48a-69000ee1ed36", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0090bf-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097889, "uuid": "28d7a5ac-e677-4c1b-9154-90346853cdf9", "comment": "Malware payload", "value": "e6e317409e586391974f890b97cf6bb7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097889, "uuid": "6a4f1fa2-ca8d-418f-bef3-2b244cc21bf9", "comment": "Malware payload", "value": "9cec051c6baaa9cfd3d022fc1b35665efad58d9e6f4986040c155ec9456696d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097889, "uuid": "e0ac54be-981a-4d2b-9045-c6ad46f724e2", "comment": "Malware payload", "value": "c44d055b3c4b095b82366f5d99bca6b65ac1a4e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097889, "uuid": "210c85c3-5b5b-4755-95bb-a4edafef5297", "comment": "Malware payload", "value": "86ad9c8b4f89759d03aede2d78ef42b77a802d7b21145a3594e49e50e6bd1117b15b0e6e11cfacc57160f09610064aca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097889, "uuid": "1964ca05-536a-4fda-b8c3-3de28440287a", "value": "T12F93FB055897B4806376B7BFB72B98E4E7A657270240291BB83C6440EFF2D09DDD0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097889, "uuid": "af859b5b-30cf-45ad-85fc-6616b699601d", "value": "768:kOkUqKsY4NeXpBoU0Bt4+mhHEZzHWwWbEZ5UJ0ege7JObsqS2f+yjipIjUzwun/n:rk7AobFmIgwuFtT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097889, "uuid": "f6fa00f4-685e-48db-8c01-fe63eaf90615", "value": 90628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097889, "uuid": "ab60d5f9-42dc-4e55-b13b-0ec79658353b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097889, "uuid": "d0e63057-fa17-494b-ab08-97b767e3e76e", "value": "ePL_070826_4848.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58a3e34-922f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786086956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086956, "uuid": "08820ec0-0bd1-479a-af47-4c5eb85c24be", "comment": "Malware payload", "value": "fee5c4ce1be82752265349da9b2e03d4", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086956, "uuid": "94e70a94-95e2-4483-9286-e336b06d77a0", "comment": "Malware payload", "value": "9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086956, "uuid": "7d7fc322-da1a-49d6-bb74-a3406a55ef4f", "comment": "Malware payload", "value": "b16b0950051f5a6314d5fc843d1377e8edce26de", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086956, "uuid": "0ae48c98-32ad-4d80-9b3c-6d7dc39512b0", "comment": "Malware payload", "value": "e3c89a00d2d00659c00af0995598521d0769e4e32ae7f2cfeeeb710c1a7f51c3dfbbaeaac67a9fd79fd72b796e54b34c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086956, "uuid": "9b7c3fe2-ddae-49e0-befb-1676b317d1b8", "value": "T1914623336F65196FC970533AB02F29327F7E541B424CDAE6AD5CA1013F8B1C5863B4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086956, "uuid": "e0ece7b0-cde0-4c00-8316-2a68c82b456e", "value": "49152:rf06GFmqF5yMCYk8pMsv1ekppfcYvQySutQ/cELEOpIVzvpix6yL3l/txM0bSSJF:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086956, "uuid": "9145e674-fa34-47b1-87e3-557a83578dd2", "value": 5554176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086956, "uuid": "3aef81c6-6b16-42f5-956d-bd01320cca7b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086956, "uuid": "46faeaa4-2a75-4753-9a35-d7b49de5fd43", "value": "0Tramxygit_pqygaj.523677ZJSPJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be105aae-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097654, "uuid": "bec71faf-54f2-4aba-aa2e-68e559dec172", "comment": "Malware payload", "value": "ee41933b93e0a78934e9cadc575f2136", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097654, "uuid": "d50881b9-4b9f-4882-83d7-2f126200b87e", "comment": "Malware payload", "value": "9dcd49e5979bae32b448bd0961aee79751815817e506cec9c2f42c1f94c3db6e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097654, "uuid": "ccca8300-6d39-488a-8d84-8da4804591c1", "comment": "Malware payload", "value": "767dcba4e83acaa576a1ead9a70c7f783458fcbb", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097654, "uuid": "46466d29-9cef-4a8b-8511-bb76cd3a48e3", "comment": "Malware payload", "value": "5f69bc6793c4dc5247cf20f504f03b208915e211244b97e6aaf30c2b57a8abe86190243c25cd2e0e22d1cf919de50aeb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097654, "uuid": "4043728c-1f57-4e50-b626-0dc09fc3d6a9", "value": "T1670181DD87D61B28E3B3173E456571651932FC47FDA29B49106947C0C4395B1C436F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097654, "uuid": "547af5fd-1495-40d8-a4f6-5fb1df7fbeab", "value": "12:8GQJs1j4ZrG83ElsnofOjAcNZlsnoV4mrXEdydxn:8GQJdRcsnoaAcNbsnoVbEdydxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097654, "uuid": "33209a27-04f1-433e-a1be-4cf0949e0b16", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097654, "uuid": "77ee799c-be9c-4edd-85d2-96496680337f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097654, "uuid": "6e864f2c-5d2b-4262-a744-c1e6eaf9821e", "value": "formulario de pasantia-3.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a0387d-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786095860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095860, "uuid": "1f62d216-1790-4e51-b004-e437ca05a058", "comment": "Malware payload (Mirai)", "value": "536db08a07ec2cad46003c2fc8f28346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095860, "uuid": "3add84bc-c0ce-49a6-8730-963bf0569b5d", "comment": "Malware payload (Mirai)", "value": "9e473fd55ad7c5fd58b5ef368182276ed99ebb2b37f5733a33203c13eff22d4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095860, "uuid": "99783a85-b8dd-485f-975e-18c23f14aa3c", "comment": "Malware payload (Mirai)", "value": "61e6aec26b44f46a0011762eb744abd3bbd2ac65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786095860, "uuid": "4ca3cd69-537e-4991-b964-8849ce4c1a52", "comment": "Malware payload (Mirai)", "value": "86e94e07cd7570167b6d65dfe776416a8e24f756a91d743a2a2f0976f6f41a9df254fda3b9e524781582c8c86abc790b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095860, "uuid": "c184f057-b645-44ba-9285-dccf057824e8", "value": "T11F858D56F6E364BCC097C430435FD753A935F4A911227E7B2A849E302E66E706B2DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095860, "uuid": "ab30285c-0868-4d48-9fb1-196c976e1f75", "value": "24576:ushx0ukE/H3ivLRcclj5vddxBgRo9IWka5rsSvidZvnFuxg8xK3XA:uIxPkE/Xivt3FdxBgi9+a54SvcZvnCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786095860, "uuid": "46d0be2b-92d6-455d-8397-2d81df05e2d1", "value": 1755824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786095860, "uuid": "81cadd97-54bb-4c07-823f-173da0ca27b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786095860, "uuid": "308a2fb4-2980-4e24-aabe-e5b8137e28ac", "value": "9e473fd55ad7c5fd58b5ef368182276ed99ebb2b37f5733a33203c13eff22d4c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ec8204-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137881, "uuid": "4165d56b-4757-4669-801d-199ad66111c4", "comment": "Malware payload", "value": "96b5f80af852448a03b5faf666cd4de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137881, "uuid": "d6687585-9013-4ba6-8326-19d81c640951", "comment": "Malware payload", "value": "9ef2504a2d6fda7c83170f620e1cebe67d24ac47239d2bd28df7cd13d2e84f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137881, "uuid": "2c9753f6-1525-437e-bf3e-aa6001fa942f", "comment": "Malware payload", "value": "13d780707bc8ca94b0654c52793c207b2b702d53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137881, "uuid": "134377df-42c2-46e6-b7cb-afbf41b9f97a", "comment": "Malware payload", "value": "3a13b2fadc4b35be25d0064e357e582867916a366a6e63c18248e55c655a7655a2f24165ebf3238160c129f167087950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137881, "uuid": "fd73b72a-bca6-4cdf-846a-bbb21ebf6050", "value": "T1206318367706AF63CA7D92350FF2CAB9E9E0365118E690487342DB1C6E392686C1DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137881, "uuid": "b5bb229f-628d-4b54-8780-8b1a9d224b4e", "value": "1536:2bMvZFLk6l42BVquclz77enocQCQhP7DI:rKAVqFxnejrQhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137881, "uuid": "55141931-c6c1-443a-a681-23be8b7c092e", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137881, "uuid": "38d9ec8a-0381-4b0a-b5b0-c99bd5cb7077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137881, "uuid": "ddabe267-a206-4a2f-9064-df35d515b5e3", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e5314c-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066767, "uuid": "c5b6603f-37e4-4145-a4b0-b0c7cb3434f4", "comment": "Malware payload (Mirai)", "value": "c5da82555ba64dd2870f01adc8d2f48f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066767, "uuid": "61d843e8-4d75-43c3-ba48-170e5ef0290d", "comment": "Malware payload (Mirai)", "value": "9fb7734eff92e7186fc51250c305b087df7c7c0698ab6a987a5027c0507b38e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066767, "uuid": "4711435e-06c1-4004-8204-1090e2cd92c6", "comment": "Malware payload (Mirai)", "value": "2e167353d07227079b50454603875d30f1953db1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066767, "uuid": "9edbe5e9-f8f3-4a33-9962-0590301097c8", "comment": "Malware payload (Mirai)", "value": "2bbded1946c6b69470d9915a7ed950c2fa2a7eb65a74f8d01bef80316b7b23ede9bdf1b6c869d16e19650421b0d7080a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066767, "uuid": "82bb82de-be21-4bbc-8d2d-7f0ecc27fb30", "value": "T10914D70AAF910FFBD86FDE3706E90A0235CCA55722A43F353674D524F54A64B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066767, "uuid": "c90817aa-a1bb-4344-a66a-0e48aa369d7e", "value": "3072:QNqm236VBWbOAvwoFhA6EdAAy/LZdOgdkQHUjX:qly6V8d7hA6qyFoIkPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066767, "uuid": "137ec31a-0ce3-4e04-be18-23dec38d922c", "value": 196788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066767, "uuid": "3521bd06-69df-4a40-86ae-1585e1c6dec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066767, "uuid": "6bf269a7-c28d-4d08-9c83-3adbf9122a31", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee162bd-929a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786132633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132633, "uuid": "3cba8c4f-d457-43a7-8ba5-929e059526df", "comment": "Malware payload", "value": "97b9e2b3ea8680faf200027db6a17181", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132633, "uuid": "32462868-96a2-45e9-abb2-42cb813c297f", "comment": "Malware payload", "value": "a10a1246b36d37c7b5dc44884584790a291558414f5b965210423a398c113c18", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132633, "uuid": "987b4678-64fa-4d6b-be4e-db8518189c4b", "comment": "Malware payload", "value": "9eee763b77e4cb8bd32d8df6724d4d4f6c049626", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132633, "uuid": "f2498d16-c9b8-4ae8-8c27-e7fac62fba0b", "comment": "Malware payload", "value": "225470333416d09042bf9a5d92fb80aaf61ac88a7331468b603e6b57b05f39c96f34c3573686160c90fc8f996e0dd2bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132633, "uuid": "84e80779-0363-40d5-a8d9-001fc6a3f6c9", "value": "T1163134DA00241E311543DACE73B73488768EA5EB185FC7D4CC4C5EAA538979CF261B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132633, "uuid": "9232c60d-0d96-4f0b-b993-802068c5c12b", "value": "24:y8LQYetCtPbrc2bfWfrOtNogDBX+uXmxJ:y8LicpbrjSOnogD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786132633, "uuid": "4b16cac8-38f5-496f-9823-97de4d6ac8f1", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786132633, "uuid": "ca72872e-a3fe-40c4-940e-3b962f9327d6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132633, "uuid": "d2a161fe-4d5a-44ee-b0ef-a205c1e49bce", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe6e9eb-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786135614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135614, "uuid": "c7004e67-0a02-4822-9a6b-7f644929cf6c", "comment": "Malware payload (Mirai)", "value": "3e58a6434feb1668f6f157fe55e789c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135614, "uuid": "f26c900b-300a-4290-8c1c-49adc0798735", "comment": "Malware payload (Mirai)", "value": "a2710ae2c19298d4f6a362b3a32d17c4f2b0e138c163c3442f350bd5a44fadeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135614, "uuid": "267423d2-d3d8-4a60-8a9d-0a28749ff452", "comment": "Malware payload (Mirai)", "value": "bceabf9508d52c0dada61c967f3bf616cb8f516b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135614, "uuid": "89f8fc04-0f56-4298-8c60-284d7fc3096d", "comment": "Malware payload (Mirai)", "value": "143314fccc89cad71c954b0697d8c2f717ecb7353ef81f1ee87236dbda1ac9b58cc81f05104fab1c31d9ffb8452dd00b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135614, "uuid": "20c29895-818e-4144-a7bc-544869a74624", "value": "T18FB4C08763093E3EF1F7543E84E64F17AB35A38451832B5B2135F96A69232F43E31686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135614, "uuid": "192133d3-66b5-4b65-8b31-d40ef5cab4ef", "value": "12288:HcOUpdISThsRZ35YHbVFKUkMNBLVLhVo9:HDZmIZJ8H3V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135614, "uuid": "c7dfa6fc-0134-4c32-9d30-4e185c0a5a01", "value": 534600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135614, "uuid": "689bba42-0c70-4b8d-be24-af94ff1eb5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135614, "uuid": "d155cdce-6472-4049-a263-27624d50a57b", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd14da6-922b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786084981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084981, "uuid": "1cb12f35-3597-4010-91fd-d792b42618a1", "comment": "Malware payload (ConnectWise)", "value": "388c773164294c5548bada60336384ea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084981, "uuid": "86c00536-6375-41d2-a17a-27fc106f5c0e", "comment": "Malware payload (ConnectWise)", "value": "a2eaeea6c061fef9dcca3ee823b828f6aca5168b8b1da3303bc94b29860f8b9f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084981, "uuid": "3b149aeb-f919-49cf-8f7f-a8d6c2407d0a", "comment": "Malware payload (ConnectWise)", "value": "ffe093ec36876e7a5e05aab5d118084e12f30626", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786084981, "uuid": "edc5fa29-3e74-4fc1-a4fc-52cc606dbea2", "comment": "Malware payload (ConnectWise)", "value": "3435667b740afe4a12962921d312bd4de434d34994076f9b50cdb0727e94b04e5efa60f8009397efd63afe362a8721c0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084981, "uuid": "50339f85-2721-4155-9188-8b09b30160ca", "value": "T11346E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084981, "uuid": "a3c3c61c-396c-4fc3-9c8d-08c2fd7356ed", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084981, "uuid": "aa91148a-8198-4aae-9ade-77ad27220914", "value": "98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786084981, "uuid": "2cedafcf-a245-4b61-a705-d8c6d6ece394", "value": 5653184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786084981, "uuid": "dedb0e98-a395-44dc-bce0-9b7cb27404c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786084981, "uuid": "959e71e4-59d5-428c-989d-e40866b4750b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3f9ab1-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786081409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081409, "uuid": "c570d537-652f-4ca2-bcf6-fefedaf165e4", "comment": "Malware payload", "value": "e5390958c2259a23b0da998275659a9b", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081409, "uuid": "e5b2041a-a062-4d89-82c3-9d808c20d868", "comment": "Malware payload", "value": "a3ca34b5d1d3788024fe3ee1bfab3f3958a017acb3141d96c72792043d343dbd", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081409, "uuid": "2aadefd6-8e14-4aa5-9631-da360817276b", "comment": "Malware payload", "value": "3c7da8e8d8f87d29cf16b00e36fcba17c9c7981b", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081409, "uuid": "df142400-9e2d-4475-87d8-7a6373360f6c", "comment": "Malware payload", "value": "e6e26372522ecbdf651f84c304646f0e9c2ece3702b82c5f6d257b9f036aa2ccd9b54a37b07ee3fd1d85becd2c1f6855", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081409, "uuid": "b2cb018f-ea4e-4fdd-807a-94a950b9f002", "value": "T104D52386A5F52970C837C7B24F83F46E706E3B918A328D0BF6CD2A409D925685C77772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081409, "uuid": "94f629c5-f0ec-432d-9fe7-287bcac8c0a1", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081409, "uuid": "daf9ebe9-e491-4b34-9f2f-cebc6c96bf36", "value": "49152:lCFcpUmS7plxxFlF/NLoc9xLen7ZAyWXEt2q6GRz4cvQvZmiVOlyfhcLC:lCypU7zVlFVD9xW7Z7Q14lEhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081409, "uuid": "8ae91e83-a10c-4b91-86ab-038f9897720e", "value": 2933248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081409, "uuid": "cccba38d-a974-4d2c-818c-b713f02def37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081409, "uuid": "e41968c8-acd7-45c5-98dd-68c8c908dc67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811004e1-9278-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786118168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118168, "uuid": "0b856cc2-7804-468e-9620-f5879271dac5", "comment": "Malware payload (ValleyRAT)", "value": "4d56b55b133743418061a05b4c09cb74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118168, "uuid": "3b88be26-af5a-454f-8d27-b8d8f8be4347", "comment": "Malware payload (ValleyRAT)", "value": "a42df8053e42a3f98ce47aa8a0d130c0aa939d3dd9a8585011ddd665a8463fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118168, "uuid": "75d6dd5e-ea22-4e7b-8e36-a71b1d912ef6", "comment": "Malware payload (ValleyRAT)", "value": "a5833eec48932d697f0cdc1780e4010667513f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118168, "uuid": "63bac87d-21d8-4f92-9523-8c696d21ffab", "comment": "Malware payload (ValleyRAT)", "value": "aa8e9ec23c60756812e7659480ca63ec64d6de05a659935b582f96187d485a1897668c878875161167b8c980eea60fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sj[pd]", "colour": "#FE7AEB", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118168, "uuid": "80a1c8e4-91dd-4c66-ba50-b496184690e5", "value": "T1A3069B24BDBA812DD027FFB83DECF99EE9DB66191506646B001703478626AC0CF4B5BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118168, "uuid": "bc46eed9-3f75-4dce-b7c1-c3d85a574761", "value": "a56c705e46271b9765bce74b10804dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118168, "uuid": "e898a6dc-eb01-4c1b-bad1-9317e79343f0", "value": "12288:dhREHV6oG9qxwOmSt2VHfg5QPNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTX9:dhCkat2VHaUewNLrvq1jDwbjfFN7Q66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118168, "uuid": "18d06be2-15f8-4ad3-8005-4649cc94a976", "value": 3806056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118168, "uuid": "c5d818e2-443e-4dc8-addd-18a592345698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118168, "uuid": "5952dbb1-3f44-4aa6-be2d-83ee53da7e68", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7629dff0-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118579, "uuid": "6428c5ab-98d8-49e0-a9da-09ea5db7678b", "comment": "Malware payload", "value": "8401e96f3e47f9e0fb2544424acd1434", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118579, "uuid": "8bffe1c1-68b7-4e1b-bfe5-e44a3fa96dfb", "comment": "Malware payload", "value": "a7e8bb5263b34be020d8b5c938b4c4187f390b9240f9ce757cae953da9988227", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118579, "uuid": "de0b6aa0-f2bb-42c4-91bf-d0d2313a0839", "comment": "Malware payload", "value": "30584a4b5f16c8125f62bfdbc24c939d21be3784", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118579, "uuid": "a5d61203-54b7-406b-b349-b293c755e93d", "comment": "Malware payload", "value": "1437cf6831ed2d5bf284f37e8ce82ec8c7aaff081e095c3234c25b58530e657cd310c5c78bb381d95e740a716594a827", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "memory-only", "colour": "#EDD5AC", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118579, "uuid": "c96f68ca-d24e-421d-870c-c5b47c49de94", "value": "T1C6E5D8855F44E352C46C473543EE0F19233086B4BDC2FB0FEE95ACB8AE6B6E5D909096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118579, "uuid": "a5d436fe-f261-47c1-913f-9643cf169e44", "value": "24576:B7+jnuKL0QACGe1p8iZePZgqj7lsld9XTousfMofBxsbSwJg0LPEQ0j/TXDJ1Gb6:h+ruK7HZePZgqj7ledou1ofEjfqkyqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118579, "uuid": "68695206-2a9c-48b9-83ae-6871820bc8c4", "value": 3054080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118579, "uuid": "86784c6c-2334-4a03-ba7b-dea5f691757f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118579, "uuid": "e98dabbd-d48c-4d18-af9d-cd06ba0637a7", "value": "stage4_WrickSpilth.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca40f923-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130317, "uuid": "544cb512-f1a1-4294-bb94-e7d82ee3eea0", "comment": "Malware payload (Mirai)", "value": "2c6f5ed88811004f831e4767dccafdf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130317, "uuid": "fa835aa2-e8f5-4b97-a820-58c245ea5f23", "comment": "Malware payload (Mirai)", "value": "a834705aedd521b2d75ec51b593ee82f49d8f3b9c61b5ef6034dc8340b70a98b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130317, "uuid": "51ae9fef-1d0b-4ff4-8567-84d551905bd6", "comment": "Malware payload (Mirai)", "value": "bbb39bfe45c689fa179435f99669545f960e6d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130317, "uuid": "2610aa58-9966-44e4-8d0c-2a2048fe2d57", "comment": "Malware payload (Mirai)", "value": "03bb0a7c219ced6ff16bde111c1c1f78a7916296c5af20c1cdcd14bf0fadf802aa6e48c0a10d37a8d972f434ade89f80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130317, "uuid": "1499ca71-84fc-4fb2-b4ef-5520dc2185e5", "value": "T1E5B43B51FC419BA6C6D12ABFFF5E828C732317B8E2DE71129C195B2073DB8560E7A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130317, "uuid": "1515f383-6408-4b58-b7dd-5fccb6dd3ef7", "value": "12288:d8BQtAbrhwwBLELeD1/7YkIQ4zj7BI8h5rJ48V8WnSe:O3bEC/zkJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130317, "uuid": "459108b1-ef63-4fb2-82f0-d466d0e9d188", "value": 516512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130317, "uuid": "2a0ac3a1-b67e-4b45-b54a-9f3ae810c0ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130317, "uuid": "15b7040a-3065-4f28-bd5c-4c878057abd5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fbf7ce-9203-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786068012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068012, "uuid": "dd5d6448-0f48-4c5a-8342-dcde3617497b", "comment": "Malware payload (Mirai)", "value": "f1583f3613d50ece6d6c113de77b7ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068012, "uuid": "88272e3d-bcce-435f-a525-47367a3f7a98", "comment": "Malware payload (Mirai)", "value": "a9a08daf07f1b3b65aefe346cece1f53a82d2dd69cd7f73a3827ae6f20c0d1bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068012, "uuid": "3ebcc46c-3af5-4828-b311-4a8adc5ceecf", "comment": "Malware payload (Mirai)", "value": "1d2815bd5c54f60b97edd4626e5ced2bc5698256", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068012, "uuid": "91693a65-42c5-4fb5-ad74-e35e2fdcfdf4", "comment": "Malware payload (Mirai)", "value": "6705091d7190039bccd918e9cbb2879f4810aa5bb0a91174ab90d7f9f4dd7f656fe954fde3a818a97eed59aa67d94fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068012, "uuid": "54e87113-95ff-4075-82cf-f9edf0cb3081", "value": "T1B393026CE0D43A91659CAD78622F15F1FD20D844D7AA329A33DE4E8C0F4706B5E9E0DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068012, "uuid": "e4b4ea89-2872-409d-b9c8-8c7736c3845d", "value": "1536:w845eht382rIQPVTzOHPqJLJIotui9BzF7+4hOlbzVS7wCovw0vWfNKzdqiPKZBO:QehtDJz1JItW7JOlbzU7wrluwzdR2mBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786068012, "uuid": "975ea350-7d87-4045-befe-5051d7b51960", "value": 94488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786068012, "uuid": "b1074cd0-5f68-4a84-b022-11ab3bfb0c7c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068012, "uuid": "319d1edb-2f50-4bc3-8e99-5d1307fb4392", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0935f4-9244-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786096015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096015, "uuid": "ce5564f9-f232-4e12-bd20-979a2440f476", "comment": "Malware payload", "value": "ce37733a06f8241a9c154fc6dbbd7961", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096015, "uuid": "8506d7cf-127c-43e1-8b12-919abb79a88a", "comment": "Malware payload", "value": "aa35fc0f401673c49ade59da35761175d5de7cbc1fe3537bbd2c0a5401468920", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096015, "uuid": "06518327-51f1-44ac-a23c-c8813dd0c3d2", "comment": "Malware payload", "value": "e18c9c4e8078384f260691197d5b9f97b5fcec4a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786096015, "uuid": "4a700dcd-81f0-49f2-9ca8-0efd67eff96b", "comment": "Malware payload", "value": "0d3c06fa0f12bc7293f2e47c2c8986ef1695a7b930ead54657399cc5233ca35d397b4735bca5ce95eaf68f934de50992", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096015, "uuid": "53272f98-382f-4eae-b547-d3459dec14b1", "value": "T13EC4231AD301FC49CB1358BF941CD5A33E866C995006FB4F3941F6AE07A61CE87EE2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096015, "uuid": "ae7070c2-16e2-4462-9704-c033ef4f5c94", "value": "12288:8poA8COkjk6+/E1UJxgxqWOr2/28+Eecj9HleuxdYZ0:woBkIj/AGxKqWc2uZEe6F7x20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786096015, "uuid": "d586b08f-3de6-4f01-a53c-bb0a77683dc0", "value": 569430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786096015, "uuid": "3cd249d7-168e-43c9-9885-c1d7d7683aca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786096015, "uuid": "4dcd9796-ab68-48df-9a49-73fb6d12ab04", "value": "AKASHA SIMPLIFIED JULY.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48db4cf-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129931, "uuid": "e921a4e8-a3d5-4c46-b48e-5e246c5fcb7e", "comment": "Malware payload", "value": "b7373dd1f85024c9dc54d5c8af4ec1f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129931, "uuid": "9fa654e2-0f20-4cf9-834c-738ab665e233", "comment": "Malware payload", "value": "ab46f0996905496b7b4fcd91520a5f7e89bb154a3d2c603e9787c411e45cae28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129931, "uuid": "09646f90-f4c4-46cf-af22-f09901cbde18", "comment": "Malware payload", "value": "7b7258266a581a07f0effa9a1e05b3955ec26afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129931, "uuid": "daf62eb8-103d-4bca-ac34-27ecf8b26b2a", "comment": "Malware payload", "value": "e820836a1bc29f8ad433cd0feeb96b112e7d765ed73693a0473a4ed7b437f160eb0655a8104ad789595a17bbfaef532a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129931, "uuid": "15895b19-9067-44c7-bb0f-2a96d2435974", "value": "T1FE53D60F7C1ECAB2CA919634C63F00511655CB5158BB9F326ABAD61EDBB212BD317CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129931, "uuid": "09cdbe4c-8213-40d9-a5c7-5a5206822bfa", "value": "1536:Z5BO5xjMM7l19SDFdpPeb2gZ8Maf9BTv:3B6xjMMZ19UFdpQyMaf/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129931, "uuid": "1621c614-a016-4363-b45d-c9362b0de310", "value": 62120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129931, "uuid": "50b5e0ff-69d4-4ece-9e4b-13eaf3a38302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129931, "uuid": "25e2801b-b2da-4b5f-abc9-ad4ba8a0c309", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5b5cea-926b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786112739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112739, "uuid": "ba82f983-af8b-4f73-a472-52c864b4e76b", "comment": "Malware payload (Mirai)", "value": "4a5a627c6f5c9d39dbc74e66ab52f330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112739, "uuid": "18f4dcd4-7190-4537-9ea0-5f8a12df7595", "comment": "Malware payload (Mirai)", "value": "acfcabaf7efea0585edaa36b830ca0346b7de8801c5c3994420cb7c68fec4d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112739, "uuid": "4025a0e8-58e8-4493-8371-47d414df7c5b", "comment": "Malware payload (Mirai)", "value": "25c1a6a52aafaf86ec270a9b914641d9a114dcee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786112739, "uuid": "2de0e90d-b054-4da6-8b70-96c03f70e47f", "comment": "Malware payload (Mirai)", "value": "04440c0b3bd15396ae558db50ca2be2d19543cbfdaa516e96199e471e61d0c902c34c23f787c963381546195ca75623f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112739, "uuid": "9876e806-ea96-4209-ae79-2899776e6ca7", "value": "T11BF45B02FF446FEBC46FCD70892DC35B14EDA98756C1A27971FC4A8CBA5965A0EC3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112739, "uuid": "1a0eebc8-5a35-490c-ac9a-f897a7ebd553", "value": "12288:bCprkAdiJbjHDw5rgmOtY/4iAEGKoWRstBTNffcp+aIBxXP89Pf2SjDPwbG6xNK9:b3I8E1I34i28HeEULxymNVDgfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786112739, "uuid": "065a8f49-33c9-446a-b90d-baa283dd4dd3", "value": 738432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786112739, "uuid": "8619a27f-8602-43ba-80a3-0f684c504811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786112739, "uuid": "450ca901-9447-4dad-a7bb-b3da53e224ed", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bbf96c-9221-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080860, "uuid": "394e0b82-ea7a-442f-90d3-4fb048410dc0", "comment": "Malware payload (Mirai)", "value": "a64b1d05894a4f81ccbe3f2405b63a9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080860, "uuid": "b19df524-0554-4095-8dd6-2606d24a5b7b", "comment": "Malware payload (Mirai)", "value": "adb6cb8832d0e0980ec41ad725cfb3182e7ed6603ac085494be0bcb954ef08d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080860, "uuid": "c1e885f0-9cb3-4a1c-9392-52fde26a3e7a", "comment": "Malware payload (Mirai)", "value": "1cfc3459248061a4103d9a6b1ea5f538619ac70b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080860, "uuid": "b8ab563a-b3e0-46f7-9847-4fdf3511964d", "comment": "Malware payload (Mirai)", "value": "56ff84ca2e30eabe4d90b79fac94c3fd8e316ca923045ec6393bb2489dca5fb322013c60769fb2e45eecac9a170f1be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080860, "uuid": "21718c22-27cf-4b68-a907-ff5f2c85f315", "value": "T1AA4302CA2BE42D86DBB33AFD8D6881512FCBB7BAB27771504D0C8D026D01351639B6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080860, "uuid": "7d656e94-31d7-45cc-9055-23e62fe9c069", "value": "768:BHAJStmAJgKqun9fggdcllI76uPaGanG9WkOQsOx/QCb3U03wf8:RAJStmAJgKT9cjNG9WkOsQdf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080860, "uuid": "4e6d4811-f328-4af6-9ad4-f2c3521f3597", "value": 56348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080860, "uuid": "52628f08-7c14-4bed-83c8-4d453b121f78", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080860, "uuid": "b3649ea5-5011-466f-874a-1b9429954c55", "value": "adb6cb8832d0e0980ec41ad725cfb3182e7ed6603ac085494be0bcb954ef08d5.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70029032-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786131024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131024, "uuid": "a6f3a2d6-623f-4b25-b8bd-6f363171e70e", "comment": "Malware payload", "value": "c9b45d1375dc83ac067a53b46f530b57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131024, "uuid": "4bc1a7eb-eccc-4c80-8ece-52941f113cf9", "comment": "Malware payload", "value": "ae87db8792e25d5d09b5732f1cae306bacde28f0ec927be19abed84b92c5f593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131024, "uuid": "7001500c-5d29-4098-ae8c-ff7913889037", "comment": "Malware payload", "value": "ce34eb17bcfd54107eab326bdf10dbc29a69720f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131024, "uuid": "2776dffd-be5a-4cd1-9c34-925213824776", "comment": "Malware payload", "value": "8898f31e71d87d31507fdf31718f2189d5ffa6a9de1aaa88c360b95f30b1a8d85444c4966d9510b95979154c24d7e00d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131024, "uuid": "7b0375bf-5418-40c8-8a80-24810daf235c", "value": "T11C132ABBDE0E3941D3C4E338E7590BE1A02FB964D29640B77E42718DC4ED9DD8DA2246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131024, "uuid": "dc2f0711-6ba2-4ce1-ab43-3e994e9512b9", "value": "768:tqE/xfKgmx0BHXAa7WekjHAipfgTp1lxLtzoCeRmlKJ:tqMfKglJAmkciFgTpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131024, "uuid": "12db0de4-de97-480c-94a1-fa1292ab6a65", "value": 42040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131024, "uuid": "debef5dc-1ff4-471a-af25-7af0b396c983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131024, "uuid": "1949e0ec-7f1a-4bbb-bafc-36153f5ade8c", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27df85-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786113678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113678, "uuid": "5e908220-5cd8-4716-8912-5b3186e6526a", "comment": "Malware payload (Mirai)", "value": "f6ef766f67d22458d4503443f4218add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113678, "uuid": "e2964b9c-89cf-4648-8682-65284504d166", "comment": "Malware payload (Mirai)", "value": "af228d098b639432aec922f1cab742d72f1cda07e9bafc1289e2d1da99dec7ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113678, "uuid": "3a995797-4977-4001-9dfd-baec4dfca798", "comment": "Malware payload (Mirai)", "value": "73054dfea6a92d81c010aed3a41b96f643d3cfbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113678, "uuid": "59ee9590-722f-4dab-8d1b-6de65e897190", "comment": "Malware payload (Mirai)", "value": "4068ca38cb8a259d9262760a31156dd1ce8a433418ec35e571fb23b78c84888fc265d120e2a99b4f71fee58e7e5ea9af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113678, "uuid": "85aec6d6-f65f-4e83-bf2c-5f01d9d07c8b", "value": "T11FF45A42FF1C0563CA530DF0293E43D5F3217A9240F9D229371E5B5B2622E76AAC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113678, "uuid": "479f55ab-6faa-4df2-a62d-9ac3d07988af", "value": "12288:wXyMnSDYmmnM4OfFBl7d/NCsBul4epnZJ7gsXt4rMxepThS/C6/O:G6YmmnM4i5dksyhgs94tS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113678, "uuid": "a2651588-0ae3-4c76-b5ae-a4656ad5ef22", "value": 726992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113678, "uuid": "466c4101-1cf2-4d65-b535-c2e5202a0e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113678, "uuid": "a79711a3-bf58-4f25-b8ee-217f9aa572ba", "value": "xd.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8a973e-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118560, "uuid": "76731d61-cb32-4b89-bff3-a0ed7d183096", "comment": "Malware payload", "value": "613a1f74df3c98a0a94cabce658b2710", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "container", "colour": "#A23055", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118560, "uuid": "99d393b8-8ee6-4b57-a292-c1102daa600d", "comment": "Malware payload", "value": "b0209a56237964228cbd95cfe7ee4c639e20da8bfb01bc19e84e43cb3d832c01", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "container", "colour": "#A23055", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118560, "uuid": "6b8b6f82-824d-4d41-a5d0-4f2985f4cda8", "comment": "Malware payload", "value": "3b0ffc7bc92957373cf820adf5eaa1cdc735e353", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "container", "colour": "#A23055", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118560, "uuid": "5c489bb8-a89a-4f97-a503-78e36dd5b546", "comment": "Malware payload", "value": "e3a2538f1f35a12cc1afb41d3a95a406228337c9cb12f36a64afddcfc12b581d1e39922cec23ceced24aeee002da0fca", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "container", "colour": "#A23055", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#F5A925", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118560, "uuid": "89fab486-e42b-47f2-b800-789a7359533d", "value": "T191271915BAFC97797FF1614006EA46DF67075C277920EC8B290BB30D58C92A4E81E27E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118560, "uuid": "c3588231-4616-4420-9280-161224b5a225", "value": "393216:Sb8NIjuwNri8Bb33CcdfnQcieu6pKajgKmyIZYo90vLyMApwQEl6tGar6xkdXzZC:SAMuwNri8Bb33CcdfnQcieu6pKajgKmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118560, "uuid": "b107dbf7-760c-478e-8c6e-178bf0c50359", "value": 20590711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118560, "uuid": "5caa5148-2693-4753-b3ba-79283a122b76", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118560, "uuid": "9c49454b-8a97-4402-b0bd-db0a1d4446cc", "value": "7Mmpw6GIH3zL.lc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef866693-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786081417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081417, "uuid": "624d91eb-99f3-4cd5-a321-352df91f27f0", "comment": "Malware payload", "value": "73ca633a53d75321616625937341fc12", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081417, "uuid": "abb62193-cf86-4c5f-a0bb-f1fb17e9bf55", "comment": "Malware payload", "value": "b1a28aef6eec7c73533a608c51a9c23daff55521998520b775b0b66dabc9f547", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081417, "uuid": "663f07ff-3889-4762-8c4d-7b2fb40b3a5d", "comment": "Malware payload", "value": "9fced325719fe5b50f5b8743310103c62a634fe7", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081417, "uuid": "6fbbb1a7-2596-4a0d-9363-024d97a86ada", "comment": "Malware payload", "value": "aad605b4e7205a6d526fd0cd95cb1b5257320ee678afb0941ea1801b7876e78e7c36baa95fde7b5287a91328aed27260", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081417, "uuid": "e0a96cdd-b44a-4461-afc3-2b29b720bf1c", "value": "T148D523D9FDB61970E433C7F3838365AEB1293B5193B44C9726C89B145E52228AC3B379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081417, "uuid": "41052223-4cd8-4bb4-8bd0-3ae6025ec3ef", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081417, "uuid": "f6f27e22-0a08-4187-b2f9-d8514dc6cbc8", "value": "49152:V3VBV8V7GM31td/9aG2gKmq9Mowx9JFZF/XMBaLfeiEvGwg9HThe2:VlBGVqMJ/9ayKmtoUJVXfUGDA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081417, "uuid": "4a465c1e-c46b-4369-8f1b-156ad9a598cf", "value": 2972672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081417, "uuid": "4cfa96d0-4007-4a4e-9feb-11ee6ec129e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081417, "uuid": "5b9fd42a-1f95-4b17-8541-7c931f6a0380", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6b48d9-9205-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786068798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068798, "uuid": "acf9a790-fd4d-44d0-a7b5-3d17509eda3b", "comment": "Malware payload", "value": "c21c375b5dd2f9d2a95a4be6f2a1be94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068798, "uuid": "fd922f17-8e29-42e7-9c08-253f24aceac8", "comment": "Malware payload", "value": "b21a6903bc670f9ecbcf74aae1fe4bf479b8ee7430a24d96921e806b13ac1602", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068798, "uuid": "903010b4-8b86-4578-adf2-eda1a334c66b", "comment": "Malware payload", "value": "dc265c6155a7e410844e387d129465b49d45d803", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068798, "uuid": "b5b2782f-fe7c-4d88-8258-4cd2413bb3ae", "comment": "Malware payload", "value": "e3096c39d082ffdc5af069cd03b62148063348268daa498e03aa3e8300edfd9a46f0c02afde44721ddbf389f2d7f0f7a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068798, "uuid": "122ca9bc-cdb0-4bc4-88df-15ede6109514", "value": "T12A235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068798, "uuid": "c63d5d85-1c64-483c-9885-7ed8c9bf23c4", "value": "768:76FWzZx529GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:GkzNcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786068798, "uuid": "48bfa4cf-b85c-489b-8da4-22c0b780134c", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786068798, "uuid": "4a0c21cf-cda6-438e-a925-446d20e4b8bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068798, "uuid": "263b7b17-88f1-4480-a724-ae81e1fa998e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35da3e42-9231-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786087547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087547, "uuid": "b581619b-28f6-40dd-9610-7874084ca0ff", "comment": "Malware payload (Mirai)", "value": "92ca58c62824a6cac29c727abe16b1cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087547, "uuid": "de7d6b60-3003-4f7a-9d25-39929d839c54", "comment": "Malware payload (Mirai)", "value": "b25ecf3369d293c9c66fc28ac4419b8f9d282a50cf3951ad7ed06b822c40f057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087547, "uuid": "7c9a4cf1-89d7-4abe-8e3f-e0e4a60f9e45", "comment": "Malware payload (Mirai)", "value": "987a153553d2a6a08928716e5fdf6c77576b0c66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087547, "uuid": "f7720964-d993-4b87-95d5-7d7f8d3e851d", "comment": "Malware payload (Mirai)", "value": "f3517c0ad86fdc170e5c5d5116ad88c671397745bbfbe31637bef3df3a8c19a5ff100612e45d68853eb817fe12a9f30d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087547, "uuid": "a793c133-5684-42d9-9c1a-78c3f40b64db", "value": "T1F7F32859F980DF62C6C13A7ABB5D428C33131778C3E9B102DD206F3977EB95A4A3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087547, "uuid": "24917757-119a-45af-a0b1-e0456841fb39", "value": "3072:0MF0jbTyzR26NdeAL+ptiCebg17L+M1ZCghVfbMk6:hF07yF2IdeAL+pVebg17L+M1lj96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786087547, "uuid": "8ac4268c-cfb6-40a7-bb37-43ec586857b1", "value": 161340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786087547, "uuid": "35fac8e4-ec4b-4e9a-9bea-28aec9c75a17", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087547, "uuid": "1331d62d-f4e9-46ae-86b9-a712bacfc946", "value": "disconnectraw.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b865fcaa-91fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786065433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065433, "uuid": "96dc56c3-f5a2-4d19-bac2-06acb2073203", "comment": "Malware payload", "value": "a6b651fd9e10ed7e8f5688793dd8fb38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065433, "uuid": "16dd3d75-0299-44c0-9d69-3584ada54df9", "comment": "Malware payload", "value": "b28df0a1e9e330e23c3ce483935e9d5f2fd164679806013f10e40e7123aeec4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065433, "uuid": "effba8ab-486a-44c3-a77e-64666155d355", "comment": "Malware payload", "value": "ea530060d196d0e96e884de37c7cf81beb3aead0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065433, "uuid": "48d7150e-5ba5-477b-93d7-dc9a37fcd862", "comment": "Malware payload", "value": "1bccbf0a6cf64207ea2ec6ebb98ad421ac5b668fb4280290f04dcc8b99eea38622a4efea82fb9a80280a36a17d325d3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065433, "uuid": "d8324622-3920-4a0b-9a5e-0b851e7583f1", "value": "T19604CF58D9D1BF39C84FA27C51B8C8A4A21290CF1369F30B459DAD3DB28A4D4DF6E8D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065433, "uuid": "9250f381-37ac-4029-835a-bd4994758695", "value": "3072:o+WD5Ud5TTCa8U2cn+xaSpkLgzNUZE+gYOyfFR7aPGDkEs43Iu:o+OiPl8R6+xXogL+eyPaQkE7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786065433, "uuid": "30f6b744-8b4a-4cce-b7fb-7753e2848bd0", "value": 190003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786065433, "uuid": "c1c2bb3b-5eca-481a-a1fe-c9296380b62a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065433, "uuid": "0bd17b62-c5ee-4677-9df3-14f9b18fd296", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e229c131-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097715, "uuid": "29e6ece0-1556-40d3-829d-fce2d7d8a354", "comment": "Malware payload (XWorm)", "value": "73c1480259c61a9f42f642148b0b8da2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097715, "uuid": "211b07b1-cc8b-43cc-8677-172693e9f497", "comment": "Malware payload (XWorm)", "value": "b2ba2af9b38cdb7112e0f3d0ef86a5138e65d2bfa139d525eac68a9dbaee49f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097715, "uuid": "94f926db-015a-4881-a16e-222db42d18b0", "comment": "Malware payload (XWorm)", "value": "09da986603b6a03b398be4c22312417bc84c915b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097715, "uuid": "24d5f9f1-d5b2-405f-9425-60ff107012c5", "comment": "Malware payload (XWorm)", "value": "dc146700eecabb2861ca93848e124a41cdb82dd04996b8d6dca678e4d15aac5a1b43fe3204a3d8246417572d0603ecfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097715, "uuid": "454a6beb-7005-49ee-af7e-b4fb860959cb", "value": "T164E3DE520DC67469237767BE622BB4E1E76A4A274244291B783CF440DFF3A0ADED0D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097715, "uuid": "d1285013-f7cb-40d4-8caa-8aca82ed6550", "value": "1536:pMM/0j4IWWRrJFY83a2S0ABUkkHvzorFm3mkshGaMSEOpIhZ8Y0SgYgTv7jt/u3i:r/08YZYjF6mIAhkTBBfssuL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097715, "uuid": "5c494fab-c3bd-4769-b802-c94e39d4224c", "value": 145329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097715, "uuid": "7dfa8508-7e46-42df-a3e9-de5d121e3554", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097715, "uuid": "721c145b-f21b-4b86-ace9-05c68c0c35a3", "value": "SO_08072026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80ca7ea-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097322, "uuid": "1520cd96-6cfe-48e4-8923-2a9eed1d6c82", "comment": "Malware payload", "value": "bfc3a1f987bf3fb268027d56db87a5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097322, "uuid": "e967957a-afa3-4926-8fcd-f58d897a9402", "comment": "Malware payload", "value": "b3b9dd7083c699ce84bf464e727bc80499ab68035bef3e992c2519dac52699d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097322, "uuid": "60f3464a-8661-41ff-a65d-783c743d9445", "comment": "Malware payload", "value": "ddc677baf5a134b2275a1834557ad476ee671a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097322, "uuid": "f71277da-c9c0-4ad2-9fad-806b75dbc765", "comment": "Malware payload", "value": "f6dabf5393739b08a4485cb7914d5d91a256ec6e14cb5056638f962b52560de76b69b526bba23357099eb85a3bf9366d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097322, "uuid": "2e40e987-5250-474c-bde7-d4a61763054a", "value": "T105D633E26B9004B0DAA7E3FA1A514A3D8373B8231774D7DB437CA9195E031D1AE3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097322, "uuid": "6bb60a0f-320a-4420-9bcd-712a91d394c7", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097322, "uuid": "05ba7330-ec07-4547-aba7-5bbd14697980", "value": "196608:C0n60sKYu/PaQrBu51CZ7TQscK2pUZMAbUEO3oDDJf6Wv/VJ8KnWWo3GYg4r5Wwm:VgQrU51CDgUSAoEO3o3Jx/VJWQ4rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097322, "uuid": "1e25b493-cd56-4d41-a427-0b8e11ad9c3d", "value": 13426212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097322, "uuid": "ded3773b-f9c2-46f6-ad92-f8702b30596c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097322, "uuid": "5d657af0-a8a8-479c-aadd-53c1aef55afb", "value": "Isass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54e145d-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097318, "uuid": "dca2684e-5554-4758-9b23-ad8f91517987", "comment": "Malware payload", "value": "a676dc09af58f3555b1ccc6a982e9148", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097318, "uuid": "63b38e19-43f6-442b-902d-2467bfab2eab", "comment": "Malware payload", "value": "b3e7456e3631e81872f327de3d8ef703c92c6ee2474dfd695ce6182649a62e57", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097318, "uuid": "923c73b5-19c6-45cd-ac25-fd65e6168ea3", "comment": "Malware payload", "value": "919c52cb36f59dcd311d8bbc57472fe04ade0565", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097318, "uuid": "5a058460-c1c3-4112-9cfc-c651aef2a4d9", "comment": "Malware payload", "value": "dbac219ab3629c45f2fc41152a673e4e4998ea83d20c7f5b8a9f061cbb6a1cf6fd2ac6446f3ff3af273d2f0d669e9e02", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097318, "uuid": "03de3a96-84a5-4426-92c9-634e6a5b5ac2", "value": "T1E84168043BED0724F3F79E3B947A6312557ABC96EA25CE2D40A1468C1832611D8B4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097318, "uuid": "0dfb08e6-aec5-4036-9972-79cff3a604e8", "value": "24:8pfJtnyURef5+pAaNhsN4aiMLFwF1Idd79ds5sq:8RAUAaNhpaiMJ21IdJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097318, "uuid": "eb12fb67-c4d1-4242-ab70-fff8009c6a95", "value": 2092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097318, "uuid": "e38b41a7-110d-4e45-b80c-3c3235c86cd5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097318, "uuid": "07a417ad-6d91-4918-bf79-ef0db2c37575", "value": "IT-Job-Interview-Preparation-Guide.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189f66ee-9260-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786107685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107685, "uuid": "913da651-cb7e-440f-a9a2-555d14b188d6", "comment": "Malware payload", "value": "3457eee268f1ba9e7c6287e05a71d288", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107685, "uuid": "f4dc7b27-e5e0-4fbb-bc4e-a30cc2a8c26e", "comment": "Malware payload", "value": "b40a92b3295857f9433298530a8c9e7e3af13e6ef2ce3f5e6b46454071fe9672", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107685, "uuid": "c048fb7a-0f69-43f9-b710-845e35781125", "comment": "Malware payload", "value": "7ff121ce15f0c138906b25d70fefae84a913d632", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107685, "uuid": "bd08279a-d9af-4023-b1ce-f86f2865b57d", "comment": "Malware payload", "value": "4ea900fcdc480cbeaefd0bfe68767260a3d475762bf75895e4039a17c93e7638c6e79424db34c536155ed26f166de469", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107685, "uuid": "9a61d597-f0e1-4dcf-9f70-6a652e1b67dd", "value": "T144059DCE233586D5C87DEBF88431988129BD9A94949286AC76D078F4E188C5F31EC7F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107685, "uuid": "2837ea1a-8b9d-4b29-be2e-5820db43e4b2", "value": "c3d1b095644b3130b7ec293d923573f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107685, "uuid": "123a749a-d61d-48b1-b9bf-c3745a6fb6e3", "value": "12288:fe/FDOpmOW7e5N4AO6cquuDs6fLcV+sytrIm+B5T0Q4YdHjC:A8m44zhxuDtLcIPR+3T4Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786107685, "uuid": "54703e25-5093-4599-89a3-38bfe34c8db6", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786107685, "uuid": "e65fc328-0b0b-455f-a578-b3f4cc18e906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107685, "uuid": "87983937-681a-400b-9944-dfbe05ab8270", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae0f9cb-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129647, "uuid": "96a7bfcb-d1d0-4680-9d4b-bc5f91e212f7", "comment": "Malware payload (Mirai)", "value": "82e97ad70c905a8f2fb4ef7dcf4851cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129647, "uuid": "24f35b74-82c8-406d-80ce-5d424d08d545", "comment": "Malware payload (Mirai)", "value": "b6260a8c94f54ff97d7838eee6391c9c32284d4b6f81e36401757cbafdc99a46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129647, "uuid": "4e4ae5fe-7cc0-4922-910b-2bf7a7bbe635", "comment": "Malware payload (Mirai)", "value": "f02341964eca0d2fa9bfc668a7517d1441f595ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129647, "uuid": "cd026340-d06d-48b6-b025-2acf54a8eab7", "comment": "Malware payload (Mirai)", "value": "de02ea36ae8e0b4a3d83ea45c9f40d69f566db30585229b9c65393c6cf4cf331665898d2adf641949eafc25f6f20f2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129647, "uuid": "0d944459-1b60-4c6d-bc8f-d0f9080ec45b", "value": "T197B42955EC809BA1DAD12ABFFF1E824973131B7CE2DE72129D051B3067DB85A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129647, "uuid": "8f86061b-cfa6-4fcc-bc32-8d786a5fdf70", "value": "12288:TWGNUpUpvRDappPMF19PQXenT7BKrNvqg/9IeaChUmI4AaydXx:SmU0lbMBbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129647, "uuid": "3c14cab2-d677-4974-a075-98be22a245ea", "value": 497344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129647, "uuid": "92cb976d-5945-41c7-a96b-194aaba6af8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129647, "uuid": "cd3748da-db66-42ce-a4ba-5e0b4026dcd9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba63452-9207-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786069572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069572, "uuid": "22dbedb0-29f0-48ba-aca1-9d97b81cad71", "comment": "Malware payload (Mirai)", "value": "9266ebb5e4e8120481e83ae16c6d1d95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069572, "uuid": "157ecd61-734c-4931-b55c-9e9900becb14", "comment": "Malware payload (Mirai)", "value": "b7f2e9185472e01b3b636cd48417239456b9a9318b7a9b1a920cdb6b2d9420ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069572, "uuid": "7f24e303-aad2-433d-b1d7-bf2a93165b4b", "comment": "Malware payload (Mirai)", "value": "cdb615d027451931df35603b624398e40f7c8556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786069572, "uuid": "48a42e18-45ec-427a-be65-97a1a3941148", "comment": "Malware payload (Mirai)", "value": "b8664567bdad3f913d73306853ef275defbadad83d1844ad7c9fc9bee98177574034bf52b5a91b69c4e3a2dbab4b9549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069572, "uuid": "6fbde6cd-2d37-462d-afa8-57bc08d0e791", "value": "T1F6D30845FD458F17CAC225BBFF4E428C7B2A1768D3EE720399255F20379B85A0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069572, "uuid": "d0e4c5ee-29f8-43ba-8790-9f22d5d3e618", "value": "3072:LSSTtBs5VOdsQx3NW5wOeMcd31Ubbgu7K4Q6HA:LSScIaM3NW5wSc51wb/7VQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786069572, "uuid": "102a1a2f-4402-4036-b6ec-ed367a8657e6", "value": 141880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786069572, "uuid": "4923ab5e-02a5-4bfa-901e-7d01133806f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786069572, "uuid": "27eef94e-3ef5-4ede-ba10-4622c001ea96", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dceb9b-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786133794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133794, "uuid": "8ab45fa6-2c41-4ee2-aa46-540cd5a2cb81", "comment": "Malware payload (WannaCry)", "value": "6da5f33515b187df3620e7463fab9995", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133794, "uuid": "2f8315dc-d0dc-40ce-aada-a4091bcc6f6d", "comment": "Malware payload (WannaCry)", "value": "b9cf80a5e63577b018937534f6219eb29876c2163f0cdad7341acc2deef2859f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133794, "uuid": "34338b22-b3c7-423f-8b41-8c174ee3b7f9", "comment": "Malware payload (WannaCry)", "value": "02c8512b8bc8cce7e46a4d28ea46250076edef9c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133794, "uuid": "43fee8f6-0380-4102-b584-361b290de79c", "comment": "Malware payload (WannaCry)", "value": "3e707b201161f7a2ee49996acb26d57d4c008ca73dca9ea41456d3b117faa167107b0a08bb7d1e2134af238bbebcde31", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133794, "uuid": "b3f8704e-b638-47b6-a4ff-09302fa25a47", "value": "T1EC36125A326C80BCC11B6274A4B34E26E7B37C5A227D930F8B5487661E13790BF78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133794, "uuid": "3e5c560e-8179-4a22-af93-8edad258186b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133794, "uuid": "e790179b-0d89-42a9-92d4-21ac90e55ec1", "value": "24576:jbLg8bLguVQhfdmMSirYbcMNgef0QeQjG:jnRnFQqMSPbcBVQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133794, "uuid": "26876153-6adc-469b-8ea0-a10c6f593db5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133794, "uuid": "a2cd1f33-5ef2-4d37-9d0f-ca637ae3f531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133794, "uuid": "b2ad28ea-0329-41b8-a233-263f9477254a", "value": "b9cf80a5e63577b018937534f6219eb29876c2163f0cdad7341acc2deef2859f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f093b2b6-923e-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786093444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093444, "uuid": "06d6955d-3bb3-462f-8a1c-7930d185ef96", "comment": "Malware payload (PureLogsStealer)", "value": "6108296a2c9c763a4b56e3cb611ab096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093444, "uuid": "e1877b37-0d93-468f-a174-203da8a49bb7", "comment": "Malware payload (PureLogsStealer)", "value": "ba7ef674b42b85717ae947a9cab116e0256f4996e949a8fdad8c5404aeef7a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093444, "uuid": "b7eb7dd0-a61f-4664-b3c8-6e53eee295a2", "comment": "Malware payload (PureLogsStealer)", "value": "4479eaf6ed86a3fc385f60c6e6521e5e341e6d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786093444, "uuid": "2a578c44-1f1b-4305-a222-8680d65c22a2", "comment": "Malware payload (PureLogsStealer)", "value": "661784e9e9e00c57ad9d98d6c8a8ee30b7f345a6a156a886ed53cca62c7a3f9df9012f5a87f9454126c4584ae4a38d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093444, "uuid": "f410103f-5b30-4cb1-b952-07f290f35c64", "value": "T168750250266EC816DC690771C8B2E3F50360BE89E522F2176AE57FFB363AF574944382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093444, "uuid": "2b03228a-26d9-466b-9ea2-9165e013ae11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093444, "uuid": "d85b68b0-0b10-44b8-97d2-7da656174a54", "value": "24576:q7Osm3ZR159DcOsZMPiOfy3UdUVL+Her5RmijlBskqirbVYjnZrbdvz48ghEW:qK3JbDcPPOfyIA++r5RmijHxr5YjXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786093444, "uuid": "01f31c77-cb61-4de5-9b45-8cbff7a15cf6", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786093444, "uuid": "b7e90dc2-86d1-4431-b8b5-fce1117719fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786093444, "uuid": "2981e9a1-5203-444a-833a-211d45fe2806", "value": "\u0418\u043d\u0444\u043e \u041a\u0440\u0435\u0434\u0438\u0442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6900d818-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129724, "uuid": "4d7e070e-37c2-4018-9c74-e79fd2b75fff", "comment": "Malware payload (Mirai)", "value": "7e409209397d4a2dab09208748d13ba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129724, "uuid": "a6926c50-3a47-4821-b7e9-d06172b173f3", "comment": "Malware payload (Mirai)", "value": "bb112d909ad88a94e045065f84809f69ca6980a27c09d7179a464af65afee4d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129724, "uuid": "f8aaabe8-4a50-4509-adea-c70a51243b16", "comment": "Malware payload (Mirai)", "value": "54905e5afebcbdf8a59006dd772f57139310fcaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129724, "uuid": "d84c5ca0-6db1-44a8-b8b6-bd9230eff19f", "comment": "Malware payload (Mirai)", "value": "d8e108c5f4896cc0db16e5691ebf57ad36a52a9701e8ca3c28b7c00a5fb6a093566fc2e694dd5dcc41ed80efc5b310ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129724, "uuid": "58abef4b-cc0d-4928-857e-e8f1a355bf89", "value": "T124148E00FB081913D5931EB45A3B0766E37DD88318B9F019190E7B569B33AFB9AC7B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129724, "uuid": "3bc670fa-2c6b-44d7-8b22-e10dd712611c", "value": "6144:JLLYx0Ar68Y0huUuOPy3AIhiDrQd4W9gK926:JQprAUR6iIh26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129724, "uuid": "c0cbb716-e21b-4675-a087-10f21c28575c", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129724, "uuid": "2a06269a-c5f4-4103-b32c-9dedc049f202", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129724, "uuid": "5cc0e7cc-e7cd-4bdb-8228-79f09a58df26", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750cc2fd-9295-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130603, "uuid": "05e27d89-ca40-4114-b0df-b9c68e9ff5b3", "comment": "Malware payload", "value": "b8fe5dec8e2d11f06230c60a2f1fcdf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130603, "uuid": "845e3309-f386-4c60-89c1-5769741848ca", "comment": "Malware payload", "value": "bb50812e538cecc509dcc8333bd8d204b455363b98750d238596367a2127617f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130603, "uuid": "558453ad-ceb3-4e40-9ef5-8776e5f99199", "comment": "Malware payload", "value": "adeb238a60e7ec2d62a4326c02dc6756be100461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130603, "uuid": "4e84fd07-26b2-4231-a4dc-d068fd4c8aff", "comment": "Malware payload", "value": "24e2a7ae231b77e84a9478cb477d0a443834c25b2a3907eafaec4693eb5a08277aedac5ad2daec8ec958038020c651cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130603, "uuid": "5071f15f-1e95-4fcd-b6ff-3618d449a469", "value": "T181130A424C218314C6E512BC57F94A59E3C15F0739DB2701CA72FB387DAE1A8BA93DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130603, "uuid": "521be204-1375-413f-bc0e-2c1a30acabb6", "value": "768:QLOeJWnaT0bO08QuAUyEYsAzfOchXlTA2J4G+MyZBJEE13Pohi6W:ARdbXYFO2afG+ZBDoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130603, "uuid": "d2d1a1f6-9c0b-48a8-a8b5-6f3886850df8", "value": 42216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130603, "uuid": "d2d1ece8-bd09-4c8b-9c4c-550c4bc5e1fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130603, "uuid": "74e88f18-e689-4b18-823d-de294ae56d43", "value": "main.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bad009-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133482, "uuid": "fe505348-d976-4221-a5c8-26f3a1368309", "comment": "Malware payload", "value": "64dd2a909b0e2f4683f1616e24de6fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133482, "uuid": "baad8a0f-44fb-4ff2-a7c7-f16b6d8a9938", "comment": "Malware payload", "value": "bb70c62afb7cd5c6637680558a40916333a5d785192495620db58fc185f5ac6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133482, "uuid": "b6753309-14cb-4ec9-bdf3-1056bac3a70e", "comment": "Malware payload", "value": "852f3ca9e2b37eb6a7a0a5cc63fad65e435e5ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133482, "uuid": "7173caae-89e4-4ffb-98d1-8f972d8721cf", "comment": "Malware payload", "value": "3b5aa5a160e242f9a7b766847d31171f80f26353238574b0c0aecde9c28c7d9cd3e04522b284969c676132170e970217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133482, "uuid": "b815ae63-d294-4bb2-8d5e-d2f9bc2dca00", "value": "T1B2F22B93C52A9EFAC106B4B195F58E780B267D468B2B0EA9E135CBE0024FDC8F145776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133482, "uuid": "50bdf71e-a244-484a-8b81-7e51b844cc88", "value": "384:f5Uf2XgC1KLJYNaR/WgR2NFGgKiNEF2M8aQj2m2sj4XjUHnCCCV9wIurWRPzH/jB:xQ2jIOgUXKiNNzcUHnwV2rKRr71e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133482, "uuid": "4563d078-0cda-4a93-abcd-0fc994a78ade", "value": 36304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133482, "uuid": "dd33b706-f8ce-41dd-b901-23bb7fb554bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133482, "uuid": "fa1aabce-e6bc-49f2-a444-949c96f0b122", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c3afdd-922f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786086819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086819, "uuid": "4c9e8c2c-2f72-4ee6-8cfc-96092050369c", "comment": "Malware payload (Mirai)", "value": "4555c91eab4b0a70f3af3224373862c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086819, "uuid": "66edfd95-62c9-4699-92c9-e1887e2deaec", "comment": "Malware payload (Mirai)", "value": "bc97f2220a7418d56edd6d652f5fbbbfe7585ae52618d2958f090b7b54c206c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086819, "uuid": "3001ee54-d50a-4edb-9b89-d1d9bc177301", "comment": "Malware payload (Mirai)", "value": "67dd1de9b8c3c4aadef3b782cd61b546273b420c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086819, "uuid": "df9920e8-4864-410a-8a08-a8781b9dcf71", "comment": "Malware payload (Mirai)", "value": "4790e1324a45ab7ffca15cd4eaf74d89ead8c0c5978abd23d6db0154312a18424784f7ac9081d058f4b687dbfc3341b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086819, "uuid": "7d6bfa37-f1fd-42c3-998d-3243a7a283be", "value": "T10D14F846FC909F26C6D612BBFB5E428D372A53A8D3EE3103DD155F24368A95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086819, "uuid": "7e699658-21fb-4a9f-ae0c-571d89253b01", "value": "3072:/+ajkQJQMtbE3bDAjg1Yct3TidXTNrkR6CA5584wx1Kjh7nGP:xJJJsb081FVedXTNkR6CAP871Kj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086819, "uuid": "f61b75a7-bf31-4215-a367-ab4279a601ef", "value": 196399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086819, "uuid": "fc3e2fc8-d185-482d-8832-0886fd3d3925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086819, "uuid": "050f571c-db90-41b6-90c2-35c918505528", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6113d95c-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097928, "uuid": "7ef492b8-db52-4eca-8366-19e4d6162280", "comment": "Malware payload (AgentTesla)", "value": "e0129b7f7708406527264f331fb83fcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097928, "uuid": "96f16aa1-d3d3-4e9f-9e79-aa83a03e3867", "comment": "Malware payload (AgentTesla)", "value": "bd29e2e123c5c3fd93d1aaa531b73fa674bb9aa52df141e7bb67fe1939af5017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097928, "uuid": "0fb9c6b3-6839-40ef-a0c4-8532e278003d", "comment": "Malware payload (AgentTesla)", "value": "b52f3e17a77efc8e61bab2fd156a36642739a74b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097928, "uuid": "799f8213-100e-40fd-8bdc-761cfc329336", "comment": "Malware payload (AgentTesla)", "value": "202b183a990bd7ec52926c4947fd76f2b7b911d3bb6539e406c63a4e62e827e225a55daeab2a011c2eb00c90f547789a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097928, "uuid": "d207685d-7d64-4070-b01a-0d585199cf3b", "value": "T11F55B878E87B6EA02D96F51E8BC6D86519B29F435DA3F7DD045FC3A10D323209AF2850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097928, "uuid": "ccb3a732-e4ed-4d9d-82a4-090411d9ebe9", "value": "24576:lJrx3s0AmZGq3aYCQz6pXhGG6W21Z9N03qhzq/124ygIO3hjoCHpbfL:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097928, "uuid": "53404ab2-f5ad-4deb-8221-98e5accf05e9", "value": 1323663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097928, "uuid": "b46778e7-4e6f-434d-a553-dd0930791238", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097928, "uuid": "67d9be97-cbb1-4315-8508-9e91a90dce1e", "value": "Quotation Request for Project BNC-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61ec69d-922b-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786085186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085186, "uuid": "6b950f93-55cf-4720-887e-2fe915fd2559", "comment": "Malware payload (ConnectWise)", "value": "9d5a7bfc3f5c2a224970c91a4130f797", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085186, "uuid": "ac315437-fb56-46f4-865e-e9fc1ea6d833", "comment": "Malware payload (ConnectWise)", "value": "bd51fc7e4074899f0af3125bfdfd449b312995511472b846c09883c5a055723b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085186, "uuid": "935ecff7-4840-48c0-8b94-a41cf6547b4e", "comment": "Malware payload (ConnectWise)", "value": "c19daf8c801ddd965e24a66a0b9e2b3903b94da1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786085186, "uuid": "23248577-b21e-4984-9c61-5d0e80a0f385", "comment": "Malware payload (ConnectWise)", "value": "97e04b0be57268099fead94b68cea29e11aa25e3400df60173f13deaa923c67b9d5a0e319107440cc3855db691dd02f8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085186, "uuid": "1bb4b44c-6acf-4a40-a04f-fe063abb29b6", "value": "T10A646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085186, "uuid": "4e27d364-1fe8-4a91-90d1-bfb66767fcfb", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085186, "uuid": "94be0fe9-2113-40ad-b56e-371b167a0fbb", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786085186, "uuid": "9bc12e93-ab76-4c85-8d1e-ad6042c48d76", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786085186, "uuid": "1c74af0b-dd41-4a91-a416-3b0f5350ccfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786085186, "uuid": "8e7ad6d4-8010-4372-83d8-8b4f00dee982", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77719478-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137909, "uuid": "c85304f7-150f-4e67-9da7-b61cbfa828d7", "comment": "Malware payload", "value": "e3bd623f5f15b65add20b78bf1f40a8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137909, "uuid": "08a68a3d-d3c4-492e-a4fa-8d4519d4bd61", "comment": "Malware payload", "value": "bddf96d519e14dce50aed9c7c539256bddd3888c16da38d2487bfa39596b5ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137909, "uuid": "bdebda7b-2336-40b0-9ce4-bbea4839d805", "comment": "Malware payload", "value": "fe1906f8565a87ab3d6dde1d8002cabf4bf3e24e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137909, "uuid": "c011f63a-e6a3-47eb-8b5e-458802fd8c42", "comment": "Malware payload", "value": "57d63d0fe0e0f1361218e07b3f8625bc0595479095d9bca403d55db7397dc2f0f07e9c7331dd78ec1ee1a8c57a13a41f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137909, "uuid": "3fb9a67d-28fe-4de7-9332-152c66659b14", "value": "T1FA133BBADF0E3941E3D4E339E7590BE1603F7924D35680B73E42B18DC4E99DD8A92246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137909, "uuid": "5d0bb13f-93dd-433a-a9ab-5cc6b332b6cc", "value": "768:lFYcSx5F4pPGTXcafULXTvjIiyjEyGJ1L3vReDT3C3NO0w:lFYbx5yPQcDvfwIJ7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137909, "uuid": "0d24f242-79c4-4b6b-8872-2480aca19b49", "value": 42040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137909, "uuid": "c6286ca1-9088-40eb-9c92-6503760594bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137909, "uuid": "68b01496-a29e-404f-9314-2d287777261d", "value": "main.aarch64be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e71266e-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137894, "uuid": "fedeeab8-f229-4888-9c36-ebb8fd3c0166", "comment": "Malware payload", "value": "5ceee5d336eb8ca141db9a9a100d6a6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137894, "uuid": "abc86905-c74e-4ef7-8368-44af73491b6d", "comment": "Malware payload", "value": "bdfbd1883d34b2adae5ee7aac342226be93f09b1e0e0f11c0df7bfee7c24ed40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137894, "uuid": "902c88b3-14a3-4e63-99f5-f4d1519f10c5", "comment": "Malware payload", "value": "30c975d0bc43925a47162b4835800665dcc1cd2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137894, "uuid": "01472565-653e-40cf-b1ba-76c21b2ae1df", "comment": "Malware payload", "value": "5a0641ca842af354b793fd93acef165ebe7add7c9dea64730abd866e7ca9addbab060806457ab89fdc73c0b45938bdbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137894, "uuid": "61edeb0d-db5c-43ea-abb3-ce85a5082697", "value": "T152333B8791B4D5AAC470BB37E557FBF68396BDF884D84B1D1C89EB2B58B0B004724D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137894, "uuid": "85976ecc-9d7a-4b9a-bea1-f4c756f283b5", "value": "1536:ZiFD4wE2nUsk1EPEJhe4ZLy3cR8hLK7X2yRSH:ZiFD4wEZBY4ZOu8hLG8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137894, "uuid": "dc351858-ab29-4353-b0d6-905501ce518a", "value": 50224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137894, "uuid": "3fc5a8fc-d3e5-4a0e-ba58-895a0291bf80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137894, "uuid": "bc60d489-00b4-47c5-aa47-c6a25cc9fdcd", "value": "main.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e58a541-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130055, "uuid": "ead14fc3-0268-492e-9e11-680bbdcc202c", "comment": "Malware payload", "value": "4bb5cdbbc259ed8d880e60c7c35c5126", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130055, "uuid": "7adf84d5-cab7-4983-b01b-67e4c17d5b88", "comment": "Malware payload", "value": "bf0f931c38b007cdec9674b7ea6d46995d00c3e50c1121b15957564eece76ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130055, "uuid": "01692de4-cbbf-486b-89c9-3b53fb0e4fae", "comment": "Malware payload", "value": "a4102cb6f0bc1460a24427602c39f97338645743", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130055, "uuid": "f48ca0ae-38d1-4c10-9cfb-2fc4aea39f41", "comment": "Malware payload", "value": "deb8e98c19a46c4d3423689345a1713bba516eb3dba6fd3fd4a3d8f0b4f040fd43ce8054deb0c63fdb72294ef575af8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130055, "uuid": "544b35b0-1bf1-4c3b-943d-19dc16f92e44", "value": "T1BF43462A6E22EFFEE56E823007F39E70975635E237A18240E26CC7085F7025D585F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130055, "uuid": "eb1d7e89-f261-4b6f-910a-c936c7c9c0b0", "value": "1536:UpX9QRFU4YwUNZXqWTzBnY9tdNGuAvxdsyE9Y9afq:yv0yE9YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130055, "uuid": "1a302e2e-7cfe-4c54-86d2-81d513b45ab3", "value": 59164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130055, "uuid": "97422ed4-cc3c-412c-8bce-171094ba3b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130055, "uuid": "24785abc-4227-49c2-b5d5-bb8559aaa3fd", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bb0933-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066587, "uuid": "25e14742-1f53-4e50-adaf-1ff4e8ee268f", "comment": "Malware payload (Mirai)", "value": "7681e606ed7f3d0caf532bd35715f3d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066587, "uuid": "a838faff-729c-4563-9bb8-60b4146a335f", "comment": "Malware payload (Mirai)", "value": "bfd4a1275626d0b82bc22a41aa65fb39b3936c895ce885d248195860fd07345b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066587, "uuid": "6fa9ce33-c3f1-4e4a-ac72-40a08ce6c9cc", "comment": "Malware payload (Mirai)", "value": "11fcefb771aa40a0af5abff86f0f3a813a1831e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066587, "uuid": "12a0d0b5-9297-4f61-91e6-c86d9d58242d", "comment": "Malware payload (Mirai)", "value": "cde8bbaf33d6c1ef85d7ee42e89826d6482ab71da482b457ec75212eda02afc8594a33e8425048f65a7ed14ed5f18e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066587, "uuid": "c3f6d691-e605-45b4-9935-425d1a09a53a", "value": "T1C4E35B81FB87D2F1E99345B0012BB71F8B349D358124DE0AEBA92E31EC75706855BB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066587, "uuid": "5e8da28f-100c-4b29-921b-196c0ef2cdd4", "value": "3072:TtDPwtUC1l3oH0SLjgWaH44nxkpB8WNWSer7OtgvTareTR/CU:pD2P4HPEWaY4nKs7OsGa//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066587, "uuid": "5815ea35-7a21-4ee3-aa8c-e034fcc2a83e", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066587, "uuid": "3d6c1f32-b927-4ddb-8199-b8d5050dbc53", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066587, "uuid": "350bc9f4-8aa9-4555-9fd6-0c1b76dcfd0d", "value": "disconnectraw.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae73ee75-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097199, "uuid": "1bf81bf6-8770-4922-8d6c-a644a1ff8bea", "comment": "Malware payload", "value": "aea9a1c96973b52b17883fa1245d6453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097199, "uuid": "28e0343b-b428-4830-a549-e0ca44e301a8", "comment": "Malware payload", "value": "c1469031ae031b93295c46ecb9be91821775df4a696350d15952f725b9d6c93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097199, "uuid": "05c30e18-1416-4175-949b-b80ac35a3cef", "comment": "Malware payload", "value": "75a7287c6242408c34e7c5cdbb511d7e50f203ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097199, "uuid": "00e78fa3-632c-4ba7-889d-23339f8aa62d", "comment": "Malware payload", "value": "b7973a03f9170ad386b8f4c6fbb9bd50535b240327c864da236764361f5f21c4122b7a92ad596c4454276436142234eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097199, "uuid": "9029402e-bc46-4010-a8f6-2dbea82c935a", "value": "T10AD5239AE9B559B1C83BC3B58F92F42DF0693B858B249E97FBCD56008D922446C37370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097199, "uuid": "bfa866a9-db4a-4369-9e61-06ce7f254ba5", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097199, "uuid": "fbb73227-5ba9-4730-b8d1-a840fa0f5800", "value": "49152:x0I21UXGS6fabT3sakPWnJ2s56rzeihY5rS7QBApnTaPe4AZgEzd69WNjLxFO:6ISU1yIk+nDnihYkbpTaPhAQYNj9FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097199, "uuid": "8b2a1639-3ff3-4fb3-9e6e-a8634c1572b3", "value": 2930176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097199, "uuid": "164110a4-2fa4-4a6f-86ab-4c442854f245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097199, "uuid": "0e3584bd-1570-43f5-ae15-9ab7e8a56937", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6533954d-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786097935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097935, "uuid": "461cd41a-725f-4820-a126-5e92c4a39c24", "comment": "Malware payload (MassLogger)", "value": "ce2116d1b02fb354dfcaccba6a62551f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097935, "uuid": "583bd1f7-0455-4cca-b7b1-24472eb33d7c", "comment": "Malware payload (MassLogger)", "value": "c1741d39f2dbc4bfff227613697e514ff109a8ba541dc32434f43f55009452c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097935, "uuid": "c7cfa93d-9c8f-4420-8a8f-46cb19357797", "comment": "Malware payload (MassLogger)", "value": "2f1a29a9e2d0130f7bd1fe3e1e0fe075d8eacef5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097935, "uuid": "3eec3f6e-b3b4-481b-9c65-f9b4774b098e", "comment": "Malware payload (MassLogger)", "value": "0a5beb286bfd0091c66481ba607d9c863372c2ef705a42e96fc30f9efffedf3c1c367de01bb0881768a94859749d3a80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097935, "uuid": "a7cc9967-5851-4f19-89b2-d063e86f60b0", "value": "T10525B9DF6BE33A8C240CF71A89F9BD9C1442CCA50452A079AFB41BDAC51D6416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097935, "uuid": "1702e84f-af23-4ee0-a30a-5d1f51905fab", "value": "1536:+a+jIyCPdL10F/eJwwOX4Xg51fowTnrfE3nJet8uWUFeHusBXwTMCDzH9K:+ahyE1G/eNngzQ/UI4Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097935, "uuid": "44f1a548-486a-44b0-9d65-2a471176b0b9", "value": 1021925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097935, "uuid": "8b64910b-d5a9-44cf-8c71-b9415027e2f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097935, "uuid": "c057514a-e6e8-42bb-ae22-e87d13c595df", "value": "cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c50ce4f-9268-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786111207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111207, "uuid": "a0b6ed19-7a59-4ed3-b1c8-50a17ea91fdb", "comment": "Malware payload (RemcosRAT)", "value": "62026426767207280fe942f9cc6e9aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111207, "uuid": "6d39ea61-c42e-49f2-a847-e370a8703a90", "comment": "Malware payload (RemcosRAT)", "value": "c1d55538417d22ca041f9a269866ccba8957c40ee698860be340b297713eb8d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111207, "uuid": "79102be9-5859-4135-a91d-b79df8ce27a1", "comment": "Malware payload (RemcosRAT)", "value": "0950d60a82c2f2f4a2e4b0575ae7a15124245aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786111207, "uuid": "fe2dcbe1-ae1e-4ab6-b3da-430dfbeeaa87", "comment": "Malware payload (RemcosRAT)", "value": "b3ff498afde451cf2f266b1fb40080a80a5bd0a3fdb40eca29a8c662232b7ee33644ca30d944bbe523477461a61fd032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111207, "uuid": "d05ee25c-daaf-44a1-9f11-216d6f22570e", "value": "T19DB4BF01B6F2C1B2DA7654300936E735CEBC7C21183699AB63D61D5BBD30191DB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111207, "uuid": "8e91387e-b320-47b5-a282-93fe85ff6241", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111207, "uuid": "e4bb48d2-a68b-471b-b1e2-851199da940d", "value": "12288:o97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOrus:olxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786111207, "uuid": "c9efbd1d-ab7c-4bbe-9aeb-e4ee51009bae", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786111207, "uuid": "d7e5a8f9-3f96-44b3-8ad9-7f086d7363ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786111207, "uuid": "107d24e0-9271-4b2a-a978-acbdb4bd9ad8", "value": "62026426767207280FE942F9CC6E9AAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38b684d-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786081423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081423, "uuid": "16903700-10fd-4c37-87fe-0b332bfca51a", "comment": "Malware payload", "value": "82ecf37a69ef8a8ab3b9e5b28bc2fcc7", "object_relation": "md5", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081423, "uuid": "8db64a94-c60e-4003-aabb-3b4ffb99449b", "comment": "Malware payload", "value": "c1f4b1fcaa128f2ef844062c0ada32d41e49ca542a8020c5505f82334cba3ff1", "object_relation": "sha256", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081423, "uuid": "919ed2bf-d37c-4426-a7ea-c85cbadd7a4f", "comment": "Malware payload", "value": "551ddc6ce3c461947383ea5b9dc3b5f36f7b3828", "object_relation": "sha1", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081423, "uuid": "b88843a1-e25c-42d0-a6a4-400e7ef997e7", "comment": "Malware payload", "value": "06e280b3d68a2af92f9496f199049bd61ede20fa07c54fb812b6863f5081fc0f2e09661e5f6986da403d46123776291c", "object_relation": "sha3-384", "Tag": [ { "name": "1ca1b16e1515116e2993ab2e8acb2ae1", "colour": "#AC9E38", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081423, "uuid": "1a279f3b-70e8-4a74-ae39-e4eea8e2abc3", "value": "T151D5229565B21978C827C3B18FC3F47DB13DB7958B249E4BB7CD6A408E26508783A372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081423, "uuid": "f3aacec6-5b80-4260-afc9-c5e500bd2c91", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081423, "uuid": "bd6db061-cba8-4f92-8e6f-2fe4c4cf22e5", "value": "49152:lAzcSIvB95Uw3lcKF81l3hCmkY4W57yDL1XszFsh+Rsva9R7sWi4qOcprBh8:lw/k9nLF8bUmkQhyDL1Xs+hXv2hsWiLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081423, "uuid": "53983b6a-7a83-4b99-8453-04b140b238d2", "value": 2886144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081423, "uuid": "f6d40d87-72e4-4806-87ae-6a0a88665492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081423, "uuid": "99f83452-703f-41eb-9ecc-b16c716cc061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb54d803-9201-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067156, "uuid": "105c2afc-898d-4244-9b30-7decb78015ae", "comment": "Malware payload (Mirai)", "value": "d4a9d25339f177f151f8f2ac943b1b5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067156, "uuid": "47fb889b-58f0-47f5-afd0-499e96043216", "comment": "Malware payload (Mirai)", "value": "c2258509124d2f096ddfe68e16e2e6f75772048bf0fd3eb2bbdd7898004b5585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067156, "uuid": "aa6bca18-bce3-4cd3-a5e8-9322f7a6e50b", "comment": "Malware payload (Mirai)", "value": "5ee88f7b80ffaf3611a5eb039667c058057bb2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067156, "uuid": "0d5f72a0-95ea-42e1-b7df-2348b65c6e5b", "comment": "Malware payload (Mirai)", "value": "bcec4452136243ea4e5cbaffc51885de5e15b831035009bd779909653ffab650253bc56549ca76a2a02dd03d5860dae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067156, "uuid": "e2c5ca5c-e07c-4a24-9d7b-dec7298fc43f", "value": "T186F37ED49A1F6D81D6C7F7BCAD5E4FB230373CB40664C1B31A00626DD4EEDE688A2562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067156, "uuid": "abb41492-c5f3-4f52-9a00-d17b9df65489", "value": "3072:u2r6Rq+KHwlxdBeCTFxcROtLtMHJvvKR:VuRQwl3BeCTkRmLqJnKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067156, "uuid": "5f16458a-4eec-4e50-884a-364a857058d3", "value": 157576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067156, "uuid": "bb9f1aad-b3f5-47b0-8ae0-c0e22b97695f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067156, "uuid": "790233d6-9816-44da-89de-3ecff4e13240", "value": "disconnectraw.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab0941c-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130183, "uuid": "7aa90434-349d-4143-983e-50698c0612e5", "comment": "Malware payload", "value": "a40057c03715f7c0085c12e3e0281f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130183, "uuid": "bfe9d76c-fbc9-4507-805e-aadf95d47c92", "comment": "Malware payload", "value": "c31c19a8c6510d6839b5ec7a66aafa25455dac5ef2ab3d54e7e8e039047a718d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130183, "uuid": "52702681-a08a-4095-a38d-368dc6bd25b3", "comment": "Malware payload", "value": "368df2d68d97e52340e31cc725dc7bf3703a74ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130183, "uuid": "0c15da3b-65c6-484b-a8c9-1e28ee3d8016", "comment": "Malware payload", "value": "789a74972f9a5fccf3e3da079b4cc987122af5f8e8c8917e485981e218cf8fd1549823bf843e69ae2bd7cb14f6196892", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130183, "uuid": "b0511710-8cb8-473f-873d-21f0954a7d0b", "value": "T192234C46FD268720D3A215F05FF65A4257816E1638D37300D8A8F63CF9AD0A86793DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130183, "uuid": "ed97e547-a69f-458f-9430-0ef2090fd2fd", "value": "768:axwLyvOReZHXivVBmvsR1V7lEAYtXaZUQBV5gGkHkl6oZerArRhy/lTTVDeyLkZd:pLKBHXQmGlYTrqXytTj0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130183, "uuid": "77aa47af-c2bb-4be4-8ae6-849abb041232", "value": 45944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130183, "uuid": "28202810-aec8-401f-ae2e-da0e212b670d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130183, "uuid": "35175b90-0a61-4f10-ac4a-8f379ab88fb9", "value": "main.riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2b919-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129927, "uuid": "a9fc9616-6fcc-4652-9802-e760c986ed30", "comment": "Malware payload (Mirai)", "value": "6e99ba4708939f3814a65c1bfb660b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129927, "uuid": "aed6e86e-c6bd-4c8d-b194-7a5ced9dab95", "comment": "Malware payload (Mirai)", "value": "c3a2e075d6914e0f21071fa4910ff0cbdd1e8a23c65fe35bf3a5e63396b8671c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129927, "uuid": "b2041972-c0c9-4e39-b236-a6a14ee88a5e", "comment": "Malware payload (Mirai)", "value": "808b412b2393bd1a5576ead35130601713a0878b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129927, "uuid": "93b73bb9-2e8f-4ee1-8adc-9b83309c36dd", "comment": "Malware payload (Mirai)", "value": "dbde612919dd2ad968ce03389c8a67969b7942a9c20a1ee7b2f526008c13beac4749441df3b75d514b0cb0d311bc638b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129927, "uuid": "eec2b46a-62b2-47d1-840d-47747e642c5f", "value": "T13C53022DE2BE1F88D0E6B1F32057F45E15184651E522EEE352107F710983B936E5DF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129927, "uuid": "40cf52e7-04b5-4398-8823-d4072b8c3016", "value": "1536:PJ6VsWTCn1Feee0V/PYlxGYgG27h1lhG0ardGLemnouy8DMC:cmOWFeee0V3YxgGOh1fG0YdGLvoutDMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129927, "uuid": "4d4c534e-890b-4205-8d13-959b9a00364a", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129927, "uuid": "4d098107-4c79-4934-ba89-d5ef194a9584", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129927, "uuid": "153ccb1a-bc28-4e94-a465-75765b5590cf", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87064d88-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786129774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129774, "uuid": "45045d3c-c52e-46d1-88e7-ee77b63b92b6", "comment": "Malware payload (Mirai)", "value": "8959561b744e6910990bbd4f317e6841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129774, "uuid": "697d65e0-3336-4de9-9200-7fa41eebaf78", "comment": "Malware payload (Mirai)", "value": "c434801de839786c9087692319a8164c626d91d290e29df2c08d450e3936a14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129774, "uuid": "c6fc8d0e-ca2d-4dcd-9863-ffe7eb9e7bf9", "comment": "Malware payload (Mirai)", "value": "16bc61e3f102ea572e54c52dae79c15b046daded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129774, "uuid": "9372f582-aba9-4bdd-9365-a83dab38be3e", "comment": "Malware payload (Mirai)", "value": "c9da2e7f6cd15d40ad7f14129662b218f7d4c02bc27954ebc4893daf2150c3ad07b7e9277d666110c649778adf24838f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129774, "uuid": "3633b71c-8fe1-449e-a25a-d244b7ad9074", "value": "T19CC37DC1724C7EADD5936E3CC20A13076E1C9A50DC83520190F5FA57EAB76E32E26AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129774, "uuid": "e627cd26-813f-4e7f-957b-7c5328d0fff0", "value": "3072:CNh+RjuqsnPFo5iczRTY7bPTxX6VveLR/rQLLjyoA:Sh9PFwdY7bPt6veL5rQXvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129774, "uuid": "52fbe15f-dfc2-49ee-998b-46c7173fd78b", "value": 125312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129774, "uuid": "e83cefa8-6941-453c-bae8-eb96fc201eb7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129774, "uuid": "12659db1-f0a4-458e-8480-d378d78f80ef", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c7c90c-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118555, "uuid": "4d285d16-6b8a-4fb9-b8b7-56a99035a51b", "comment": "Malware payload", "value": "a4a2220982f10cc0dcd44e3a3f8a2e44", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "rpa", "colour": "#074AF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118555, "uuid": "83c0e038-2c5c-42a6-9f00-4ec7207b8a36", "comment": "Malware payload", "value": "c4a461b72c5bfa08d4bffa4d10d265d3777efeb4066566442b11220cd48b88c6", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "rpa", "colour": "#074AF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118555, "uuid": "c9d465c4-4a2d-41f5-8965-18b6a675cbec", "comment": "Malware payload", "value": "6f53ac8553986f35b6e78e6ec99b97571e679bd9", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "rpa", "colour": "#074AF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118555, "uuid": "f244bd67-6fef-4106-97d3-0eb3567f47c3", "comment": "Malware payload", "value": "9ff4c470688a00ef4bec58ba3842aa637b9c5cc8a97f2698820f2fbd5bc2f95a744ea67004b4f2f9fd932a3b340bcb12", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "rpa", "colour": "#074AF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118555, "uuid": "b4b4d37d-7b53-41dd-ba20-b7853a6fcda0", "value": "T18BE3026DFA462B79FE398A4EC92BE3AC091F58D04CC3B980D7310D50879867B8925867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118555, "uuid": "cd7b5424-529c-4d4c-958f-c05971aca64a", "value": "3072:ATHhDozOgzvcn+4ctvEKUTHhDozOgzvcn+4ctvEKF9KMzU9KMzqxrxamE:ATBD4ut03UTBD4ut03LY8VamE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118555, "uuid": "60b2bda6-ead8-4ed0-8a4c-318c77756f19", "value": 143789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118555, "uuid": "12476767-4436-4343-9f39-cf0d048333db", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118555, "uuid": "ed85b071-7f37-41b5-923a-bfe0093ff4d8", "value": "libwin64.rpa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491c5111-92aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786139549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139549, "uuid": "0fd27cbb-eb3a-485e-91fd-bdfe045bb732", "comment": "Malware payload", "value": "e9c8477a7011ac3fdc936f8b57ae9344", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139549, "uuid": "5f56642c-0ecd-4659-8bed-c7fba4cce872", "comment": "Malware payload", "value": "c5125a9712a4bece5cc1d53da1914ec5ac7ba147ab37242b03ce488bc2909137", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139549, "uuid": "3d1d0493-17c3-4fa1-809d-93919f3a0982", "comment": "Malware payload", "value": "8a7ad515a23953f1dc2eebd140f434e7a61cda9d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139549, "uuid": "b4be6219-545a-47ff-91ae-cb9e9ed1baa2", "comment": "Malware payload", "value": "6bc046449c0b1db618f7c367b7a1fdcfbf6d739d51692b2689f99824bceb3df611b5aa9a09b1f9e0dba9f1d86958a592", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139549, "uuid": "da1c70c9-d0f4-43cb-ad45-d8a7f207f497", "value": "T123E6334C9AC152BBEAB3817CBDD26094E07C78661362C9EB5BE843651CA74E04D3BB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139549, "uuid": "1853349d-928b-4acb-bf84-31ad384a7490", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139549, "uuid": "0c01c2f6-5152-4529-bf73-760a46fb1a22", "value": "393216:ubGmCCSCWPWaDSgvk644NL7fXMCHWUjwcuI3/PGTAI:ubGhCSWRuksvXMb8lH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786139549, "uuid": "41c9f252-5162-4caa-82fa-40c83a7bff5f", "value": 14301663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786139549, "uuid": "36e691f1-cc75-4da0-8e0c-0623d44519d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139549, "uuid": "7e4aa6a0-0bf9-4428-8161-5c08bf75cc3e", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8b60e3-928b-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1786126270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126270, "uuid": "b4c37ce2-e5cd-4c1a-8bc1-bd829e7f2799", "comment": "Malware payload (SilentNet)", "value": "bfc39bd4431b6f2d9bb8b4629dce2aaa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126270, "uuid": "86eeb265-f0fc-4a1c-a486-2ac531778cac", "comment": "Malware payload (SilentNet)", "value": "c87207dfad72220e26cc74aaa91b67559b979170921adead3fd6ba8f2d071c78", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126270, "uuid": "8504a952-6877-43f1-8d06-063ff2c67134", "comment": "Malware payload (SilentNet)", "value": "2b9b903454d89624a92d2421f60733302c14ecd9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126270, "uuid": "d2be2f4a-149a-4b1c-aa57-878987c89ae8", "comment": "Malware payload (SilentNet)", "value": "1959ad7698a471be5d46e85d7467a13030d814875c159b4575970a7b64f818c9dabd1e642ea5b42a91a5041ca8b2b041", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126270, "uuid": "5f4e3016-c072-4fd2-b986-5f6b8899eba7", "value": "T161B5232AE148C83DE9EA237140770ED7661D63259682716F3270934B6CA1DDF5F2C8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126270, "uuid": "1e1ed710-db4d-4995-b95b-1bcd57d8e5ef", "value": "49152:5Q1VSS4249HmE2iFIcbP9p3yNPi6Q4GyyDPIIk:5QFr4I2FIQP6zQb1DPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126270, "uuid": "92fc1eb9-6aa5-4902-ac0a-155c30722ed7", "value": 2300909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126270, "uuid": "a951a5be-84f8-4ba4-853e-93d62c525efb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126270, "uuid": "def407ab-cb5a-4b22-b7bb-7b324a136ac9", "value": "horizon-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e25ef94-9276-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786117331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117331, "uuid": "f732bdcb-7c80-47be-a069-44bc25bf45d4", "comment": "Malware payload", "value": "185b647e31562926eb8548175c1f0425", "object_relation": "md5", "Tag": [ { "name": "92-205-105-93", "colour": "#8A6467", "exportable": true, "hide_tag": false }, { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117331, "uuid": "9f3a52fb-3521-415d-ae8f-7fa74ff15ff2", "comment": "Malware payload", "value": "c8756ea3af938d0c6d6940850b12d23963e1e417aae0aa15c2fcb13390974995", "object_relation": "sha256", "Tag": [ { "name": "92-205-105-93", "colour": "#8A6467", "exportable": true, "hide_tag": false }, { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117331, "uuid": "abffa657-3318-4a34-909d-56ea6397966a", "comment": "Malware payload", "value": "8b930c053898bd01bd02abdce29c698666705872", "object_relation": "sha1", "Tag": [ { "name": "92-205-105-93", "colour": "#8A6467", "exportable": true, "hide_tag": false }, { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786117331, "uuid": "54494dd4-cd90-4a44-ac02-a01030ccb095", "comment": "Malware payload", "value": "1d0ba74eb6e77807a7294072debaa80348920ac8a284969f2789343c9b8835fe489c44a1ce28128e1968f85efc050c23", "object_relation": "sha3-384", "Tag": [ { "name": "92-205-105-93", "colour": "#8A6467", "exportable": true, "hide_tag": false }, { "name": "93-105-205-92-host-secureserver-net", "colour": "#AA7610", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117331, "uuid": "79cef9ef-666e-4719-9507-99b03be13a78", "value": "T1FA2106B8EA08461CE42B20B10993CC5C46A4BB0A90AFD03DFF022C93CBB4788221CA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117331, "uuid": "fbe0fcf6-df03-416c-9691-510486dd5471", "value": "24:9IR7O8P6tIXJSfPYzrUWBcsoNc2jQ8APmclSdRI4OJX:9I93POIXJSuTBcso7nozlqK4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786117331, "uuid": "0f95c70e-9e3e-4601-bba5-23bedc73e39c", "value": 1167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786117331, "uuid": "bc987945-2fef-4db4-b9d4-75003520833d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786117331, "uuid": "30dd70a3-c478-4bc8-ba2a-819a08653ee1", "value": "File_7ae005b5-f714-487f-bba5-360f6d3fd385.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beac10a-9253-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786102295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102295, "uuid": "d274fb6c-5490-4548-b1a2-17fa7fd06b69", "comment": "Malware payload (ValleyRAT)", "value": "5d4037b55e48dad64c3fdd1fe565ff5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102295, "uuid": "fe416717-d5e3-4bcf-86c7-2bc2fb1307be", "comment": "Malware payload (ValleyRAT)", "value": "c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102295, "uuid": "f4c84ed5-7340-4cdf-8779-9564ab945872", "comment": "Malware payload (ValleyRAT)", "value": "2a5e7de67590ca8a60e1e3d518ac505ada2d5c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786102295, "uuid": "ec9e9bd9-9ade-42cf-9938-9c3ead95a66d", "comment": "Malware payload (ValleyRAT)", "value": "40ab19f03ce0424b4efb42de6c6af633b8b169f5908d517453c462a0fd7a4f0ad3187414d7840c010b6b1796d9c7e27d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102295, "uuid": "0b8ff881-d5c1-4d78-8fb8-6f64fd1e1475", "value": "T115E4F101BDC155F2D5220D36566DEB206939BD201F14DEEBA3E46A6DEA301C0EB31BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102295, "uuid": "9105dc3c-0a2c-41ad-8aba-3874aa4b9a86", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102295, "uuid": "d72fe9ff-35fd-409c-ac94-78bf42f6ec74", "value": "12288:2zxzTDWikLSb4NS7eX+t/0XiLNAhzJkSVgF9D3rMlVJNY+aO3RX2m:QDWHSb4N2NCddVgF930Y+a0RXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786102295, "uuid": "ce1661db-15c7-41f8-bb52-66ed66a3728f", "value": 658872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786102295, "uuid": "fca121e7-7ddb-48d2-a59f-1a0c0310a482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786102295, "uuid": "cfbba0a4-de42-4622-bd1b-783d3ee4cf4c", "value": "\u4e2d\u6587\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd78e8e-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097329, "uuid": "a8d2427e-bca4-49d3-8e2e-ab9d058f6c2c", "comment": "Malware payload", "value": "16200685a2c8b4b4d69745cd0888273a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097329, "uuid": "e3644482-18cd-4b84-905b-ce2362e9f609", "comment": "Malware payload", "value": "c94748d3ef1295840d61aac95b4d889f562030d57b93fa456069e8e71c167283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097329, "uuid": "3da23f57-7be5-45b0-9d14-085f510005e4", "comment": "Malware payload", "value": "c6092469b468a2dae4e7bac41a7139dd8a27c5f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097329, "uuid": "942da87f-2290-4a21-972c-06d2fac9517b", "comment": "Malware payload", "value": "dca09bbb132458f90ec2ef425b0964e354359de706cb38295a08bcab055f6ce2986721153bec2560695fafb4bceac9aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097329, "uuid": "30d142e9-6c16-4e35-bbeb-fb827daf6455", "value": "T1B3D523C6A5F169B4D477C3B29F43F0BE716DBB998A618E5BBACD2C0089231911037372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097329, "uuid": "65e2f183-3da3-44ce-ab6b-20ee11c25de1", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097329, "uuid": "219de8c4-9602-4c6a-baea-970a68427e50", "value": "49152:8WRTe59oQOnyKwAtZbPWWnnQNcBaDHSFvx0JeBcISWP7aN1oyn7bInww6fnsHzzu:1RTe59ROnJRZLJnQNcBajw0JemJoZHKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097329, "uuid": "f31172df-3e00-42d9-ad09-05d99e7c8ed2", "value": 2895872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097329, "uuid": "3ce86794-6ad4-4dc4-b958-660ab316c51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097329, "uuid": "246662ba-678d-486e-b8ff-6dc5e86a53af", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1423b8-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097195, "uuid": "f89db407-1126-4836-99f6-40288ea4182d", "comment": "Malware payload", "value": "61b2c00cc38e21c82cf866e53c008b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097195, "uuid": "74f66346-3da9-4070-ae29-ca2a5288dbc9", "comment": "Malware payload", "value": "c9e2edd85c59a64c95a1aae4ae8e4006416470acd7f53d6730910a8b5d0d5526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097195, "uuid": "859bc857-02ed-4301-ba84-b2b466e10363", "comment": "Malware payload", "value": "22442d5ec21a12dd60a35aa5cced669f27d8e7ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097195, "uuid": "dac68860-c823-4117-ae88-76168165b80e", "comment": "Malware payload", "value": "28a22eda05b2969923cd5a5872573dc7640914de02f854b3ba9f7841f1e88a50f816d60310f914c8496beb314b23f81b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097195, "uuid": "27852b72-c05f-4227-a96c-aed5e8334052", "value": "T12FD5239EFCF619B4E032C3B75287A5ADB12E378586348C1772C92B246CA35583C76379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097195, "uuid": "a138e1c1-7341-4f40-bc58-186ca262f908", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097195, "uuid": "1471b157-796f-4c33-a50f-fcdeb894dc6a", "value": "49152:Saq4YLAjhAYbli1H57Gj0AzldTwKBQELiR1Ol6q9NXHxYTWambIooC:SZB0Pbwt57GXllwKBGR1OEqHXRTOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097195, "uuid": "782a068c-e0f8-480e-8d77-50978f8b6381", "value": 2956800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097195, "uuid": "807ead88-385c-4e8c-866e-d8c9978f8908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097195, "uuid": "d28abdd3-1b6c-4a5d-b21e-bbc9d2b96f9f", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de5647a-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097842, "uuid": "e12774dc-8060-4fd2-809a-db2cb8a90d01", "comment": "Malware payload", "value": "09a1af526c6e103e7dadc563927017e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097842, "uuid": "47f5466d-38b1-470d-b17d-335ab21bad43", "comment": "Malware payload", "value": "c9e702a02d7003afce0ba08d6bf3177b92b16cd11a820f3d00bb3128ade6f65f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097842, "uuid": "6d2e8fc2-ef9a-454a-a45d-99c903a8440a", "comment": "Malware payload", "value": "86585a99f514bddb3d998ace15ab0d867b926dfc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097842, "uuid": "ae110460-5743-4004-84b4-80c2c33ef6fb", "comment": "Malware payload", "value": "234a13a4c6ca023a5afd180a5ca53be8ecac5a339ecce4d6518d6e57d9d5e067c67bbe2c29e6f1cfeb68bf146b295099", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097842, "uuid": "ff56f3c1-49ec-4beb-8d08-dc8f88cbc127", "value": "T17293FB055897B4806376B7BFB72B98E4E7A657270240291BB83C6440EFF2D09DDD0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097842, "uuid": "fdce1b3b-324b-4b5b-be24-7ca43c2942bf", "value": "768:kOkUqKsY4NeXpBoU0Bt4+mhHEZzHWwWbEZ5UJ0ege7JObsqS2f+yjipIjUzwun/M:rk7AobFmIgbuFtT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097842, "uuid": "bc7684e5-dfa5-4b84-8a94-bb165f10535d", "value": 90628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097842, "uuid": "43c35d3f-1e94-4407-a318-852f39192b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097842, "uuid": "095a3539-6c08-4f22-9384-1d090f803e8a", "value": "LHDNM 1TAX FORM 151916TAX 2018 - BE1467430.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71699a4a-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118571, "uuid": "bbbb6d32-2400-4232-87e4-7ef365b38e91", "comment": "Malware payload", "value": "146d5c015c2abbf08c9c05d83952dc61", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "targets", "colour": "#79D73B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118571, "uuid": "5518ad13-2d24-4e22-b9b2-635874236b49", "comment": "Malware payload", "value": "ca31be1448cc15dfb3359f1ab1ba32cf6124fde5216457ca9fd03918892ec43b", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "targets", "colour": "#79D73B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118571, "uuid": "0db66e80-861b-4516-860a-1a4e3d53a77e", "comment": "Malware payload", "value": "4e7521d75eb1bd8e6e240852a900b8eaed8aa357", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "targets", "colour": "#79D73B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118571, "uuid": "09e5c998-69de-48a9-ac58-5a33bfcec431", "comment": "Malware payload", "value": "fd267c618a1c8ad7d6c3d1c1c15313292a8868dec82d5c4db861fb816f3ac9f482013792391d5e20f74fd9f1bb30e30c", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "targets", "colour": "#79D73B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118571, "uuid": "41553115-e83c-4cb9-b741-278d9ef2bad9", "value": "T1C9568E7899EF10A4FBD7CC1126ACBF614173348BCBD26E51436CE5608AF9BE62F05948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118571, "uuid": "890c78cf-72d0-4b12-ade0-dbef1c98305a", "value": "12288:i6YDmnxhVqWhmBonWVx03CS/1bmrhXeC8Rp1xvbDNx:i6Yanxh/nW43norhXefRpjdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118571, "uuid": "08656547-5cf9-45ed-886f-9a835ba3427d", "value": 5980188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118571, "uuid": "a2f1d29d-796e-43e7-93b2-da7352ca81c5", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118571, "uuid": "b5009b6a-4a42-48ea-b1c5-3248469e6486", "value": "DocumentFormatOpenXml.Compile.targets", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89382f48-9202-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067501, "uuid": "9a885947-731a-4266-9645-60bf360fa075", "comment": "Malware payload (Mirai)", "value": "1e394f9ac8a393f4deea581598441ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067501, "uuid": "0650d60b-367a-466e-a018-1cbc03e6474a", "comment": "Malware payload (Mirai)", "value": "cb2ffb986351e2eea68c323dffd000bf0b8af4b41e4ce5afd024bbd0f4dfd599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067501, "uuid": "7c582c2d-d893-426b-8786-b5d756664255", "comment": "Malware payload (Mirai)", "value": "6566bcf6104aeda0407fb1f27c66aa2c76263da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067501, "uuid": "8b1382c3-c056-4f19-9af6-aca49efab5bc", "comment": "Malware payload (Mirai)", "value": "ec85ba0781193df9b8551af90a63aaf88215b286e1910a16ef17e5d52a95776840e257366323e68f4e35ee258e5e2776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067501, "uuid": "ac6db43c-8fde-4080-831a-5b0107368427", "value": "T10BD34C13E98080FDC49AD274879FD137EB32F89A12347B0F2B946E611D36F616B5A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067501, "uuid": "d767f352-3175-420e-b785-ce1189db48b5", "value": "3072:ByrYwOWHo64Cqm4NgI9bjjYqUA0ndiTLUbkt:ByRH7E7YDfcwbkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067501, "uuid": "ec95f18e-0705-4dbc-a4d9-98a646a229f9", "value": 141440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067501, "uuid": "6074645d-70c3-42f5-bb4c-1ae841dbfb1c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067501, "uuid": "38325077-0541-413a-a360-58b2299c80b0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32cb2ea-928c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786126896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126896, "uuid": "eb558472-b596-4f7f-bc05-e3f95b950790", "comment": "Malware payload", "value": "d0620761d9d906e630f5aca01ac96b5e", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "v2026", "colour": "#309485", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126896, "uuid": "bcbcb29e-af82-4ec2-8196-e0bee91c44f2", "comment": "Malware payload", "value": "cdab250ea90f79efb405d13c4f77fff2876b21392ddc0849737d2ab86e308189", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "v2026", "colour": "#309485", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126896, "uuid": "f083b598-e185-41f1-9998-4c4a32bb0e70", "comment": "Malware payload", "value": "71844a2528bd7d7ba3cc1cd205a817b0f4b087bf", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "v2026", "colour": "#309485", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786126896, "uuid": "e5002cd5-2480-4df5-8f11-73b9e2430b84", "comment": "Malware payload", "value": "73cfc9097f8ba954ffbc4614595dda4da991ff526bf5e41e74d96ed8ed73d35d95df83862e834fb9abde324e030d64cb", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "v2026", "colour": "#309485", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126896, "uuid": "46d64dc7-90ba-442d-ac2e-53f9e1e4ca8e", "value": "T15A446D15B6A559B9E457C07DC2178672BBB278850B21EEFF02A402353F27BE12A3DF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126896, "uuid": "3840826a-9a3b-4d1d-a51a-b5868d740c24", "value": "4567949ad535f76d067fb7d1aea455ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126896, "uuid": "b85fbb5a-6bda-4e03-959c-b1b8e34b96df", "value": "3072:aIgKX1BOy+cMp46tdiPRXJJnzWm5OIN5gOvY+CNF1Azm6DQ7f9dwt8VqaIGmsf+1:aXSBOZFOmi5XbWmrHguqH1Sm68m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786126896, "uuid": "d16ce034-1e3e-4f24-a5ba-41445adbddd5", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786126896, "uuid": "9c169c87-0069-4485-90df-b8d46ac1db63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786126896, "uuid": "7786626b-b81b-4351-8b00-37398b67ef19", "value": "cdab250ea90f79efb405d13c4f77fff2876b21392ddc0849737d2ab86e308189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec207dec-92a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135957, "uuid": "ca81c54a-676a-473d-9a82-fffd266579c2", "comment": "Malware payload", "value": "11f2b24989b0edce6ffa5113c7e61470", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135957, "uuid": "67a3aaed-04d8-42ac-a3c7-242b481ac9ac", "comment": "Malware payload", "value": "cdde719462e36f6a902e40859fab9e057acc944a02cc56c43353ab449efe6105", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135957, "uuid": "e7449fa5-fe62-4ae8-8465-5a0b2ae163b6", "comment": "Malware payload", "value": "8a7cc667b001f6c5e2eb56759ca725c3a1694276", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135957, "uuid": "b49eb72c-ced4-4222-bbcb-6147e1c1e124", "comment": "Malware payload", "value": "1bfa71e2c27b7be74d68658de74cbb4f4e7c6e3860acd45058586dd09ea58362e82baed807a57b24cadcadd6c000fded", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135957, "uuid": "3350151a-f33b-404a-9a31-1323562c0d5f", "value": "T1F9E6330826D001FEE6B395BCDAD156D4F8B4B46987B0CAAB47DC87785D27090863BB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135957, "uuid": "34538177-7309-45fc-a418-4ce0a1836a36", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135957, "uuid": "af2b9457-2740-4808-8ae2-45534a150cc4", "value": "393216:6GmOGRvrGuf7XU2jACGXMCHWUjVcuI3/PGTAI:6GT+aujhACGXMb8iH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135957, "uuid": "727e624c-1802-48bc-bb51-4dafac6fd43d", "value": 14304913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135957, "uuid": "51f125b1-0597-4fb4-893b-ae0b7e12e339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135957, "uuid": "7733d1bf-acc1-4ad1-90c0-5df90a916458", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc48cf47-929f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135125, "uuid": "3d2aeba0-3956-4f49-9a48-ef9dd347bee9", "comment": "Malware payload", "value": "9b7e26afd03bc448bb151204581a390b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135125, "uuid": "a1a6ec22-bd45-48ce-b7e9-57e7aaf0cad6", "comment": "Malware payload", "value": "ce6877673a5562fddb23109127fb9534be420e0a3191284c06775b277295fa90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135125, "uuid": "098338b1-9fc9-4d63-b7f2-838f67527e20", "comment": "Malware payload", "value": "a99e32b761be01e5c341f6460032ee344b09eb76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135125, "uuid": "068a6764-4153-44cc-b9bd-a2ed10c012de", "comment": "Malware payload", "value": "b28c45a4e91a3d785e4169ab1c03ec4f5257b68035121d3417596e6b076b2c87abb258ea44e2a33fc27deb46a9dd425d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135125, "uuid": "7af19ce4-5a9f-43b2-b8fa-0a48cf2485b8", "value": "T1A003E882FE1A8607C2C273FBF75D428C7B2A6EA8B7F932155A306FF133865D11526161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135125, "uuid": "16aa85ee-7a6b-4e3a-8743-a1719b78905b", "value": "768:HNp77c3DLaPZRaPyOhaadPbUk/V7FQFGPpLIvQ8DKHBjxD6:H7Af2KhxV4k/QFYLIIVh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135125, "uuid": "ac94287c-246f-4e42-b677-b95f1e6e944e", "value": 40144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135125, "uuid": "5d129cd1-83c7-46ee-9e8d-9d1fbcbee491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135125, "uuid": "47db4776-d439-4067-b79b-62c4563b5ffe", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ff5695-9209-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786070633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070633, "uuid": "d77e7c1c-20f9-4a47-8387-fe79a6de07a4", "comment": "Malware payload (Mirai)", "value": "8223e45f76be0234ff5043dfa0eb56c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070633, "uuid": "1262bfce-757e-48d1-83d1-496f736f00c3", "comment": "Malware payload (Mirai)", "value": "cf29935a19b0f6f894971c107e8ffdefe122dc44ffd643f1fe0dbf23207d7083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070633, "uuid": "16600178-2592-4ed4-878c-7a6f09531948", "comment": "Malware payload (Mirai)", "value": "14908827f9fc3942f2a3df30509e46cbdd9873b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786070633, "uuid": "430bc385-26a7-4220-ac2f-e550926fa4d5", "comment": "Malware payload (Mirai)", "value": "716e04373a00be86248664675a5487613a16f283b8f68eda304a63d684607f73f96052d69403380bd74bc6107791ce21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070633, "uuid": "44986087-1676-46d4-be13-b54353e0219b", "value": "T10714975E6E228F7EF268C73447B74A34976D23D627E1D684D2ACC1101F6039E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070633, "uuid": "5075ce6f-a27d-4146-8287-a1a35ba8446f", "value": "3072:lcytmq5JQDxGJztOk8klG0n5bCXfuy3Rs8Ge5RPfeWg3KR7X9uHl9i:lcytmq560hOk8ibUfuIOofMaR7ts9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786070633, "uuid": "c40109c4-5295-4fe3-af29-2fcc2bd11c6f", "value": 194580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786070633, "uuid": "d29bd9d6-ec7f-4dca-ad57-19c352ea8c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786070633, "uuid": "d9d4902b-1287-4c91-a794-819aa9c09fb3", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d481a940-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786097692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097692, "uuid": "4509045a-0f17-480b-8af2-e904473a8e62", "comment": "Malware payload (RemcosRAT)", "value": "60d28d6e1be1d80e9eaa15eeb0c3ff58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097692, "uuid": "b4867d7f-1f20-4c62-85c4-fec08bd17d84", "comment": "Malware payload (RemcosRAT)", "value": "cf4ebc8e5121ece3f32be7e760a99273d170411b74bc6aa1d2f8e8509560f90c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097692, "uuid": "c20f1b38-9bae-48a3-be85-641acda763b0", "comment": "Malware payload (RemcosRAT)", "value": "2066dc1b567f2564ede215a14d5a9eaee94dab13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097692, "uuid": "472a166c-54ae-4662-894b-608bc1b0a514", "comment": "Malware payload (RemcosRAT)", "value": "a6766d5c6f9b81f5804b2b629194731024bdac0468cbb8cfbaf3fd8e4ddad8c6c63a0cffc7f19e644226298bc83bb30f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097692, "uuid": "8d3a9c81-5214-4cb1-aec4-9f8488f155fc", "value": "T1D5B53ABE8F9A3E2B31D19066DE2791D13B92B69AC5F650F1C0B8473229930EED457433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097692, "uuid": "a18aecdc-3a5b-4b5a-92d2-644e9549f503", "value": "24576:ROkdkVummJFQnVpyVxl0tmP8dSHmk5pRjYfdWWZTCjrW+:k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097692, "uuid": "f3f95823-da2b-4b06-8af7-620cf21be461", "value": 2370335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097692, "uuid": "ec028de0-1340-47f7-b40e-35fb34de8165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097692, "uuid": "9143578d-cea8-44f7-80ff-a6c886173853", "value": "REF_00168_0708026_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24468856-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099544, "uuid": "849c8c7b-48dc-4197-b233-1afffd42d84c", "comment": "Malware payload (Mirai)", "value": "8806e2438beb3da9bcd574588a55db85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099544, "uuid": "e952ddc5-d87d-43dc-8cdd-1ca2c5abef04", "comment": "Malware payload (Mirai)", "value": "d023137d1430de07fbe3225f6e2511b85b228d76b6c43aa23ecc55a97ceee4bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099544, "uuid": "9156f1fd-3040-4611-9ae5-7413ec03bb1d", "comment": "Malware payload (Mirai)", "value": "53751675c182c802bc7253d1b9a5395a52d56faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099544, "uuid": "ddce81b9-6677-4da8-ba58-9507e80537ad", "comment": "Malware payload (Mirai)", "value": "c2cb414750cbf358e75452cae311dc2389581a9900cc929bb87a2ecc0f0c6b3fb3629c80f40211f4ba2014970eebb0dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099544, "uuid": "7c4a03ae-e27d-4688-9e97-243f7d54a7e1", "value": "T1BB23D694F9409B39C7D074BAF95E42DD33130FA8E2EA31159E216B313BF79194A37A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099544, "uuid": "1f5ba71f-41dd-45d4-98be-501f7c058722", "value": "768:viZcnppnxvdw/z9M7kfpL1ZFWSPGZhTHUD7fhDHOmXBw4AOpOUO9Ok57YUQVaR5/:viZcnppntdw/z9M7kBBZFlevTABXK4A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099544, "uuid": "f299477d-a55d-4336-aef1-ae54711e2ccb", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099544, "uuid": "84579917-6dba-49be-bffc-f0a1c0a03d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099544, "uuid": "c67620f8-9d73-400f-9b71-e6dd95f67516", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487407.29115.27015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf749a0-926e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786113864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113864, "uuid": "f5532ae9-402c-460b-84d6-55b6e1875c33", "comment": "Malware payload", "value": "50e9b42204820774435ccf259c83b602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113864, "uuid": "77a55912-ee4b-446e-9530-817b55c6b645", "comment": "Malware payload", "value": "d030dbd4fb42806f83b5681716c8fd31eb280ea6c171a908a7161223e94a48ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113864, "uuid": "f737001d-e2c7-4583-a1b3-95b08ddf5122", "comment": "Malware payload", "value": "d06d03267394d0e97e1787759cb156b8a16748eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786113864, "uuid": "03207fd7-7840-4b9f-9548-1c900efa307e", "comment": "Malware payload", "value": "c735bc9a1492af80932a9ea9662228f6be318e1481974756fa23204ff1acf12edf0d0919d1327713c321534dbef0dcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113864, "uuid": "b69c0786-f52c-402d-a6d5-3e8ea7bf4824", "value": "T1B2D52399B4B50DB4D876CBB28F83F5AE3229378086758E43BACC7E005D221A85D79735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113864, "uuid": "2d3c54b4-66c9-476d-bc05-555d38ed718b", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113864, "uuid": "f79d600b-ef33-44a0-81ad-ffceb932832f", "value": "49152:av43RBB141Q2y+EZUcQ5Pi3b55SfErbgovSPLqbrnWwTZx:ag3v81ly+EZisPSsrbgovSTKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786113864, "uuid": "619fd3e5-33b3-40d4-9625-bb70e2cf4943", "value": 2924032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786113864, "uuid": "f5d84f74-ccdb-405f-9a01-a6dce77c4901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786113864, "uuid": "7706b993-861b-4d70-8c2c-064214cedf6b", "value": "d030dbd4fb42806f83b5681716c8fd31eb280ea6c171a908a7161223e94a48ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3d4e77-9202-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786067484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067484, "uuid": "15b4045e-8b96-4f55-b855-8b841fd8b71b", "comment": "Malware payload (Mirai)", "value": "1a4e5fb9867616d104e17853809d0f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067484, "uuid": "33e90e5f-595e-484e-a1d4-f94ec1bf5647", "comment": "Malware payload (Mirai)", "value": "d031735c3f1885f132d422c246cf99fa8c7dd6ec10f78d4397fe50621ac84576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067484, "uuid": "ea403aa2-1d94-47e3-bfa5-32e21c932679", "comment": "Malware payload (Mirai)", "value": "ee74a5517084f3d5a39551606696df581c15e2a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786067484, "uuid": "d8c661a2-cf63-4de2-8ae7-06803b33ab93", "comment": "Malware payload (Mirai)", "value": "84d7235d96ee57abdc520f5c88dd7279406c182de8090009599d7c2e2ee114e2498d8cbbaa24d8bbf36c3f57c51b7aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067484, "uuid": "d7f8a6ab-810b-4707-bef6-ff3663660812", "value": "T1476301BF815AFEB5C7D059365A3E07C93390582B1076E71EA4E2769AC8D76FC8F05202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067484, "uuid": "32f27026-4a88-4eea-a647-b770c81b6efc", "value": "1536:35qDgMsi2HRMhrf4pgCxG5C12aC+nnLumY50IINQBP5k1ZVyDa:JEsDRMhzqnxG5CVFnimY5nVPGZVyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786067484, "uuid": "db89ae05-76ae-47dd-975a-4c13dc857a49", "value": 67136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786067484, "uuid": "e4c6c7a2-ecf6-4788-b1a2-ef6df40b58c1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786067484, "uuid": "13baa3f4-de45-4c72-8fcf-94ed5db87723", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa76947-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786097837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097837, "uuid": "89809d7a-d8c0-40a6-99f4-95a7e6b5040f", "comment": "Malware payload (LxBaseRAT)", "value": "926a0ac68adc58d88c7a1cabf210af28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097837, "uuid": "6ec57287-f520-4951-8d68-6c5f1542cb7f", "comment": "Malware payload (LxBaseRAT)", "value": "d0425434ffe85b1539b6b7f3160759f35bed76ce3e95de09f96a4ee5f579c219", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097837, "uuid": "16942f9a-7782-4e0e-bc88-413fa673fde2", "comment": "Malware payload (LxBaseRAT)", "value": "c349bbf827842b10863fcfe3ec61427428df96d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097837, "uuid": "57f4baaf-afab-452e-ad71-61bf6562454d", "comment": "Malware payload (LxBaseRAT)", "value": "dbf6e6db8566aa544757237c9ffe64e8021dc73d38ecfaf51afa8025ec0e0c754067c447d7a23a13c478acdd590160a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097837, "uuid": "454938d7-1a7b-48b7-bb15-089ead645522", "value": "T19F73AEE9052CC4E525DCAF0F6E743324978FA2D4A818A33E9686DFEFF9E075C6506418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097837, "uuid": "17a18969-5d85-4aa0-9026-1171b902a13f", "value": "384:MSPyE72HcO7jgz2akZd/t66E6TRkBEtAgrGGQHKBYBGQafN2:MuOga1ZdVHSWSgrGGQHKBYBHafN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097837, "uuid": "c8c11606-b456-4812-b095-ce8d426c581f", "value": 77560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097837, "uuid": "0d78fb21-2a9a-4ec6-b0d3-44ec67e82fd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097837, "uuid": "90fb4441-579c-4858-a50e-ea2ba795f7ae", "value": "INVOICE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ea4094-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137906, "uuid": "ed503903-10f6-4fac-b233-b6a6961ea4c3", "comment": "Malware payload", "value": "0185a472ab9b3d0782d4c5f7030badfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137906, "uuid": "1061b91f-be52-4a37-8db7-a95eadb34086", "comment": "Malware payload", "value": "d08221a100c5599634143212a5ffa574455da350a7773b280e9a74d9d67546dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137906, "uuid": "7dd0ba55-24ef-4edf-b04f-4ef4025fa9da", "comment": "Malware payload", "value": "bee45b0369f2f6f2ba8a6612020add26f4cd3cd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137906, "uuid": "7bcc966e-96e7-43ce-ae73-134db7ca1fd7", "comment": "Malware payload", "value": "ccc5e74ebcdf2e0989cc4a0940a297bda350ab415e21f4593032a80d50fd5249eb79fab3318cf220eefd11475909c081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137906, "uuid": "6c30e863-3747-4c4f-941b-2e38f61f602a", "value": "T19323C51BB6A3B07CC24BD0B45A9AC5F1B93178B402213D3FA3C9FA312D35D516A59E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137906, "uuid": "cd56e955-c3b6-4548-8e4b-b1db5ef42b2d", "value": "768:koZxzHpMepJ85Z1f+57AJh01aoNowMTCJwGXQ3pTiTTljiJ:HxzHqeQxkAJhgamJwGXQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137906, "uuid": "f6e13240-d64b-446d-bbca-23fe28724349", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137906, "uuid": "62797ffb-23a6-4510-a14c-82e7793a83a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137906, "uuid": "ad491b61-fc03-4190-862a-179b1146b78c", "value": "main.x86-64-i7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671a0db-923b-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1786091951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091951, "uuid": "1151f679-1881-4649-8327-a87620787ff7", "comment": "Malware payload (HijackLoader)", "value": "d8752eeda20778ce0e9ef7a224155748", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091951, "uuid": "05fe89e3-03ff-4f3b-ba06-44210261f434", "comment": "Malware payload (HijackLoader)", "value": "d17eba397f2feb1aac83499c9b89475b476a586cd4776bb1485c376516c89655", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091951, "uuid": "df03eccf-ec6d-4371-8f5a-1b6bfce73a60", "comment": "Malware payload (HijackLoader)", "value": "cc9dbee196e748aa1b01dc56bf8f4d56d571cf01", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091951, "uuid": "2a7be8b2-417c-473e-a672-4b9b0cfba8f4", "comment": "Malware payload (HijackLoader)", "value": "5b0143861e6f733e3191430c50e23b8d557f4cc8a9c0202c15f772a171d0d0a20ed6533480a76f1044e8d265cddf2d81", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091951, "uuid": "992d1405-39ac-472f-974d-05e5e2804d45", "value": "T1DA563370FDA49931DA4AF97941838B18667F7E62642DE2431F0570690BFFA7A08B43DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091951, "uuid": "f39cb6cb-a1fb-4080-9adc-825195c8d573", "value": "98304:KHDpNyRPqaMM+H5cSTA8wwb+N78chnmMioBUe6cmKgo7rbPJtuvYfHyiAK/2HC:WCRizM+Zp1crioB36zKvPz8YfzAK/2HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786091951, "uuid": "e06cda47-99c8-4045-93e9-00f7adf37262", "value": 6234112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786091951, "uuid": "16c03287-3f3b-4392-86a8-2fb94c9884b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091951, "uuid": "7d383696-5fa7-4583-a5d2-1b0c9a868579", "value": "SecuriteInfo.com.Trojan-Spy.MSI.Agent.6752.7247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176ffb12-929e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786134312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134312, "uuid": "cc9a1897-6657-4335-afec-84321614e681", "comment": "Malware payload", "value": "febfddc8add63ac563833c9664d85319", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134312, "uuid": "66afb121-d562-45f8-af21-326487404dbc", "comment": "Malware payload", "value": "d1bac5d40cd98f05ef8e605931a4ed9a619171ad8f0cba785560da36c3ca85f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134312, "uuid": "ead2491b-9fdc-4443-b89f-1b82d59b0279", "comment": "Malware payload", "value": "206bdbb52545c9426c69ee8da16ea9b2904b53c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134312, "uuid": "2316be03-74f2-4be3-9ff5-1e677d62bb8e", "comment": "Malware payload", "value": "a27b2f6600a6810a907b1ce2f708a65ae3e8b1deae9a135b8f02d0d6cea982cbc30fc43ea18e5adfb9a65849fb5fc2e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134312, "uuid": "95016236-f4d7-4f4f-841a-f1b5d3f7ec12", "value": "T1B11194D9A4D688313F0D5C27641D4CC7B2C1052B00F92DD4B35DA9635E0CAB5557AF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134312, "uuid": "ef342aab-f330-430b-bb6f-ea5782160b37", "value": "24:HmtD9jWijWr5jW2Fr7jN/F5haHifMDsxVexUQkjJjCDYXmYRYCYJ:Hmd9jpjY5jPnjN/zACfMDqe6B1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786134312, "uuid": "ebbcf337-67c8-465c-b243-60b124b7907b", "value": 880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786134312, "uuid": "30121eac-03d9-4d45-8945-521c7d521295", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134312, "uuid": "86fc53ed-790e-45c3-acbf-f92af8ce3e63", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408afab5-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097873, "uuid": "c094e49b-795f-43ac-a6a8-e2392cbe1035", "comment": "Malware payload (AgentTesla)", "value": "35e023c3800818b49f0f5086b1ed3170", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097873, "uuid": "4a22feee-5d6f-4499-990e-bff3d63bfa7e", "comment": "Malware payload (AgentTesla)", "value": "d21d86002931aaac18703428b8db94f1877a450d121d0c7037d24dccd9b59951", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097873, "uuid": "a23ef7fa-3a70-4d9e-b46a-2393990d5325", "comment": "Malware payload (AgentTesla)", "value": "04458c83a11bf494cbec5f9f3c7f3ba70d120841", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097873, "uuid": "2cdf3530-9bcf-42e2-95e6-d787ab3dfc80", "comment": "Malware payload (AgentTesla)", "value": "fe01e24a23a02faddef0ad1618911fce779318be20cbdf3e3367adec6bba8dfbb252185efe4e042f9a622a51f3baa47f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097873, "uuid": "4fe36de9-5fbb-469e-af64-2fb7e7664cdc", "value": "T18383BA1518967480533727BFB62BA8E0E776072B02502917BA7CB450DFF1E09EED4DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097873, "uuid": "4a7d52d5-bc5b-4fe7-97e1-4914a547d581", "value": "768:bJRGFH9zmmDrxZikiOJ1XBf3jU7SGc2GY2aa5geTrVxprk03/DRvxFxobvgdsltp:bJcFdzDPm+owqOAyPvwR+ldcDZzeHBrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097873, "uuid": "401d08cc-e573-42d9-9c06-c91c70ecbd77", "value": 84218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097873, "uuid": "4875b082-c829-4a37-ac42-66f91e071019", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097873, "uuid": "d03ee53a-948c-4ff4-9efc-4d95a403c90f", "value": "Nomina 08.6.2026.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864858ac-9293-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786129773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129773, "uuid": "012b9fbf-014d-4206-bb52-fac2a1439aca", "comment": "Malware payload", "value": "d00de57898ad60c520cebb43aab23073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129773, "uuid": "c736b8c4-92cd-42e2-b148-8889b0424ea7", "comment": "Malware payload", "value": "d263333a1c51a1ceb3b2995dfa654cfdb5247e7ec2d80ede483cacd00c2b7690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129773, "uuid": "4721956b-511c-4300-a835-47e6e03624f2", "comment": "Malware payload", "value": "baa650faaa0486e8be63a4e4b94c94ac6e67b7f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129773, "uuid": "cf4283e3-47ff-4243-8338-de86f731611b", "comment": "Malware payload", "value": "eca2c0163f56433d862549f6e311e5cbb5a9375bc02b75b020e5b0103b3dcdc387b4bafc567f76ba8d71c91092211b0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129773, "uuid": "24f16972-9dd5-476a-babd-2c8d58c4e9c3", "value": "T14843E62B3584A3F4F58157B077E7A3B27C680BFF1096A05B6A4216167AF07BB603C947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129773, "uuid": "338837ae-1a86-427f-b958-98a4c52ccb37", "value": "1536:3VO7JkN6os4c3dscp9RILT4S633oPCUKtkJl1+nUo:F8JuZ/cp4LTN6HwC/tkMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129773, "uuid": "2a24bbf6-8309-4d37-b127-a0a371a9c10e", "value": 58140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129773, "uuid": "19f73b61-644d-4315-892f-044f7fcff42c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129773, "uuid": "1f9ff35b-9c79-4af8-9d66-dfb6f26128a4", "value": "main.openrisc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4c0103-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137887, "uuid": "51d035e8-8576-4362-85a7-6b16c8349d79", "comment": "Malware payload", "value": "49f6d6a73fb26c0f7d912a49fa52d6fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137887, "uuid": "2d9c1555-0082-4924-b42c-fcdaa6375fbe", "comment": "Malware payload", "value": "d26a76e53bb19c1459a4eee5c1a15bb97fc05177b4042666f99b0191a2b86d03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137887, "uuid": "e2e57910-fc26-4c81-a73d-77b3616ae5d7", "comment": "Malware payload", "value": "0a2a35affd6e656b6a4c005f199d056e363abd5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137887, "uuid": "05b9fcf3-7ac2-4b48-ac7b-f54c24d48bce", "comment": "Malware payload", "value": "d498c6ac62e69446de667903fa5fa30e19a4d37c40d5727f5b582b6f28d205603258e24b8bdeee3da407ea2ee1a11d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137887, "uuid": "4e2a6acb-efce-4cdb-94c7-03e9088d7be8", "value": "T18C055B12FF4C2517CB0D0671A96A9778F792748381F4C6133B0857AF68D223A1DEBE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137887, "uuid": "83da8903-cc78-4071-bd0c-98811b3a17c4", "value": "24576:re8qZs2mW6+TDq3x8BEueg4wUK5yyTLOi/hjM3/qL9lFKA/Gao2Hcq:re7mW6+TDq3x8BEueg4wUw2i/hjM3/q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137887, "uuid": "9f41e5bd-e77e-4a1f-8572-1f80d292df0b", "value": 860392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137887, "uuid": "354a4c68-ed5c-4baf-b21d-2cbb577c1b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137887, "uuid": "92348b43-41d0-452b-8ba3-8082f2bd7228", "value": "main.e5500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13394c27-92a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786136023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786136023, "uuid": "f7d7a89d-831d-4d1d-84e3-77a73b4cf796", "comment": "Malware payload", "value": "0ee33f76b0a2f488b546a19d0cf918f2", "object_relation": "md5", "Tag": [ { "name": "192-252-178-228", "colour": "#3832F3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786136023, "uuid": "846d820c-9990-48bc-92ba-68949e312949", "comment": "Malware payload", "value": "d2ece067dae0c6921b68ade8a9779b92da96f940437b8e192f9ed89a175fcd62", "object_relation": "sha256", "Tag": [ { "name": "192-252-178-228", "colour": "#3832F3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786136023, "uuid": "f02c5282-41d9-46de-8028-3efa8fa0c370", "comment": "Malware payload", "value": "46499d2aa76f6cf6087d84d6bc0dd8abbb4a10df", "object_relation": "sha1", "Tag": [ { "name": "192-252-178-228", "colour": "#3832F3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786136023, "uuid": "1b1c6711-ce28-44e0-a6ae-34b6cf52b21c", "comment": "Malware payload", "value": "7a03916823003f609c0d04fff3fe498aeb152e08b6dffa9f72b26027ee9f4b02c1d07b2f75ddc02cd690309be881f467", "object_relation": "sha3-384", "Tag": [ { "name": "192-252-178-228", "colour": "#3832F3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786136023, "uuid": "364caeda-3825-4e46-aaa1-d85e7a4c4bf8", "value": "T180853389BDED61135D26FEA2E0F319E8322385C72CEAFB4070BD8C15D7654E960A7316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786136023, "uuid": "c364def5-47cf-45aa-bb42-bb272d58944b", "value": "49152:e0bzvKcRYebVwQ/+0IXhUJ0oD01udiHDNoTJgf:jbrKcVbVQFXhg3DIukhoWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786136023, "uuid": "ef193255-fcaa-4c4c-9065-533ea258939b", "value": 1743476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786136023, "uuid": "0ef5eb07-74cd-43a0-ad9b-5024a6615800", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786136023, "uuid": "a3a41767-8b90-43c0-9579-75e6849f2355", "value": "update1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafbcdce-922d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786086107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086107, "uuid": "f868fa63-33c0-4a5f-9c5b-7c34ca010918", "comment": "Malware payload (Mirai)", "value": "f604781a9ac7c3b6c0216fc02f9fcd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086107, "uuid": "0079afda-a5d4-45af-8aa5-0627ecf0721a", "comment": "Malware payload (Mirai)", "value": "d33f3b1668cd682ae4b7a049d2ec3ce5ca5f0de464061881948a6802ad8899f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086107, "uuid": "35142f61-38b7-4134-96de-3c7e921245d2", "comment": "Malware payload (Mirai)", "value": "1a55522b6830da41b1fe0483f30dbf1f630f4d8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086107, "uuid": "94e43ad1-8b7b-41c1-b2a3-1bf9e28e0d3a", "comment": "Malware payload (Mirai)", "value": "3d6c7d07c8a62edb5b108c3ed1199f4afd9124de7d34249dc6f7373939900f6d7e9d0ec99ae85b3328e4f27230c07128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086107, "uuid": "dccc21cb-260e-4eba-859e-f7f0c3f27e1f", "value": "T1FFA30210448E3186DE97D1B021AD573CAF3F08A131276E8D794CDEABDF46122B4DB1D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086107, "uuid": "062f3e61-3e31-4718-85a1-dc05df88b9e0", "value": "3072:8J1DLO7nEr78eFKge3cMdzYXQ5/LBmlITqVCPVEx:8JlO7nEr7VSsMd0XQNLBDOAEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086107, "uuid": "a72c2366-e46e-42de-8dc9-4df9d4353740", "value": 99740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086107, "uuid": "d458be7b-0a56-4f10-93bd-a7e06c9489ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086107, "uuid": "a2497d6f-4b04-4534-9cca-36e9ec33434b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bd2096-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786133715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133715, "uuid": "5b33203f-6a16-444f-ab88-e48177e1f51a", "comment": "Malware payload (Mirai)", "value": "da74e2ccd46fd3bc17ee253b4a45ab48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133715, "uuid": "18978b1f-c5ae-40b3-aaef-e3d1c95d7672", "comment": "Malware payload (Mirai)", "value": "d3ab958551ae4b0c4d3086b00804e00b52c612cd5e19ac28dfb5fa969585d65d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133715, "uuid": "13d70787-f90a-4e65-a31f-43d3ddf9e90d", "comment": "Malware payload (Mirai)", "value": "34cd05b7eeca263fb4eed5253bd50d0b0fb8f507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133715, "uuid": "979eb92c-5a32-41fe-8161-2306a9a88b0c", "comment": "Malware payload (Mirai)", "value": "af739556ef2a98c41601dea3fa4979fb69663828b9b9a655f92af352f2dcae982acb6688a8ffeb288f7320c81970dbf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133715, "uuid": "d6907af1-eecd-4279-9450-c20cad1b7803", "value": "T100435316ABA1DE77DC1FDD7305E8860124CCA49762A92B2B7170CA6CF75B88F09D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133715, "uuid": "b6d7bf5e-6390-4ccc-a467-f51f8ce0606e", "value": "1536:afGi9vflsdMus5KEd9llnrQUFpVlzIlZj65ApLWg6wKIpjH:aei9vNsdMus5ZJ9rQUjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133715, "uuid": "bb715c05-0b5f-4ff8-b27e-47651181fee9", "value": 59212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133715, "uuid": "cc2cc344-d89d-4e85-ba25-e1e5c6b9d7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133715, "uuid": "930a431a-e5bc-49c1-8625-89225db26390", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ae9b65-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097754, "uuid": "126879d4-b238-4034-9862-219a4b2b2cf8", "comment": "Malware payload (Formbook)", "value": "106584fa39d3f59161d72551299456f9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097754, "uuid": "bdaacebb-28d4-4c92-a3b5-5c3ad270663a", "comment": "Malware payload (Formbook)", "value": "d3b2ccc8a4d957e446ce7d29558c29d9ac9949c24069e08be6d4f43e6dd0748a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097754, "uuid": "ad244537-9777-472a-88bc-823e44c034de", "comment": "Malware payload (Formbook)", "value": "1922a35867eebbf924a981c361244dd6ed2f0a3e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097754, "uuid": "c11a7609-85a7-4357-9849-685550c69b90", "comment": "Malware payload (Formbook)", "value": "0d39e5d3226e6e354c901f73f30c7491ed0217563be79fe80b1f20e85861e080e3494cb7f1d6a9c23bb55d51fe592f9e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097754, "uuid": "8060867f-d5ae-4822-93a1-c8883189a9e6", "value": "T1BE4321BAEB97C20ED74821C344B4EFE951D2FE6687E5F60E5129D688233C7147D928B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097754, "uuid": "1bd5a607-6201-4c84-b3cf-feb3170be7e5", "value": "96:TQ56d3BYovlPZ34NqmqaG8+h7ptpdkPRrlrXRxLDAODphP:Bx8qFdmR1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097754, "uuid": "fe497b35-b09e-4d0d-9172-9076bf9ce743", "value": 56270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097754, "uuid": "4dcad24c-8872-48e3-8098-48f7c8355177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097754, "uuid": "e29c644f-4189-4022-bd16-cf45a8c6fc25", "value": "854f1e97-5dbb-4a87a5PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a9bbd0-9224-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786082044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082044, "uuid": "34f6fdb5-e07a-4976-b682-8d6c2ace9d6f", "comment": "Malware payload", "value": "a1c249edabd90e696d384eb76cc1592c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082044, "uuid": "8ae59e25-3912-4745-ae55-61c3b3cc0562", "comment": "Malware payload", "value": "d4971d87f7d0e94f302ac708a733f9e0166eba8daa4a5e0c8e41ac580643ff8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082044, "uuid": "694d91e8-fa21-40b1-b256-210283331762", "comment": "Malware payload", "value": "f27387c596409e65503d9c1aa4e1133839eb80d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786082044, "uuid": "475287c0-daa1-4df7-8c74-5ff31f950b50", "comment": "Malware payload", "value": "d0d709bd02376cacc96475b861edd0e58f710b0d574ca0c4730a6e6b0bfb2a9dd85cfb0b21eac24132d777683e9a34c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082044, "uuid": "1c95df60-6528-41e1-a1df-a13f6f726bf4", "value": "T13651334A6D2790D22CF7EEA1E623651CE9319416BD7B4D3F3C90E48C4B1DF79944408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082044, "uuid": "471cf9e4-2f70-47ca-8a90-8c36aa2df183", "value": "48:C5/7AG+O867/nzgL8rQ5zVCm66K+pjXlX87tX1/EJF80yk3RnAXEN8PNxT0nXHrj:eTA7O867/nUwSkmpjVMX0yFEaP3qXrY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786082044, "uuid": "7293420b-14c7-4606-b601-8c445e7a0461", "value": 2535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786082044, "uuid": "8035c32f-e400-45a1-86db-1fe1339232fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786082044, "uuid": "64300646-824a-4741-b79d-962ef1fd936d", "value": "EC_puller.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094a3dc3-91fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1786065139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065139, "uuid": "2bc180c2-2e20-42fa-86f7-636e2531ae0c", "comment": "Malware payload (ZigClipper)", "value": "d8fcb7a4ef513ffff9cd2b3448c2b0e0", "object_relation": "md5", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065139, "uuid": "226ea796-e64c-4a89-af97-8c794943e2c5", "comment": "Malware payload (ZigClipper)", "value": "d4cfab5e052df4c049f258e226d11825cb37b0359be454b83241edd59b295f08", "object_relation": "sha256", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065139, "uuid": "3d5c4ca0-586f-41de-88c0-587dd934e414", "comment": "Malware payload (ZigClipper)", "value": "56b6322ec04bb397dcdcab70d50275e689312c4e", "object_relation": "sha1", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065139, "uuid": "013d427a-4a7b-4015-a393-f096ef5d5abe", "comment": "Malware payload (ZigClipper)", "value": "67acb78b4612a99f2f093b26a64402e8ec4ad0b7ab224b10bf4190a9f6952bc276a923654e3767da9535ffd364bd7562", "object_relation": "sha3-384", "Tag": [ { "name": "197b1ec4b9644da7b43669fd4f0ed73f", "colour": "#3D643C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065139, "uuid": "d8d79348-a6ea-4d72-826a-032ecc734d3e", "value": "T11145BF15A3A411F8E62BC274CA9A5233EBF174811B64EACB1755D65D3F33AD06F3A320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065139, "uuid": "3862b615-2cff-4eff-84ea-57d5b11324a3", "value": "8c0ed5311e0eeba51b4c1a13e4263081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065139, "uuid": "5bb6ef18-0023-43a5-98b5-ef09c013bc38", "value": "24576:F69ePqpqfpP1y2LxKG0+m1gFZ3VttK5O1+MEcCxlnAlQrA:F69ePX110+HFlVts5aCxCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786065139, "uuid": "226f290c-0648-4e6e-8229-75cfb20c7be6", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786065139, "uuid": "006f6464-eb0b-44f7-ae87-9ab12030c61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065139, "uuid": "a9775f99-ac5e-480c-81fb-ac05618951a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8309c5-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786097706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097706, "uuid": "a3b40ced-a877-41de-837a-397b590ed7a4", "comment": "Malware payload (PhantomStealer)", "value": "2d404dc67999ab752801f902420310f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097706, "uuid": "d330e299-0271-4b10-a63f-4c85d3523e08", "comment": "Malware payload (PhantomStealer)", "value": "d577739b4710f7339eb864950e14e037f41f7e35e489df25a03336013fe23085", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097706, "uuid": "08185336-42e8-4514-a182-7ba90569116f", "comment": "Malware payload (PhantomStealer)", "value": "19c00bff8894fd3dd43cb2e1d118a35ae4f4ef4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097706, "uuid": "983e4960-8107-493f-94a5-dae8bd82a718", "comment": "Malware payload (PhantomStealer)", "value": "b72024dea2a1a61ed856b39e1347c23a0760ba127b4e330ff0ee5cd83fe26e511ba8cf4904dfa8dc9da7037e44df95a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097706, "uuid": "ebc09bf1-ed24-4aaf-993f-0ef47a727575", "value": "T16C06E8B625DF220758ACA799B50B54F80F1AE1202E93AFE4F4FF1EC0166B4473691D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097706, "uuid": "655e6ca6-1645-41ed-bebb-b8a9b31b077f", "value": "49152:TazR1lwcYRJCWr7DzX2OhtIQmIc1z1vCZWdlKJ1bI2H7zUgAg4udFCkV:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097706, "uuid": "992fc549-3ac3-420f-b9e5-5455adb610ec", "value": 3676757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097706, "uuid": "b51195a5-6810-45fa-9638-5493709cb298", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097706, "uuid": "d7ef1bb8-5ef8-46eb-891a-e149665398da", "value": "TRANSFERENCIA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0167c216-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097767, "uuid": "abd59e73-aa86-4324-8fcc-51b7fc8a0da3", "comment": "Malware payload (AgentTesla)", "value": "e8607f940f25591ef4d672b314122ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097767, "uuid": "3ee44983-445a-4773-8097-7e60aeb7744b", "comment": "Malware payload (AgentTesla)", "value": "d697ffce28c39d6553ac42bd90b640a5de08a251ef612c7ce8fc35f0866afaae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097767, "uuid": "388ea592-fd37-4bed-89a9-dbbf31151886", "comment": "Malware payload (AgentTesla)", "value": "74d39437293130894afddf393c04d9b456d4e70e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097767, "uuid": "51f2c988-19b5-4326-be81-fef97d6b42f3", "comment": "Malware payload (AgentTesla)", "value": "c574a4e4e460ad77ad20953816953055276edd12ea6dcec2379b9e5c112e0c6caad932ba7acedc05dade7f5db9384fb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097767, "uuid": "997ade73-027e-44eb-a4a9-b08fb3f2d51f", "value": "T15C552D759AFE3993F691C83EF617A0E23D227890D526AAB7C058272710674F2D8D3437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097767, "uuid": "fdbcc030-7ea9-40fc-9f56-4a78dd6fed9a", "value": "24576:fTYx5Ns4kTbp/QylyTLSpDzYVVrJ6wd7WnS:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097767, "uuid": "68009a96-b697-4d02-971e-10dd251caab8", "value": 1325176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097767, "uuid": "69a3f9f2-8c49-4137-9ec8-a62b065645bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097767, "uuid": "003824d6-c1e8-4177-bb1f-08dd8af76f2a", "value": "Documento di preventivo_ 07.08.2026 xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9aa269-925e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786107106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107106, "uuid": "74c8b9f7-54c2-4970-81ac-3a48e19bd227", "comment": "Malware payload", "value": "bf09ff77f7058f0105ebc3c6ff5f51b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107106, "uuid": "7fdeafb3-d6dd-4f20-a66a-73a0113ed4f0", "comment": "Malware payload", "value": "d704cac1031a49406266f8d4c60287f72efdc3738619bd5441afbda6d24831e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107106, "uuid": "b88b7d66-c1ce-4786-8f1b-8fa062839fdb", "comment": "Malware payload", "value": "1d68ae6dbbb1e5e763aef3a38a6a82bdda43b151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786107106, "uuid": "b00a77a4-e8d5-4cc5-985e-34c625cc9f0d", "comment": "Malware payload", "value": "d47d7f525809178cbd0e48847817de77c193c18bdb62d3c5f84fd9e0cc330215702a70a01e25044a373f737d30d72457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107106, "uuid": "f74b0adc-e4b9-4fc9-afca-af7251287afa", "value": "T14833F7213307AAC8A99ADDAC6646C08F752CC2932B7D9DCE1C3F625894937C097947FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107106, "uuid": "23ddc2e6-ac37-4299-ad60-124f688d9c40", "value": "768:lR+3MXGfJfzKkxieAXZ9D1xZY0cAZ366Xu5r4vkRvpJdKEqFLLPRiCdFFdhlZ:K8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786107106, "uuid": "81a369b4-3c39-4bc8-88a0-fa20d9b80305", "value": 52044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786107106, "uuid": "64291ef9-b84c-4d49-b98e-1652abfb9558", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786107106, "uuid": "330398fb-cb5c-4ef2-bd7e-f347a5c05c99", "value": "PAGO_53_034289.001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21afdede-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099540, "uuid": "21667643-6bd7-4cb2-a052-67d4d4474699", "comment": "Malware payload (Mirai)", "value": "79db06d3960015c15727b4eedcbd8678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099540, "uuid": "262a1d06-2e96-48f3-b558-9f94e5808ef2", "comment": "Malware payload (Mirai)", "value": "d7428fc63e0f2170d3e5a420e5ec249c2dfcd95e2c281a070e99405f83b608a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099540, "uuid": "8042006b-8c30-4ad2-b9ef-257f89034566", "comment": "Malware payload (Mirai)", "value": "bc82f52e988bdb519a487e02464c8774a4dff200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099540, "uuid": "778d1748-6492-4b3d-9a0f-74d4c21db638", "comment": "Malware payload (Mirai)", "value": "e24d556fb7c7e4f45a701c8c0315e4d49cba3567583338c20c932406b0682d33421b8195d25b2e83c06b8047d1937ad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099540, "uuid": "13ebfcdc-e15f-4757-8b32-a03a51806d43", "value": "T1EE030A42EA519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099540, "uuid": "d262c2af-905f-475e-821b-7b8b69ac344e", "value": "768:yGnpfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdzR2:yGnpfD+gTFvhM74jMQ0MCiNB2YwDXR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099540, "uuid": "d0f24639-15c2-40fa-9b41-01bcba65123d", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099540, "uuid": "2e1a7e4d-2887-4da3-b3de-61b880dade5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099540, "uuid": "63bf9093-cfb0-4520-bb7f-447f4386f4bc", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.12319.31075.29998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab1ee0-9294-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130314, "uuid": "eeab42b3-98d0-4795-8fca-7132a577c035", "comment": "Malware payload", "value": "5ed743d47d200b821070b23dc49ad46a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130314, "uuid": "682baef1-576e-4d65-a4d0-09b9e012ce73", "comment": "Malware payload", "value": "d74a0a4b26ecf24d69c88fe63fcb9ce0d7b0b359e42f82084beba1b88d9713df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130314, "uuid": "1101a9ad-7306-4c23-be0e-c7b7b3bcf545", "comment": "Malware payload", "value": "92c6753d2bf8d9dd6cf34abdff87db997f8e3097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130314, "uuid": "796ed523-be22-4080-a4eb-aeb02c30c013", "comment": "Malware payload", "value": "0d3facaf2f981ae0fda50e3eb48717248dab11f7b0024283f5f6c3e7b8c730dca09379c3ec38a4ac8f4380d3215c2291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130314, "uuid": "98c2eedd-e5a4-479d-a5cc-53428503fb98", "value": "T13B030A42E9519B09C6D232BEFB8E414E37176F78E7ED32359A306FE013825E70939525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130314, "uuid": "a39d9da4-a4c2-4989-a0bf-d4cf27ab8748", "value": "768:yGnDfD+gTFvggM749NLD1m3AJWMP/SiNBhYYwD9yaVdzo2:yGnDfD+gTFvhM74jMQ0MCiNB2YwDXo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130314, "uuid": "c8f47d3e-5ec0-4b3e-a423-a2d55ef7077c", "value": 40792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130314, "uuid": "34ae2074-cde0-4dd7-87e3-476b3ca7194a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130314, "uuid": "5c193144-8d50-4e1e-a78a-2e34e051aa39", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aac594-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137882, "uuid": "fc01ce15-5253-4a19-8b06-d4ea5966784a", "comment": "Malware payload", "value": "a9858aa6ef071b542b3d9727009c108d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137882, "uuid": "e5705c5a-8eae-40bc-ad64-3f9a8052e5d2", "comment": "Malware payload", "value": "d81610a8d26388e9a4b446d5740984990f9ecaae2af7bb3576e02864c4f522cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137882, "uuid": "1cc83ef3-a362-4404-b9f3-a5ed1f38087b", "comment": "Malware payload", "value": "e58ae2e4ff3d37ab4ee7568f38ae7f20cba13714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137882, "uuid": "78e6b728-19b5-4666-ae10-529d302cd307", "comment": "Malware payload", "value": "a1e883b38d897da59518cf1cbea20d80faa47568ac0ce282fd7d78e007b34ed0dbcea133088602e3aec3f5573be1b150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137882, "uuid": "925a12e8-28c3-4260-b7fc-49f9e3c8bb7b", "value": "T1DE138C41762EBFDFE0259A3AC116855A7F34AEF0B1839632F1937C22923F1631E5E905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137882, "uuid": "5442c5fc-6248-4d57-9bca-7395caaca980", "value": "768:xHE0kgFa4oDM5xX+6EZfPYQlz1Of387ckETQOne4TOCrZKvyKp:xsgmDp6EdB4fh7rZK6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137882, "uuid": "6b78d45a-e4b7-473f-9c4e-5b8002a6accc", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137882, "uuid": "9b8bf4c3-1085-4a3c-8d34-9da5b9ed3427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137882, "uuid": "1f78d0c3-48d4-4d20-bd70-d53004eece76", "value": "main.m68k-68xxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68deeebe-9278-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1786118127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118127, "uuid": "3e54ed27-409b-44d3-af7a-c840d9394e77", "comment": "Malware payload (PureRAT)", "value": "52986c188bb52d99b07384a20d73289e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118127, "uuid": "db02497f-41d2-444b-a7ae-90be70cbdb70", "comment": "Malware payload (PureRAT)", "value": "d82fd1f36b81436d7fd9096cec50e2d08dbe148680ff1281e59b10d0fe806448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118127, "uuid": "aac55cb3-1fa4-44cd-acd9-ee62a481f042", "comment": "Malware payload (PureRAT)", "value": "d5738f928da3c4feede8a2f510a792a1bb306e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118127, "uuid": "fe189598-6541-4059-bad7-67482a486c3b", "comment": "Malware payload (PureRAT)", "value": "f651a6a1d13badb1fc933c655d926734e932c77d57605bc4f17712293ae95ab8c49f0becfde08f85000b158f6bc0382d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118127, "uuid": "50899fb7-96b2-472c-ac97-4778b0212a92", "value": "T1B235BF16A6EA02F8E17BD17D8B934901F576780207715BEF07E105A71F27AE18E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118127, "uuid": "9b959aca-26c9-4587-b120-af4b34552c1d", "value": "71011aa64b39df4a97645d77cc629bc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118127, "uuid": "57fd1d04-e091-46fd-9456-168de17b47c2", "value": "24576:pVgOX/lmCPBtax7MEASeoKguO6n7EtkumiEko4U:pVLQCPC5MV9odufkkTiEko4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118127, "uuid": "facfb336-9f38-4b26-812e-30c7d4d853d6", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118127, "uuid": "e0037e57-ab57-4278-bc01-b004c7bc858d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118127, "uuid": "a63b3e39-5ade-4e8b-9692-bf7ebcb0c3f2", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u7b80\u4f53\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22923ea8-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786099541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099541, "uuid": "f25f8217-9b59-4c0d-a7e3-c1486b042f25", "comment": "Malware payload (Mirai)", "value": "bfec0ccc941de25113e5e51b99b11543", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099541, "uuid": "0892090b-b950-438c-bf73-4c98feeaf11c", "comment": "Malware payload (Mirai)", "value": "db6f644a02746e20c456abd05044137e70b4b482f18f35c536bd449f93aaecd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099541, "uuid": "e1538412-9cd1-4e3a-8c35-eada1a905fb3", "comment": "Malware payload (Mirai)", "value": "3547328602c0a4bef5e8ad0d209255d10860484c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099541, "uuid": "12b834c0-1376-448e-8dc4-f3a867fbf0f4", "comment": "Malware payload (Mirai)", "value": "8d8706108782d079444886d3f6f7f564033fa71204779327a41927fad0aa850cd32e77923b01ce77a6902c3ce5d387b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099541, "uuid": "8278bc5e-f324-4313-b29d-8073f29a58b6", "value": "T12A230998F8449B39CBD475FAF50E43DD33020FA8E2E671118E219A313BB79194A3B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099541, "uuid": "d16e72c9-9298-4891-8d0c-ddce4632528f", "value": "768:e16aUO1K+wRsvX3lsWK0kSf+9iGUAl3pZtV96c0YSWfwRJAVLxiyrEx:e16aUp+qsvXVsVfSfaiZe3pPVH07ReVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099541, "uuid": "0de8c8bf-062c-409d-af10-c06fa39266eb", "value": 45956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099541, "uuid": "a5f594d2-6c61-4a05-a0a2-524bad29b0ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099541, "uuid": "4a68d9b4-8960-495b-9797-138e6aa47d00", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487439.10617.5039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264d98a2-9295-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786130471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130471, "uuid": "6d183fb6-42d9-4fcc-ab68-8b416f78717d", "comment": "Malware payload", "value": "917d572e7e89670bc817a44dd2c47fa5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130471, "uuid": "b7f757b0-af8a-4c59-8899-5c07e03d83e9", "comment": "Malware payload", "value": "dbe3826e93f98c1212ccd30e6d1ff4febc180d0c50dbbdc3a369df4bd15afef4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130471, "uuid": "f4305d86-0ca5-4f3d-ba12-16057e369dcc", "comment": "Malware payload", "value": "5b043a41991c34c0c67040a7125dd3dad210c0a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130471, "uuid": "964613ca-3df5-481c-8e26-2943b1c9eb24", "comment": "Malware payload", "value": "b3ab2c42c0da7d9ea3f5376184ad588d6125d381260e78eda5497d9f31ddf67899fefd9c670f37f313b20dd26d6de4b1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130471, "uuid": "e2bf12ff-6fca-4317-90ca-a667fb065a34", "value": "T1EA1171D9A8D64C322F095C2774195CC7B681093F04F52DD5B35DA9236E0C6E9617AB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130471, "uuid": "03142645-a976-4c71-bf3d-772f0f566d6d", "value": "24:n8tD9jWijWr5jW2Fr7jN/F5haHifMDsxVexjJjCmYDYXmYRYdUQljfYK:8d9jpjY5jPnjN/zACfMDqeN1BGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130471, "uuid": "b1904e9f-583e-406a-9ef6-d19de574fa8c", "value": 922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130471, "uuid": "b47bb5ff-e80a-4594-9b67-8cd9140583b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130471, "uuid": "af5c016f-e5bd-482f-a222-b2054c4178ab", "value": "sensi_av.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803b4bc3-9283-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786122891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122891, "uuid": "bc65cf0a-78f2-48f4-bed6-25b4ae4e0ec4", "comment": "Malware payload", "value": "d5cf90d75595ae54fad924f7ea2861dc", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122891, "uuid": "b46a7a00-34e7-469a-a536-780fe4d6a072", "comment": "Malware payload", "value": "dc1e2425521c3ff8344ea04a2294730e8ddda29da11b809421b85c896a693cad", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122891, "uuid": "781c1ce5-b75d-4201-b3e5-1b0b8be52a0d", "comment": "Malware payload", "value": "365ee4d8c9c3b3b10f07b41b316a745452e8e00b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786122891, "uuid": "f5521dcc-294f-4792-83e7-5938314f7239", "comment": "Malware payload", "value": "efa735982258e34235b133313ef41610d429dc50f4b845f23b679acf7e125c538f18f6fa764cf8cda75f01bb856b8608", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122891, "uuid": "42d6ffa6-8cb3-45ad-bfec-e3a4e61ac958", "value": "T162066C03BC9248F6C1A9A73188B746527B61BC095B3233D72EA0BBB82F727C15D76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122891, "uuid": "278b8d8d-3b4f-4025-934f-dc57602899e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122891, "uuid": "3f7f359a-1f1d-4bd6-9df0-a14c4f8d3f3c", "value": "98304:FbVUbOQtsOhRksfdUM/Gytzve2lT2Tta4S1Q2KIt5wFj6Mhvb8TcZr34+ViJMFL:F54+QJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786122891, "uuid": "bdf36fef-3192-469b-aca3-1fe2be511fbc", "value": 3697024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786122891, "uuid": "febf8532-46fd-4c1b-bafb-dcf7c9509722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786122891, "uuid": "8c164796-761c-4f8f-a282-55e93b4d7b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2709091-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097662, "uuid": "5a6e0b8e-c708-4e7f-8a96-fe7e8e0afce0", "comment": "Malware payload (Formbook)", "value": "b38fe6a14563a55aade04cdcb030b754", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097662, "uuid": "b6b037aa-85aa-4702-85fe-47717de96fb8", "comment": "Malware payload (Formbook)", "value": "dc23b3336cba53708db89ce82d09a3efc0b7857a6acad17689091aaa18da4f31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097662, "uuid": "87002517-71e2-49ae-a350-ca41bac2cde6", "comment": "Malware payload (Formbook)", "value": "ed6de5a6d0ac5aabda7b924e4471feb786ac816f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097662, "uuid": "916488f2-13b5-4823-9830-2568fcb1e40a", "comment": "Malware payload (Formbook)", "value": "cb7178ad699c82497535f08a8e2f0406941da68633906b973e4f30a720be5bdb5336a5a304a408617aaa0b04538a8e0a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097662, "uuid": "f9f70596-9a8d-4114-bf14-4a5ac4c11362", "value": "T1072527910E1C58AE7B9E17346A6DF18813E093C6EAA329D8B11ED0B12F34F5F65146FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097662, "uuid": "c75fb031-9e05-48aa-90b7-5ddfa2163932", "value": "12288:M5SuiG63PhJd61vKmw8JBP6OGxc8UXwSDLN8obro:juiG6Z+BCd8zDJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097662, "uuid": "765cfd28-b38d-4f59-a0c1-47239bf45900", "value": 988439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097662, "uuid": "408d7f42-edad-44c2-9ef1-d5f1cdf5d745", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097662, "uuid": "ab659439-d1d8-4a3d-b2ff-1a1eee32cf88", "value": "MV.SEA_GLORY_APPOINTMENT_LETTER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515d0a4e-92aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786139563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139563, "uuid": "515889b2-ec31-43ab-8433-b072f9d8a434", "comment": "Malware payload", "value": "58a519430128d0e52fc10b3bc7fdb717", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139563, "uuid": "57761134-5f71-4205-93e0-03104a8329a3", "comment": "Malware payload", "value": "ddf8b517a8fed544e1adac815a5d85d4c917717449dd52d1354c03f599f05779", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139563, "uuid": "01e3ec16-da1f-4aaa-972d-25e55f599069", "comment": "Malware payload", "value": "a4933d27e1f7f7331a3a0ab54d6b53339a412777", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786139563, "uuid": "d03a4bf9-8381-4189-acb2-c419ff5a9322", "comment": "Malware payload", "value": "ef450c2708cb1671d77ae13e6efdac2dabffe732b9c15dfeea72f93f9c1eb79afcd6df05931d98177c4e3ad9739ec9f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139563, "uuid": "20a25572-5171-41d8-9caf-f78e5d3e82b1", "value": "T16A068C03AC9249F5C0A9B731C8B7425277A5BC489B3237D72EA1BAB82F327C15E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139563, "uuid": "ed84561f-bcec-4c9f-bf2c-32f8e2c9ef67", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139563, "uuid": "9005dc2a-dcc1-464b-8b8b-da0ce35c3de5", "value": "98304:qbOjLYrCy3QaujOhsqgm9ivYauj9wRp78l5wR1M0Hi1lrD0/BmKVsMVhmYR/A:qFGmYRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786139563, "uuid": "98e4c076-68fc-4ec3-bf91-5bf9bd389b73", "value": 3715464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786139563, "uuid": "c743776d-6a47-4b81-83b2-4d8ff1e2497e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786139563, "uuid": "fbcbb282-a2d4-44b1-aa11-6370761cfd73", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a947013-923b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786091958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091958, "uuid": "df69c366-9960-4b7d-9310-ff1e413a0b1c", "comment": "Malware payload", "value": "39e5eea063bb7e951d23b2aef9decd73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091958, "uuid": "234911e3-c4b1-4613-a280-4ba82ee55839", "comment": "Malware payload", "value": "dff9ab23aa2ec30cb126f90448e995eb36403dee572b20ee930ad35203aef7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091958, "uuid": "c32aa9d6-15c7-4421-b51c-b78cf47fa6af", "comment": "Malware payload", "value": "44112cc7b87815d20d461ac761cc1c4f337b4663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786091958, "uuid": "7540abe4-b941-4a33-9611-cf5b86f301b0", "comment": "Malware payload", "value": "38f5ea9a4ca065a39b3d3ede8bd071cb39a8494c127b3c47ddfe999d5cd19807a4d8163af4fd59e708965a6e98111812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091958, "uuid": "5ea94972-09ed-47f2-9ec3-765faee9c994", "value": "T174D5238AB9F61971C833C7B18F93F0BE712D7BA147624DAB7ACC58009E12509AC76735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091958, "uuid": "f49f6959-1f1f-44ab-9be1-7003607a4227", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091958, "uuid": "71c9c112-9ce3-4ddf-8d34-461e56622795", "value": "49152:gjKx0y43jlmBIYJsEuoSv6hav9eCSdJoihcrxzCdTtw1GCo/z520E+PXyRcfe0:kKx07TlmBh+PofaYd3A2JsDo/z52ok0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786091958, "uuid": "d5ac475d-ba82-4372-9798-75939dacd565", "value": 2968064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786091958, "uuid": "cbf969b6-983e-4da5-8d1c-62eb60d8777b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786091958, "uuid": "25887c1e-232d-495b-a15b-534800324136", "value": "dff9ab23aa2ec30cb126f90448e995eb36403dee572b20ee930ad35203aef7bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56ba52e-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097640, "uuid": "5c055575-10ba-4eb8-93d6-4b8565705426", "comment": "Malware payload", "value": "6486332172722049c2519466cad3095e", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097640, "uuid": "4671fd7f-cc66-4a70-9316-fc8dc5a3fca0", "comment": "Malware payload", "value": "e093c583be5fafa6bc43ec5e1307cbd3c36587939bc08fb1185bad2e3796f8c4", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097640, "uuid": "71e72145-21b6-4e8f-bba8-d0a126c45413", "comment": "Malware payload", "value": "b552716d3ae9a3cbd03b73c4e0006077fb3dee44", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097640, "uuid": "4e3d2ae9-d210-417f-9237-fb54d4ed541c", "comment": "Malware payload", "value": "7c57b983ec5bb67f870a1e0a35186cab595590fb82ddcbf9054ff25b718c72756181cf897a33a22822097506eaf5a945", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097640, "uuid": "a4745b7f-37fa-450c-9dcf-049c893ab275", "value": "T14A574B7857C01BC6E70947714D80F814F60DB21BE7D68B82C226C7A2DA593CBE5A7CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097640, "uuid": "d047f5bc-189f-49b5-a78f-df7cfee6d13a", "value": "3072:7erqv+BUuhRQrBC3W1R3KARRIYdCcbVGoTjAucMqAmi/3KY/37/umGmTzAx2yFiM:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097640, "uuid": "406c68ae-b6c0-45eb-a989-8ae0dbe9d7c8", "value": 27551810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097640, "uuid": "54b524e4-c906-41d1-86bd-7029be8759d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097640, "uuid": "e8da5614-c801-4b6a-b826-f04057185d47", "value": "FedEx AWB_Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba839170-9247-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786097219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097219, "uuid": "a8e57df8-aee0-4999-a6d7-bbb8fa77ddba", "comment": "Malware payload (RemcosRAT)", "value": "57ff8beb5322f25307b928a159d36de0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097219, "uuid": "f4d1fddc-f67e-4232-9bf3-313ad1372208", "comment": "Malware payload (RemcosRAT)", "value": "e0be2a0f23433c826792d9d5ffd14d0167c13924b1ce87cc57806bd61734a25e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097219, "uuid": "2dec8895-ea4b-41e4-8f40-0172c1c6d0bf", "comment": "Malware payload (RemcosRAT)", "value": "eb8e887eb8e3f99cbe192c0e5e8ba505c98df1b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097219, "uuid": "3ff3080a-611f-4ef8-a47f-f64e7d9e052d", "comment": "Malware payload (RemcosRAT)", "value": "96fc0fd418ee1ea7855d6d3c5ba556baaa008a6a46fc5168a96a2edfd1a61e2e8926f29b25c95e2a0c99b903eb239560", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097219, "uuid": "c60392a7-7265-419a-901a-9eaddf102a11", "value": "T1AC259F2B407B40A857C0551E2C49774EE282E815D98B754A38CFD66FFCB4A7E09D2EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097219, "uuid": "8c5b67f5-1958-4386-9dea-31a00b287c7d", "value": "12288:cjxMZQk/bX2io9zRjGjPLkU8rnHBshvCf95FzXA6vWiLR57dC+M6fCYKc1kR+atI:Cx2QAoOLkgA9XnLdx8wbzYhxV3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097219, "uuid": "309c0eaf-c328-4bac-af22-d7c484a68705", "value": 1012237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097219, "uuid": "59ca7235-15e1-403f-859c-b020543fb65a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097219, "uuid": "c8be0ed9-6c7e-4406-9654-47150cbe1dbc", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4eca2b-929c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786133598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133598, "uuid": "f8003446-4dc7-4b9c-8f35-8c677c2d523e", "comment": "Malware payload", "value": "96c62dff8336e957434a3277f45b6d16", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133598, "uuid": "d3cef5e6-1b70-40aa-9746-2ef75e5aca82", "comment": "Malware payload", "value": "e10e3cb9d4a4cdb0733eb120a7500996e854b01466d7a42b99414598324f8084", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133598, "uuid": "fde607c4-b971-47f9-9556-30089cd2152a", "comment": "Malware payload", "value": "5bc7e23a41af4d7df9456448e4263f2216235ab4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786133598, "uuid": "a93d7b7a-f759-4ea7-9d2e-5da562969c14", "comment": "Malware payload", "value": "49faff344bb83d5a3f383c005249fa026463299c8144b06dd7e6ed49e70c2deae24465e0202b4e34b05763e6c54f4da0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133598, "uuid": "ed502797-68b4-4d16-9a9d-8ddc0d396c9f", "value": "T120C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133598, "uuid": "f4696e82-5e2a-458b-9f1a-84b7ba22ff76", "value": "768:48vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:48l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786133598, "uuid": "784c7e3c-af0c-4487-8072-3dc691f8079d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786133598, "uuid": "7e4f0e8a-9906-403e-a10c-93ac247b2756", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786133598, "uuid": "4fd1102c-d99a-44f6-b64b-6b182f058f30", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae480ed-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786097783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097783, "uuid": "2385260d-06d6-4388-b66e-283a4e8b0c96", "comment": "Malware payload (AgentTesla)", "value": "64491953187a24e53fec6871be3e5e46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097783, "uuid": "5aae7538-1977-44d6-b0c9-590ccb1daea0", "comment": "Malware payload (AgentTesla)", "value": "e177832273e9347afe9af00a28c4c53a092bb8e86f34b452b363018ac9500969", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097783, "uuid": "36a8524b-4b4e-4076-b577-38c9270897cf", "comment": "Malware payload (AgentTesla)", "value": "b2d527656c62685a5f1325b9f0594be3cfcf31ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097783, "uuid": "b352bd2e-2ec9-4b8d-9c81-297a867fd5aa", "comment": "Malware payload (AgentTesla)", "value": "5ec199e55d918fc8a942e8bb9fb8c3ff4d93094d1f84722bbb1e5ac9dc95f59e6aa1d1ba87614b17e54a4aa55ae78af4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097783, "uuid": "2b08fab6-7793-4c2c-a641-1cfe41a69298", "value": "T15625FDDB9FB5D69906297D6EC87CBE9D248BCD9000D0AA5BFDB88147F30E64502C4B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097783, "uuid": "8f4426fb-ebd5-4a19-9b5b-cdf042c96dd3", "value": "12288:hcBYx96k1rPAPKSAEqn6KloLGtUnYX0CsJpkus24hu7Z8ogGgU3yBiCMyJ8y4QSj:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097783, "uuid": "c2ee2fc5-37ff-4332-bc73-dd0b73e1a19d", "value": 1037321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097783, "uuid": "fc887f26-3c14-4cdd-bfcd-f35066abf6d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097783, "uuid": "a2369af2-c21d-435b-9408-2bd9096f7094", "value": "Quotation_Requirement.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4af36a-92a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786137358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137358, "uuid": "1c900308-c8c5-4df9-88b6-20a7eec31384", "comment": "Malware payload (WannaCry)", "value": "f0d062c4f07188525d9b14c975e871ed", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137358, "uuid": "3deb6621-9355-4e7c-82da-829c8a31794e", "comment": "Malware payload (WannaCry)", "value": "e1ee2b7aeeb62f063134d78df6e522afde0952eca1701fb8d0835abe18ef16bc", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137358, "uuid": "ccc8eed5-bbc3-43da-bbe2-27bc723a27af", "comment": "Malware payload (WannaCry)", "value": "8616383a669c0d3ba743bc9f122954257fb28bd9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137358, "uuid": "d5ef12e4-0549-4cf0-89b6-5a1ee10d38af", "comment": "Malware payload (WannaCry)", "value": "df3e480cad1a4c5c4ac107b3073ae6214bfbecef20ef15b96d0d39e1600b359a8c3b371c09f5890b3f385719a1b4568a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137358, "uuid": "03434190-fe01-436d-b7c7-8a5f93f7fdf5", "value": "T16536238A31B881FCD1072AB584B78E16F3B37C5E22F95B0F9B40457A1E13755BB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137358, "uuid": "3b483bed-6d6d-400b-9dd6-c3bbafa732e1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137358, "uuid": "e6957621-694b-4692-967c-64a76019a1d2", "value": "49152:jnsntqMSPbcBVQej/1INRx+TSqTFQo6SAAR:DMtqPoBhz1aRxcSUF36SAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137358, "uuid": "61a2b8e9-cce3-4e87-b10b-fdbb28e32d90", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137358, "uuid": "16906197-ea32-4f2e-b229-282580429f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137358, "uuid": "7a00e58f-a460-4a4c-bea2-71284e5962df", "value": "e1ee2b7aeeb62f063134d78df6e522afde0952eca1701fb8d0835abe18ef16bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866a3070-92ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786141370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786141370, "uuid": "71a23853-4ad8-4572-ac88-04c47d67e040", "comment": "Malware payload (RemusStealer)", "value": "a216558b0c9403010e3682e37bad4b0c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786141370, "uuid": "66c1ad05-b051-4e86-85d1-94c918656f2f", "comment": "Malware payload (RemusStealer)", "value": "e234be44eeafaf0250d9ef2cef198e223264e1541cff78d30a98163c5a7dde67", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786141370, "uuid": "8dc8e7ce-7525-473c-95b8-291bbb91ec88", "comment": "Malware payload (RemusStealer)", "value": "50e9dd0c02bc1927862be248b90d3d9bdb0fcc86", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786141370, "uuid": "ff4d8280-2a64-4e44-83be-2997027cb328", "comment": "Malware payload (RemusStealer)", "value": "efcaa3c30fb64498aaebb8f70a8012dacb9e765d961cea0cf542ba76171dc01f1656242889942c64fdc56a37c3abf889", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786141370, "uuid": "f01bda7b-5049-40f2-b718-b4a9c734d3fd", "value": "T19F1663383CFB502DE073FF716EE8B99ADD9F7633660A645A204503478A12E81EE5253D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786141370, "uuid": "d8d6c103-c7c1-4196-a6c0-ed099b7552be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786141370, "uuid": "2a8df372-742c-41ca-b5a1-56eca9d1fb2e", "value": "49152:51d2YWDAZF5tcUoB9D6tzcCyYWCjKHfpmpWAMvZ8jmaL/qRvBQq6:gYF5tcUK6tzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786141370, "uuid": "d545a775-c5ef-427b-8aed-218e907d43a0", "value": 4378112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786141370, "uuid": "33565ce7-3e78-4f97-8968-bee77b9483e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786141370, "uuid": "83e22d52-0085-41c5-b69d-da77872ca0a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8b3281-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786097840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097840, "uuid": "be8e0168-293d-44e9-97ca-b106fe5545ee", "comment": "Malware payload (LxBaseRAT)", "value": "165e37b1c96d9d3124f420ff6e64384c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097840, "uuid": "e040ebe3-54f8-4657-b4e7-485f4f3ad717", "comment": "Malware payload (LxBaseRAT)", "value": "e2f9eeae126236bb235433322d5bccdfd605ec08607c8b367fb63da3aec7fa0d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097840, "uuid": "5327382c-ef72-4ec6-badb-a59e2d6f405e", "comment": "Malware payload (LxBaseRAT)", "value": "be16f8fa15119176f247c68121fd841a064058fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097840, "uuid": "9b4f8c2b-7efd-42ea-8adf-fe1f0879d4c7", "comment": "Malware payload (LxBaseRAT)", "value": "bba9eacd136249dfd08727b91f70a398b86ab94fc5da6526b7848084f0bb56b53adf395958df721fc1cca92a9382536a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097840, "uuid": "2afe6fc2-ac2c-4e88-b670-386783c3863c", "value": "T1C3F49F081391DE5A0C9A73EB076D05E13EFCD80C8B5286C0B989FB6B9FC4A25D69D1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097840, "uuid": "aee7aab1-8b5a-4a67-a7bf-8613e10f3d19", "value": "24576:TAIKdDeaHgUTLLYc6M0VZfCQdtmLyR19Z:8PdD3PWrdqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097840, "uuid": "6f55f214-7919-4f26-ad25-abd276088028", "value": 791567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097840, "uuid": "cd5c34ef-7c8d-44ff-bd82-78373e26f102", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097840, "uuid": "f25c4a15-d57b-4950-8aeb-f6e332769ba7", "value": "\u0110\u1eb6T H\u00c0NG _GI\u00c1 M\u1edaI_..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49c16b8-929e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786134683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134683, "uuid": "b6dd9602-064e-4e5e-9465-c1c59bd5022a", "comment": "Malware payload", "value": "1f4782a82256b175fc934e581e477c12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134683, "uuid": "2db3828b-0f4c-4dce-906d-07cb5d860c85", "comment": "Malware payload", "value": "e3a3ea4778ea5d97a92d3ec0924cfae0f21163ca492d1fa776fe065867c9e5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134683, "uuid": "7f30cc4e-f801-4f4d-92b1-3e970e61f189", "comment": "Malware payload", "value": "fce12783edbbcff005367f40847013eec471e012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786134683, "uuid": "25bb0469-2d08-4cb5-a718-406d868302ec", "comment": "Malware payload", "value": "59bbe16c6ff5b874bc31cbce01c52484bdc0d1fa56344f1b36dff3f5a885a0cda4f084f179e6dc8c99b84b73adb4a836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134683, "uuid": "f36aaab0-d3e9-4c9c-a075-f01fbe67b232", "value": "T1B8C2B603A643C472D50321B152F2DF625930F87FAA268546E77DAFF1EA6A0C0925377E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134683, "uuid": "cff6ba51-5959-4635-991e-85f6d4b3d4e5", "value": "384:ffD3O/nElk0q4PUuiKDTgCPgQP9oug8/HanjPBlUQiTmN4ZfUB:HDInElkP4oKDTdIKT+FlFXYfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786134683, "uuid": "dc724c35-2494-4d82-a7a9-f76d1dd06ec9", "value": 28072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786134683, "uuid": "fcf958d6-19a4-4441-b22e-98f54fe1ff53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786134683, "uuid": "9a514d2e-f538-4817-ab69-845669516607", "value": "main.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30588a7c-920c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786071647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786071647, "uuid": "19ab1b79-72e7-4a73-bb68-2eb34ba98e62", "comment": "Malware payload", "value": "7cc12f501c6f17f55b17053ac177b9b5", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786071647, "uuid": "928ce314-4e10-4186-9b3d-c2543ad305e2", "comment": "Malware payload", "value": "e3e213066272b32a6b4aeaed3f12eebb814cdd3047605d1381a1972ed0809134", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786071647, "uuid": "099cd6d2-3124-4a10-ad10-89ce04aa7045", "comment": "Malware payload", "value": "84171c04ba6810d3f77cdc0c4ab597894ded1892", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786071647, "uuid": "bd7877c2-a03c-4023-963b-345770d32c94", "comment": "Malware payload", "value": "70577e7495bcec483ac64fd360a992f761ee118c3a3f4f7a704f631aaed3fb87a0cccb98f3eb63cd6b89168272bb2119", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786071647, "uuid": "a29caca0-aa32-4877-9cd1-7ffb78f84a16", "value": "T12D166C07ACA148F5C0E6A73188B75292B775B8085B3533DB2EA0AFB82F763C15E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786071647, "uuid": "13e6a1a1-06c7-45d9-a066-55e1bc719208", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786071647, "uuid": "e9347b3b-6ddf-4aa2-9b4e-8cf72793bbf6", "value": "49152:SOJrS/7bIsrTDXYD+7LN+jxhrBQe1TW72JGLZ6xeqR:SUyvXa+HN2JBTYAGFiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786071647, "uuid": "86293c10-b32e-4193-9ba6-b49ed6ca8626", "value": 4138344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786071647, "uuid": "b7b33cd1-5f79-419c-a746-654e081c3779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786071647, "uuid": "bebe89ae-906c-45c8-8508-31f89e259357", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f24f8f5-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137895, "uuid": "7b05a83a-89ad-42e3-9bde-8c09d9655f6b", "comment": "Malware payload", "value": "ecb4a5fbd760d74b4cff1b17c42a2a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137895, "uuid": "f67879b0-dbed-4eec-abdf-6bc964155a94", "comment": "Malware payload", "value": "e52f270af5de9c0561b1c6572a2debed721b5c655a4b0589fc4de31ab21eeeac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137895, "uuid": "d40f0465-32df-40e8-9d65-9c5c657b636c", "comment": "Malware payload", "value": "2c8c1ece6384bceccc74bc6284183a47560e9c23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137895, "uuid": "c8b6c3de-3c89-4760-a70c-aaee31ec08b0", "comment": "Malware payload", "value": "b95e7995f7535e132fc9df2671a32528309b13cb927e9842e0d94fb82cc0352f9001246464a61fdac3c1214c0a1b5106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137895, "uuid": "d35d0457-3b5a-4d2b-a9ea-62f8436ebef5", "value": "T1AF23C51BB6A3B07CC24BD0B45A9AC5F1B93178B402213D3FA3C9FA312D35D516A59E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137895, "uuid": "b5107115-0e4c-48c6-8cf9-15d8315557b6", "value": "768:koXxzHpMepJ85Z1f+57AJh01aoNowMTCJwGXQ3pTiTTljiJ:RxzHqeQxkAJhgamJwGXQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137895, "uuid": "fe29e841-c471-4f2c-aff5-dd2e9a822888", "value": 46152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137895, "uuid": "9a35fb62-96b6-43c0-9c7f-492aebcf7e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137895, "uuid": "c24ce022-e2df-4407-ab58-835bdc7f4ebf", "value": "main.x86-64-v2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341c09ee-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786097852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097852, "uuid": "1db8fba2-08e2-493f-aacd-c676ad648d05", "comment": "Malware payload (AsyncRAT)", "value": "6c5941e95e3aad06ad968853b343c5a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097852, "uuid": "d3a64c2e-f51e-440d-92d1-c7ca62db6eaa", "comment": "Malware payload (AsyncRAT)", "value": "e595ec10457cdf21163ff26541ba26fecc8988321c747b02c42b58cdc3f6b556", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097852, "uuid": "67bd7317-e34a-42f8-84e0-a6a9055ac776", "comment": "Malware payload (AsyncRAT)", "value": "d1021c9319576455657a8c5cb5d4b316f8f73768", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097852, "uuid": "f67cfe59-da2a-41e0-81b1-38241822d96b", "comment": "Malware payload (AsyncRAT)", "value": "4e60f9f171dc945032f7c07a7de0af0394a2194a98db12276e49a652335b5418b60facc7114a5d8d0243d240b587c348", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097852, "uuid": "a052053e-3999-40db-9d3e-4d3d43fe6091", "value": "T10435E7E1778E64891A053B26E40E59568F29C4210743BD9578EF1EC84B2F89FE9C1CBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097852, "uuid": "fddf2266-a950-4d7d-9b0d-b4d65c060f9b", "value": "12288:3k2xZET//THHk7mzrlnjaPE67EYsw+eLOBIwj:3mLkIrlj+X7uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097852, "uuid": "26e2c136-0ccf-4405-9c7d-8407055ecbf7", "value": 1115363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097852, "uuid": "2b5e9294-ee21-4cbb-9de5-127960101194", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097852, "uuid": "81fb367d-2fcb-49e8-bcb7-01330c6867d2", "value": "startuppaaaa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8005cc19-9291-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786128904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128904, "uuid": "cf0fca24-a7db-48d4-be1e-232fa5c53126", "comment": "Malware payload", "value": "81f1e315539b97a14949b2b84655a107", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128904, "uuid": "22c576cd-cc26-42e9-9d38-dbbb1afa5dcd", "comment": "Malware payload", "value": "e6beb0e7fd1699c0dc2e5155fc8a168f894ded2f3f1da8bd34971238d5b0f404", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128904, "uuid": "fbf2fe6c-17f8-42b5-aaea-aeade34b0362", "comment": "Malware payload", "value": "4a3a0d9b858d50a4aa126d8741c9716f429ad0a0", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786128904, "uuid": "9437ec74-556c-4fae-9cd6-b53fc5d0fa6e", "comment": "Malware payload", "value": "c0e5d53082d68c3c6b8eb0405f86f892092cdcf68e10b008a752a5154c35bd04f88517dfdd03000b61553ca7fab045ee", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128904, "uuid": "7e11a453-8984-4535-b51c-e7b5550c6d9c", "value": "T113D52389F9D33675E436C7FB42D364AEB12A379087B09D5E378967005D229282C3B36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128904, "uuid": "abdae42f-16b4-4888-808e-00f2dd8714e9", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128904, "uuid": "194600a1-807a-4768-ba64-a9ae2e93a8b3", "value": "49152:iibm0I+DuwEjbHCpAide169Uqe52k6lbhNQe1/2owMo1b+QYWnZt+gcNvTdEImE8:Bbm1+Du/b4Zde16ngDQbhY/1b+UZt+gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786128904, "uuid": "31142f67-b1c9-4e3c-a2ca-bad60f979229", "value": 3012096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786128904, "uuid": "b8e62eb4-d437-410a-a36e-d5d10a927605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786128904, "uuid": "bcb819e6-fd14-4a04-839c-6ee092f89840", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3748a726-923c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786092274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092274, "uuid": "a7ae60c1-ac34-4eec-8acf-81c43f1d4cab", "comment": "Malware payload (Mirai)", "value": "bee0866d3ed604e360d85631493fd9e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092274, "uuid": "6d5f7183-a4de-4fe4-a243-521b38955619", "comment": "Malware payload (Mirai)", "value": "e7582e9a1921e105eb46885a85d67db37e3a9eb37bd4c212953ca7d17ddf1eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092274, "uuid": "674935f5-f4e7-4273-b623-432a33060818", "comment": "Malware payload (Mirai)", "value": "32f796ce9aac7061c1da4a3128270fab15b539b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092274, "uuid": "884774bd-f4a8-4f79-a11e-0933d28ff1be", "comment": "Malware payload (Mirai)", "value": "3888cfd801fa3ae1a697d510bd2459b0c9e4890a70681dcbdd6a18a9efbe1e43990e706754da8694eb07ffc8289e9bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092274, "uuid": "94b125e5-9b9c-4976-9692-e2c9b821d101", "value": "T16334398EDF650FEFC4AFCE30461E431715EE999A93E1733A467CCC48B58A20956E3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092274, "uuid": "07a90cb7-e180-4fcb-b97e-506d3d5ca42d", "value": "6144:D0fFFVlwG0L6SFqfjm/ILGvVOez+UN7GwdKt5q+TBM1FpdHqOBn0wJHqPZvqxmD8:cFNSFqfOq46ltUzUMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786092274, "uuid": "132a53ef-83cc-455e-a41a-1a5ea5007f9f", "value": 237108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786092274, "uuid": "86d00557-9655-4650-a639-5bebcf97cce2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092274, "uuid": "53a03318-0df5-451f-8897-5d7904cab91a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd9b967-9220-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786080258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080258, "uuid": "1eba9226-f93a-4a28-ac18-4c5c26cfd5e8", "comment": "Malware payload (Mirai)", "value": "c6e0b4f18dc93e9d2b01874842f5affb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080258, "uuid": "17149d2a-a553-4101-b8e9-fe16b528a7de", "comment": "Malware payload (Mirai)", "value": "e7763421d994358879b052070205b41c1603d17e8d0ce362c47893e438c5fcc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080258, "uuid": "cab33a1c-ca22-496d-88cc-774b7f749a45", "comment": "Malware payload (Mirai)", "value": "30ea4043042ee1f973c5cd40685ab8d090ec9763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786080258, "uuid": "95052754-71f4-409e-867d-37a4e4c3cecb", "comment": "Malware payload (Mirai)", "value": "47a092d4677ad6531004325d9440cac2b82e80a2908aae138fd55bf84bb327dd2da2b6c19c6e743bdc9300cdfe3b93b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080258, "uuid": "2115d431-99c7-4db4-b17d-bbef55cca73c", "value": "T1DE33F1E37E8F6D59C6B02DB7E49D44826A98113422627FD37A2083B4F7E254B3B752C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080258, "uuid": "f33309ad-f477-4d17-abc1-a9806ce1d78e", "value": "1536:89dn9xPYZ21AIiRJVwrnwi9DST7naIdMENWzis+f6n:+v714JenN9DaaIaaWuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786080258, "uuid": "049bfd61-1191-4599-9f05-d39dbf7b0c1e", "value": 55132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786080258, "uuid": "538dd030-28d6-4a9e-80c2-731c94b622b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786080258, "uuid": "aacc29e6-b5ed-4a4f-89c7-8b152ed1fec3", "value": "e7763421d994358879b052070205b41c1603d17e8d0ce362c47893e438c5fcc4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ce2c74-9296-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786130920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130920, "uuid": "9ba5db93-2d49-4576-a81f-7a7c13177c76", "comment": "Malware payload (Mirai)", "value": "09bb26624dbe52268983ce2e142caee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130920, "uuid": "21fbb4b3-f643-4b25-a307-b6d144516e88", "comment": "Malware payload (Mirai)", "value": "e7dc0a0f294912bb34bc2298207b5eedaa531a52ac9da53d659c267952f33c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130920, "uuid": "5d6b5489-d765-40c1-86ac-c26f99ae98f7", "comment": "Malware payload (Mirai)", "value": "7ca00d83c36eba7a113ffc107ca4dece2659d8a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786130920, "uuid": "62ca4901-0ca3-45e0-8e99-f4414cc17ab3", "comment": "Malware payload (Mirai)", "value": "cfce014ae65d7361085744feb15bf0ff395ad9f2c974c68b6c367d5d7a38ca1f33d323612f8a036659f1faa3f5e35d05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130920, "uuid": "d7f0456c-0b0b-4393-99c9-6219417ce4b8", "value": "T176043A5F7710CF61D729C93005B3CB5666E926622AD28889F36CDE04BE74349A82FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130920, "uuid": "75bc1337-1446-428b-9349-7f84552d63cd", "value": "3072:VZ2h15fBN3U2TT5iZKsCAVPoPBT1DfjtWnS:vwxBtU4MZzhVIBpvQnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786130920, "uuid": "4601169c-3e11-4bf7-8506-d3a2f5a611f6", "value": 182120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786130920, "uuid": "896033a3-9820-47be-96ec-403141b0991f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786130920, "uuid": "37f06d44-802f-4c14-92bd-191e60ac4817", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d05392b-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099532, "uuid": "159275ba-07e9-434a-a0b0-c5d7e6e89364", "comment": "Malware payload", "value": "4e2cbb13ccbfcf40f02b087b3e742825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099532, "uuid": "eba52154-f63a-4533-bea5-0a2964c10f81", "comment": "Malware payload", "value": "e874de7032b3645f911a6c1eadb8429b84e61eb0b384411499caa9869ac16d71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099532, "uuid": "bfbca3a3-157e-438a-b1cc-783fabaf3452", "comment": "Malware payload", "value": "5ce9868f5d8e7ca161026a0a3b051f28575549f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099532, "uuid": "8347008e-d34a-4e7f-9176-c28fdf7cb732", "comment": "Malware payload", "value": "7dd182ca2c8d2c413da0a402a7e4bfbca31832369b0f18badcebfd0b76ebcd928f10b0d2abf8746cf947daad818faf44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099532, "uuid": "a3511d7a-ab94-4530-8dc5-c4f0a004a65b", "value": "T13F03F981F286C573C80A953567BAD715374379DB2E72A20098B5EADDFB674C0AEB0433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099532, "uuid": "0ee28fac-ae84-4b51-81ef-f1197ed76865", "value": "768:HAEvNt50ssGL+8770Ut2R5x2rn/w6F3TyD3hK3wf3MIAffP14d5AdSptv63uF:Hdk2rTkpMICadSw6eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099532, "uuid": "e542722d-c3f6-4c32-af4c-51cc7f31eceb", "value": 40328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099532, "uuid": "44eb513b-48d6-4c2a-8e83-1a8b2e50bb0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099532, "uuid": "08114587-feed-4d1f-b52a-34b06c0b8ad9", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487430.12102.7461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030370d9-9200-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786066417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066417, "uuid": "f4f3f99a-ae20-496e-ba5e-b9960d0226fa", "comment": "Malware payload (Mirai)", "value": "e67414131e1073b627cfc84b2e616845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066417, "uuid": "def1bb90-d905-4b01-a6f1-8d1d3e145a0f", "comment": "Malware payload (Mirai)", "value": "e8c0a568e792becdf2986764d2485c797d9af3de4402bd2a5f1064e732a451a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066417, "uuid": "4b33b239-af86-49c6-87f2-a231f4a37431", "comment": "Malware payload (Mirai)", "value": "fdb89a8a38f489d55617b7b0a3d8e4829856ff31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786066417, "uuid": "b9b4e86a-2af7-4235-8907-0499da71fcb3", "comment": "Malware payload (Mirai)", "value": "e0aed32048e0a5d00166fb49328ecd5e85adbbe264dd4de4ab0e1b15f3ab0c2562b038fb076ef97fc33561912bcc4d98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066417, "uuid": "27206486-987d-495a-892a-d33a46c28466", "value": "T13C243A4B77118FA0E379D63006F34BA7ABA9228616D39545E36DDE107F6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066417, "uuid": "65b32eea-5419-4815-8f6c-d321161a6a9e", "value": "3072:wcWRQRKgLXF539VsavywVi5C0Ucms9HEUlQKBxKYZfv3GTkQES9w7IKotjbu:lhIgLVVFzVC49sB/JiyPQEGEIhpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786066417, "uuid": "29b10924-8be0-4d05-97e2-146ed66c6e2b", "value": 224588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786066417, "uuid": "45f44f65-c3c1-4583-b3fc-017c2cb70219", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786066417, "uuid": "d2f2a430-7da1-459f-b226-c217dd25a34c", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6806c4c-9203-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786068060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068060, "uuid": "814e4918-fc99-4cf1-a537-19cf5ae3e17b", "comment": "Malware payload (Mirai)", "value": "3bfa05e5d583e362b5ea1893b54f4166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068060, "uuid": "f06e3006-c2e0-49cf-b430-cc16332716b6", "comment": "Malware payload (Mirai)", "value": "ea607ebe34ee5a06f5ed85805e0cf9175eaeb390fc39cb19bd31a7add8a4edf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068060, "uuid": "37fb11b7-037a-42e9-b625-44542f0e0996", "comment": "Malware payload (Mirai)", "value": "a14409f5a799150184ce27400fcf6ed6699e7647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786068060, "uuid": "cf910d2b-0feb-48ab-810d-ecaeeaaa9142", "comment": "Malware payload (Mirai)", "value": "689eb9e8b8620548c01ef7fe40cd975359d43ceaaad2d3c53660aad9707eb3b9131359046e62c55c9c4d74fa97eaa10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068060, "uuid": "4ca4abe4-901e-4011-8355-3587ec0d8f64", "value": "T14824188ADEA50FDFC46FCE30062E431719EE599B93E4733A457CCC54B68A2494AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068060, "uuid": "cbc42cd9-58ee-4540-a628-800f1cdf76bf", "value": "6144:s7vwfwq/uBbXxFTd7Lji38h5d+ylyuEPvMao07:+vKebXTd3jVTylxo07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786068060, "uuid": "6f3d2608-6b6c-4dee-aadd-7a679e470438", "value": 224588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786068060, "uuid": "3057dd89-1870-469a-a413-7ccf683aee84", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786068060, "uuid": "7edbf9e6-53a9-44ee-ab57-7a2b6a87da38", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b1d2f0-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786081182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081182, "uuid": "6da0287b-bff9-4691-bbf0-ca1f548215c0", "comment": "Malware payload (Mirai)", "value": "d464285a5c227c75e8e5921c8b95f504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081182, "uuid": "ff0e463e-2c6b-4f27-902c-bc786144d0a5", "comment": "Malware payload (Mirai)", "value": "eaae53e0fb54c2e62783d504b660eea6f0405c5bdaf9be50038b13808c3b8fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081182, "uuid": "d6bcfac1-b373-405c-8f0b-b2da72536a8f", "comment": "Malware payload (Mirai)", "value": "29c9dcad407b46b38b47e443ab0918cd29f7a596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081182, "uuid": "dbedd397-8302-43f2-9e3c-2ed0ece06f98", "comment": "Malware payload (Mirai)", "value": "135311c47e35382916ba4f84d01e599f40bfb3731e7d66ec0876736cdbc583a72f5484a77dd7aefa5c5cee40506ab80d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081182, "uuid": "4666a030-5085-4858-b89f-21caba09d1a1", "value": "T156147E00FB181913D1831EB45B3B0766E37DD88348B9F019190E7B564733ABB9AC7B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081182, "uuid": "03bcf0ce-0103-49a7-9361-77305c0a28d3", "value": "6144:9SpM/C9UuMpSY0qiU8xj1jAILiX2Qd0frruNLZ:9szdMuUnwirX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081182, "uuid": "d8cb50e8-ffdd-4733-8c1b-399acdb16533", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081182, "uuid": "5172b05f-4d4f-4b9f-b848-bcc29152bb77", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081182, "uuid": "2c1d6f43-f9e7-45db-9b42-0db897a217d6", "value": "f4a6c3bfcd44c3c0b0f0be490a0c4b2d06783ee672308cb814e7c11c6f090782.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9e4065-9292-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1786129519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129519, "uuid": "c53fd773-b812-4436-997d-26add4d4c2a1", "comment": "Malware payload (DDoSAgent)", "value": "8d93aa9786f6f86cafdf39e087f85aee", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129519, "uuid": "eb2846c3-5ac2-40da-9447-f2aa86a43c48", "comment": "Malware payload (DDoSAgent)", "value": "ebbcfc4e0f8f62a4c232983b35559e0edc04ef13be3981e090bd533366a87bf0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129519, "uuid": "acba2f8a-f6f6-47de-b3f5-147e3aedf68f", "comment": "Malware payload (DDoSAgent)", "value": "dbb17d219f363cdcaaa74aae917eef2221e4b6c1", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786129519, "uuid": "2489353b-cfdc-47c4-b323-caa7da485ed1", "comment": "Malware payload (DDoSAgent)", "value": "f09676a26eb377036693d8db07d4f979013fcf391ac68d259bc959ba755d7fd2356272649b609a79cee8d46ae48eb47a", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129519, "uuid": "02c2e6a0-3875-47d0-bb4a-353ddb1eedc7", "value": "T1D9077B43ECA515E9C5A9D2308A739253BB71BC495B3127D32B90F3382E77BD0A9B9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129519, "uuid": "3d5bb8fd-0b48-4f4e-92eb-56064ac03c83", "value": "98304:jopv876YrwvTRZmbrZlal09s7VDgJyleBB0ovwNxlH9Iq1EYsKViiam5+uPxaaib:jATXRA+lb7OJyw58QTKViq5YhFwTT8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786129519, "uuid": "2a920433-1281-4d42-b517-49deeaefc120", "value": 17236013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786129519, "uuid": "8b14314e-599f-433f-91dd-b297c38b45e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786129519, "uuid": "748319fa-8858-4bd1-83cf-aff68ab7f9a0", "value": "gg10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a0c83b-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786081155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081155, "uuid": "ccb1e1bd-c6a1-4fa8-b683-6079fbbdb5d4", "comment": "Malware payload (Mirai)", "value": "d43ac1b256639170ca4d545e85563e22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081155, "uuid": "d7ba4e1f-3297-45a1-8344-c490de023bba", "comment": "Malware payload (Mirai)", "value": "ecaacd42fe76418179a238d07aaa371fb40fb37f866e133047d19f9693a0cb52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081155, "uuid": "acc600f6-9a72-4acc-af14-eb1176476c81", "comment": "Malware payload (Mirai)", "value": "a9b9a740883e273095b88495a18510d1b59a4b31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081155, "uuid": "3e291861-6240-4c6f-a55f-0aa2092a939f", "comment": "Malware payload (Mirai)", "value": "c8efbd8d6cb60e28d112a0bcf614ad3da0c0b3dfbefe00c86e407213f6bd4474a04645fed7bddb7561a975c3bba3152a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081155, "uuid": "9be97d6a-c2c2-4411-a1c5-049026a070e7", "value": "T1BB8312BEDE265FA5F79283F006330BEDBE7473259E1CEB55471E285309C44780AA2398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081155, "uuid": "6e054dcb-2c82-49c7-824c-b4d6c0c89a80", "value": "1536:Q6tiWlZUu9NcIgHRDP5HQiSxSSRfm8vX+3RJPuYzKIlmXIGyeQQ:Q6hlRuRLSxSSRfJ+3HuYzQXIGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081155, "uuid": "d614e735-9144-4dbd-803c-9496f7a2b1a6", "value": 84128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081155, "uuid": "31897f90-1707-4914-85e0-f112b954a758", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081155, "uuid": "7733f2af-4a6b-4e25-9f52-c195d9536978", "value": "ecaacd42fe76418179a238d07aaa371fb40fb37f866e133047d19f9693a0cb52.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88031644-9299-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786132353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132353, "uuid": "c72cf003-1914-4ff5-81cf-8bc4252f741f", "comment": "Malware payload (LummaStealer)", "value": "68ccd17f80bcc61bec8759b77cb80b24", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132353, "uuid": "7a27a05b-7dbc-4b03-ae02-60dfe139e820", "comment": "Malware payload (LummaStealer)", "value": "ed71b72c1e0d19a627fea10181438779fb02bcfcd67870ce57e363a7c5168e94", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132353, "uuid": "5e8b07a3-3b92-4521-80b2-a4a1889e683d", "comment": "Malware payload (LummaStealer)", "value": "2bc8a0dc10a195172f9ab72e38c4ef38c2aa1d97", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786132353, "uuid": "3cd02ffd-2fe5-4dbc-a0cb-5e9d1cff0213", "comment": "Malware payload (LummaStealer)", "value": "3a1395382c24927c309087dcc1a88b6059df00507241a71b5532fdb2b142197c8c778c8289d54eb2dfaeee827bef7e60", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132353, "uuid": "e51c9568-6842-460b-8378-c116ce9b59cf", "value": "T153165B02FECB84FAE4032E3160E762AF2739BD050F318B57EE543A79EA772515C22655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132353, "uuid": "1fc688b3-309f-434c-a70d-5ae4928d7b63", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132353, "uuid": "7ac96065-579c-4e89-8953-d8cb3fdc9060", "value": "49152:5eCZUR9nHrIiDPQf00yEi3o95Jg1rLbQpW:coUR1HrIiDSi5Y95Jg1rYpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786132353, "uuid": "175e1f57-ad91-4415-af53-862ede61508b", "value": 4081520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786132353, "uuid": "69ba03b4-b3ae-4605-a117-fb8948f96863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786132353, "uuid": "6b0b4b93-ba0a-4453-a110-2f1f86421738", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686ba0f6-92a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786137883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137883, "uuid": "ef4f7a07-24cc-4e35-b98c-2eea34c9ebda", "comment": "Malware payload", "value": "9b62051833870df91f3d755925545820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137883, "uuid": "d70d1bd8-9c04-49fb-8746-695b3efe4b25", "comment": "Malware payload", "value": "edfac2aacde2c5ad263d08023383743db8ceab54659ac5cca9d1d39098000bc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137883, "uuid": "77a156aa-c6cd-4bfe-b2d1-f18efda66904", "comment": "Malware payload", "value": "1585447d8606243699f0e47b792fc668bb8e443c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786137883, "uuid": "4d6b13fd-682f-4648-b51f-859c0c633b06", "comment": "Malware payload", "value": "a0c66c13b8a617abe6b7d80cc84f10029c40a0ef7f52754699dfdfa9b8f371c0d10a1d94bd5a7e1f2143f5e20d3d7bb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137883, "uuid": "ce594e5d-bece-4ac3-bff0-c96924b7a352", "value": "T1CB63E809AF15BA7BC09E4E7445FFC49204D63DBAA2C4833975E47A9DAF3C25902C3698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137883, "uuid": "1f94ccc6-56bc-497a-94a8-29900c40a02d", "value": "768:7797wyVjdEnPzvr+vBX6zPQYvkRTGlmFIpv/dB:7ZBV2r84QeEGlx7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786137883, "uuid": "ce497929-7b91-43c2-b2d3-d4c569933ce3", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786137883, "uuid": "806c6cb7-68c2-4276-9a4a-cdff9c1f28c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786137883, "uuid": "a31b4030-95cd-4bae-9df9-83ce0cb4a346", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfecd5ab-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786097711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097711, "uuid": "b405e873-7941-422a-ac15-488c6d06011a", "comment": "Malware payload (Formbook)", "value": "66c9541633054153763e69b3c6628475", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097711, "uuid": "8097212f-dabb-449b-92b2-efd144b05a0c", "comment": "Malware payload (Formbook)", "value": "ee594fc03a20cd8451dc7414f4b926405b9c85b23141d4f267ea0d6be5645724", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097711, "uuid": "3ea19339-f53f-493a-83d2-0194fcf677fc", "comment": "Malware payload (Formbook)", "value": "7101b423490231456f880c8fae3bae48262c5260", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097711, "uuid": "297775e4-cdd1-4478-b331-48a8de28024c", "comment": "Malware payload (Formbook)", "value": "fad7c4392757e7b978a9a3a65e163e035bfc4fa32289ed16d1eeea5dd9935878e2615b0113307d2ffb998fd80d2e7b56", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097711, "uuid": "4fdb11f7-7482-49b3-9b46-fc73ae2bf692", "value": "T1F2E52BE536FF6A4F1A14BBEA688C25414A8ED50D0D03F0D4F0CF5DF5934F89916A0EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097711, "uuid": "084119d7-a59b-475c-9263-96bd8f9cf038", "value": "24576:MhkeO15oNE1UZHJDNZtsZkcfd7uG6Hh4jJDo6mp05+TYFw0HE:gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097711, "uuid": "e5a27e49-b34e-44d9-829e-627461b747c3", "value": 3184578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097711, "uuid": "cb77e4fe-f696-4333-8356-f8aaa8a421b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097711, "uuid": "b37051d5-684a-407c-9e9a-072e3ffd34ac", "value": "WellsFargo Payment Confirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a89b21-9285-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786123658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786123658, "uuid": "f9590055-0b72-4070-b292-4bc5c8ce89ae", "comment": "Malware payload", "value": "4b36002775ca27159b9b420e2e4a728a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786123658, "uuid": "cbaffd7f-2b94-470c-978a-18bd76960fa5", "comment": "Malware payload", "value": "eeb02dab08c063cca1b4990c057ade23db85e6f6c74d8729936d5d77510d106d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786123658, "uuid": "de34d1a7-1e46-4bc3-8f29-96ebcf1f8b2e", "comment": "Malware payload", "value": "0b6d1e3716bf4df72a8b7dea33eedc088fa0cad0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786123658, "uuid": "bd09117c-1b6f-4a55-954a-965cd8bc6951", "comment": "Malware payload", "value": "030c734bef69326456ca841817fe6771c23f3e0df38b6b5f50012be2e55a2504583c0be4e83c8515bded955bd33eb534", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786123658, "uuid": "9a3b0345-2df6-482f-aa32-dd4c683ac191", "value": "T1F1C27D956A867C44BDC94A3E4CBD2B0D6DF5C3E1324952AC3D8B3C719C11F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786123658, "uuid": "19df3fee-a87f-4fce-ba10-5c596f5581f3", "value": "768:VM8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:VM8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786123658, "uuid": "ec4a8138-e88c-4a78-bfef-112b824f2b37", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786123658, "uuid": "37c639de-54ca-4baf-b7fd-1cabd78306c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786123658, "uuid": "6a754444-d693-4483-9efb-f229626c498b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2372dfc9-924d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786099543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099543, "uuid": "af7edb4f-ea69-4fbe-9d09-fab22f3f3b5b", "comment": "Malware payload", "value": "53de6e53447d67dc278ce42d4b64f534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099543, "uuid": "efbe9ebf-becd-4c56-b328-a16f7083f474", "comment": "Malware payload", "value": "ef3d52f4ed12d54d18531d2c3d7eb61d8f30e89100a380a048d8eb1c4f2c6441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099543, "uuid": "dbf3a58f-4795-42a3-b739-5fa5ea20e7ee", "comment": "Malware payload", "value": "5a83961384967eb8eb23fe38c00877ef341a757e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786099543, "uuid": "f53fb905-b52c-457e-bcf1-30eafb19cc07", "comment": "Malware payload", "value": "3bbec77ef81590d50274a06fcbb139e9756a9498af5c90123e72b2446cf1ea049f36eea48b17368251a89fa85430ed16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099543, "uuid": "a0bc0db2-7c16-43bb-9bb1-90a7f7cee1d3", "value": "T1EFC2B603A643C472D50321B152F2DF625930F87FAA268546E77DAFF1EA6A0C0925377E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099543, "uuid": "032339b5-e144-4118-858d-692b8928e2bb", "value": "384:ffDqO/nElk0q4PUuiKDTgCPgQP9oug8/HanjPBlUQiTmN4ZfUB:HDxnElkP4oKDTdIKT+FlFXYfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786099543, "uuid": "bdd684d2-f870-4ab8-b560-10cb74ea78b9", "value": 28072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786099543, "uuid": "a96ced89-a64c-4915-9b5b-582081840087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786099543, "uuid": "e80b3408-b264-4212-ab57-01fc56b2edad", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.39487435.25975.11602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ceb209-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786097696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097696, "uuid": "1a76942d-70fe-40cc-840d-b6dc2a454907", "comment": "Malware payload (XWorm)", "value": "1c0fb7eaead50f53d12db5fe2eb2c8e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097696, "uuid": "1613ed15-5724-49c0-913a-497bfa1befed", "comment": "Malware payload (XWorm)", "value": "ef69216d58bbdb5e87757a404ab392fb4fb243ce6fdc898bde7344fa9b24e2e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097696, "uuid": "2b65bfa0-d366-45ef-8446-2abf1d45ebe1", "comment": "Malware payload (XWorm)", "value": "573af85b4143131dbbd7942d2fd697fe80c3c886", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097696, "uuid": "b6efd8f0-8ada-40f2-af0e-639253008cce", "comment": "Malware payload (XWorm)", "value": "a92f4dcf69f29e83c2e40cfa4f70f7045a9ef96efb37f6d7ee0c47e486a3f22b688e168d494b7e01b7382b32d35a9f66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097696, "uuid": "20ad603d-19c2-46be-a638-9447c7eb22d8", "value": "T16FB5C6911748E4B27A3D77AEE5379E254A0FE00351C1EF1D342CA6083759E9BA38CDE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097696, "uuid": "2c45e4cc-1f80-4c56-b369-28d38b9989f6", "value": "49152:en0Cz9Ud4OQJtcnwWEKjuJCMJU1K/sNLQPrxM7x6FHTGlXrClsP88nFV1HD9m9op:29QAcNCJUAACry16FzmosP88nFV1HD9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097696, "uuid": "819f3b7c-00aa-433a-9446-180f25a4fcd3", "value": 2288114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097696, "uuid": "86e1f47a-d00e-4827-9de8-3e48c808bdfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097696, "uuid": "134a2160-98a9-4aca-b19a-5a912b5e803c", "value": "Reckless driver Cam8 photos.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b270ce9-923c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786092442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092442, "uuid": "14f283fd-256a-4f45-aa7c-51d5d82d7f5c", "comment": "Malware payload", "value": "529989c75c23447e9db0463f684a1c47", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092442, "uuid": "2044b74d-1251-45d6-a7b5-38052608a7d4", "comment": "Malware payload", "value": "efb06d67ffdd28113cbf7bed214a7b56b0c151c9f04034052f9cc7eedeaf7a71", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092442, "uuid": "47db36d0-2474-4160-b0b2-72cd0a63bf82", "comment": "Malware payload", "value": "40c451f667a2ac477b9b07fddb6c9416760b5078", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092442, "uuid": "a2c19da5-c78d-45d7-9d91-e32e8521ecbc", "comment": "Malware payload", "value": "337aec1b6cc3009e89708db8d33f3a656f29551733c5a6b174b57934e9a3f1005b62b68a73b70147c529883a33699b93", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092442, "uuid": "eed33e11-f3cb-4343-8a29-62647a5f8a9f", "value": "T186D5238DBDF61A30F472C3BA854771BEB058BB848B304C5A77CD27546C52A187C7A27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092442, "uuid": "c7741f33-7814-4bcf-a7b7-be41f5647b03", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092442, "uuid": "26f021e4-97d2-4482-af5e-f05236f0c507", "value": "49152:jISNr32V6rSw81RBoVAbO7sWCxwNK8AiP68PhVi8JlsF6p+EgtavMacJwh6tili3:US9lWabiwb1SYFz+ESavFmwh6tYifgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786092442, "uuid": "a38eabfd-0358-434a-9f42-d934530e0c01", "value": 2952704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786092442, "uuid": "71c1f830-d8bd-47cb-8140-9442c83c066a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092442, "uuid": "37a68d5b-7d90-4f52-b348-8c3f5895f560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058178f6-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786097774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097774, "uuid": "6535c677-26ea-487f-8195-801ac1ada8e1", "comment": "Malware payload (DarkCloud)", "value": "edae02cf337005172fabbb1b47dfcfbe", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097774, "uuid": "6b11f7d7-43f5-40ef-833e-c41918e95a74", "comment": "Malware payload (DarkCloud)", "value": "f0aecd84d2de3ff182a4b75424ef581bfe50a4e43d36827de2b3e90f5ed71182", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097774, "uuid": "763eaf10-a734-4e58-a67c-ac854bd08595", "comment": "Malware payload (DarkCloud)", "value": "0eba13cbfd07923ea968cb746fa765e4bb03cdf4", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097774, "uuid": "b94d174b-d6bf-4144-b7fe-2246fe66a1b5", "comment": "Malware payload (DarkCloud)", "value": "22632a43253c6b86395880f90ad7d0aa742022d44e1ad66a51fb659c2176407179f56c0bbdc38b8c159fad5f1c0d5005", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097774, "uuid": "52f52f76-cef1-425e-bb70-02ad8ec01457", "value": "T16526B7B3635F268A1E193749D81C58AC4F5B90099D53E5C8F4EF0A8D234B80B35E6DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097774, "uuid": "e9de1aa9-297a-414b-8068-62813518292b", "value": "49152:WflNlKaFvUNk3CTr9/Qmq03JmHztME14PBRfCSAIRc1OdEpOJpXaNSUWGwajomvf:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097774, "uuid": "221b5d61-f92c-4d92-aa7d-37375e6ff1de", "value": 4592887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097774, "uuid": "8498b625-a347-4640-bb8e-6ca7aa25bd9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097774, "uuid": "3e6c51a3-c6a5-4e54-83dd-fa4ed094348d", "value": "DEKONT070826.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622752a4-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786081179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081179, "uuid": "36df4234-c1e0-4dd1-a16f-28d0c4e52840", "comment": "Malware payload (Mirai)", "value": "456ea885c1d8658d41d42e9f6f280cd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081179, "uuid": "958695bc-e09d-47ff-b26c-7910d22afc90", "comment": "Malware payload (Mirai)", "value": "f0d6ed16f4ad666e5ed9eaabfd077e50d1c1d5bcd9a1862b93f66b2d2c9e4ff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081179, "uuid": "5facca2d-a084-4843-a6e2-74fd97b23841", "comment": "Malware payload (Mirai)", "value": "6fcc14552feec0e49031cb54be5362fc927b6571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081179, "uuid": "0d7085c1-85f7-4313-b3ec-a981fa738528", "comment": "Malware payload (Mirai)", "value": "7fae8b889261dc97727207c168d3e3e599353aab213cbe6f3db669df243abc703cd47b3fde8be2b1aaac4f55be8c8aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081179, "uuid": "82dc67c1-0737-47dc-990a-341ccdbaf3e0", "value": "T1C404094F7720CF61C729C53049B3CB4656E526522AE18849F32CDE08BE65349A96FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081179, "uuid": "fb829c59-bc70-4bcd-b378-ad776baf6746", "value": "3072:ivd9CkyxnwXMNcHYqI/R/H3zZP6TlfVkCqZD8sSun1Dzjx:I5qRVSsfFHSu1Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081179, "uuid": "62a4c15b-e26b-43e8-81c7-6e2d4e4ce3a5", "value": 182248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081179, "uuid": "59ea4ab3-0a7e-4744-b988-160d3480adea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081179, "uuid": "a4eaceaa-2bd9-478a-951b-9fcb4948bdd1", "value": "ecaacd42fe76418179a238d07aaa371fb40fb37f866e133047d19f9693a0cb52.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b961e029-91fd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786065434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065434, "uuid": "b42aeecd-320f-4775-8c68-0928bf4aeff1", "comment": "Malware payload (Mirai)", "value": "a23c74da92168efe64b1f4d04ea66504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065434, "uuid": "ce33bd9f-3a23-4de9-b5b5-aeaca27388c9", "comment": "Malware payload (Mirai)", "value": "f26e0468626e39ac1940aba366021ce782221d505888d15bf95519bc0340c1c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065434, "uuid": "07c95344-72ef-4085-a65b-4ffc382eb9e7", "comment": "Malware payload (Mirai)", "value": "5df90d17beb48db6cd3dba88463b066aa2e69c6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786065434, "uuid": "d90e0298-cd08-41b6-9d0b-7927c81b974d", "comment": "Malware payload (Mirai)", "value": "74e94e824e955d7788f172102c4aea2609c070036345234cb523b639cba0d9585dd5852a1024f825774cc9176ac25d66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065434, "uuid": "b1de65f5-e30d-419e-ad1d-34797a5bf7f6", "value": "T182E31856F8819F11D5C151BAFF0E128E73131B7CE2DE72129D24AB707B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065434, "uuid": "1e841c47-a811-4749-8d01-896c9ce1a3ba", "value": "3072:PdgDabQu6uoXtQFzQaNRYZtbEK+Ifg7/D82mUnbPUHp76:POkp6ztQF0azYvoIY7/DoUnbS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786065434, "uuid": "6747990d-cea9-484f-bf66-72af0b41d808", "value": 155508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786065434, "uuid": "eaf1af8e-4a26-4454-a7d6-c6cfb89de06d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786065434, "uuid": "8d6049d5-9523-48f3-b793-afcf76093612", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158721d4-923c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786092218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092218, "uuid": "6cb5ac42-b8ec-45cd-9a38-99dfac721dc2", "comment": "Malware payload (Mirai)", "value": "ffc300da490099f961eb56ef94cf6251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092218, "uuid": "d03599fa-c641-4829-9ad7-1a21816a04cf", "comment": "Malware payload (Mirai)", "value": "f2b379c510e605d6c2024bd5715fd20d5e85efd3a5201fb4c849d1d141ab5c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092218, "uuid": "bfc968d7-8204-4900-b723-30ffd7436839", "comment": "Malware payload (Mirai)", "value": "0bb78f541e8f6f29e84c02d45798ca1c3f06bdba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786092218, "uuid": "1cddb0ea-f5c7-4100-b521-5656df2203bf", "comment": "Malware payload (Mirai)", "value": "5ae390ff8f1eccbf7b2cb5ce0aab090564f3b74990fd3941ced4a4094138e82046ea47317199bc1634d827eae14b0d22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092218, "uuid": "0d95eb41-9516-4fd7-8d83-10a5c8f1955b", "value": "T12EA312BC8612FA2A46CE0A38315D7B284E9E78812C7759D987744CE96F37CC776D40B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092218, "uuid": "372add85-3274-467c-a34c-268913216955", "value": "3072:/VboQyo4Ppp5XAQSb7LrjFKqabZ3dyfPSVdYwK0C:/VcB5Hjif/aVt+SdXK0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786092218, "uuid": "f9b6fb45-688c-4e42-a4c7-4ee8755e29bc", "value": 100892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786092218, "uuid": "eb49429c-9174-4505-a048-25fb9ffe67d8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786092218, "uuid": "2029a176-09b5-4083-bcb3-1f20b7c7b0ea", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45de0be7-92a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786135248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135248, "uuid": "d0d67bb7-f947-4d37-906d-3f47f467b8a5", "comment": "Malware payload", "value": "e47fdbb60152c2dc8d364d6dfb8df4fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135248, "uuid": "f7b114dc-2336-4577-a794-3c76d3fa0b64", "comment": "Malware payload", "value": "f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135248, "uuid": "710a2921-186a-49b7-b8a8-5a489f5f0ec1", "comment": "Malware payload", "value": "40e2278c49d112b0037d97f8819bc49e91898901", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786135248, "uuid": "f1e9e3c6-2604-4dc4-aee1-fa8e91ac5310", "comment": "Malware payload", "value": "887926bf4871f8a85b7d70895368088a0e490045cda9fc9c8ff1c5c467f391e137003dfc64873e19af8a6f0e5dc226dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135248, "uuid": "19584dba-bc9a-4948-aff0-d94de1694888", "value": "T1500167CC41611971CC82CDEAB663DD7554C4EDC42BD14E5CAECC24B1908CDD5F961F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135248, "uuid": "532ee60b-cf47-4ba2-96e6-ae77f6ffa9c1", "value": "12:my+KWK4GqYEeREe5vEebmEevEeRI3vEeL:mjbHiE8EOE6mE6E4I3vEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786135248, "uuid": "c528f88d-d35f-48e9-bd83-053a9d2b05e8", "value": 697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786135248, "uuid": "478ba5da-2f7a-432c-997f-0f7c901605f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786135248, "uuid": "f81e46ef-181f-4bb1-ba20-8605f3ed88cb", "value": "twget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1df853-9279-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786118567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118567, "uuid": "5083bfd8-ef53-46eb-a9e6-60ce06499c00", "comment": "Malware payload", "value": "3544426b23e38f543e1f20ea11de831b", "object_relation": "md5", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "csproj", "colour": "#C26C73", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "packer", "colour": "#8D2A19", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118567, "uuid": "41c38a8a-ae33-4fab-afa1-1cf6cdb2aeb8", "comment": "Malware payload", "value": "f31df9170d3d70c2e3a84e56f1dabe093f19c79013a4d741cda3697ab2a93eed", "object_relation": "sha256", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "csproj", "colour": "#C26C73", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "packer", "colour": "#8D2A19", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118567, "uuid": "ebcf794a-513b-4288-b4b9-7236b449b7c7", "comment": "Malware payload", "value": "97a73641431173f0239341a4d8ed4b5a534da2f5", "object_relation": "sha1", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "csproj", "colour": "#C26C73", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "packer", "colour": "#8D2A19", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786118567, "uuid": "e08edcd0-e0b2-403b-831d-c11b42469f0a", "comment": "Malware payload", "value": "ba2224da632823d56b901cf1ff0d0228b4171bbbde0d8b2dcc0409022b385e17e827efad818a66caff4a885d0686c37a", "object_relation": "sha3-384", "Tag": [ { "name": "Amatera", "colour": "#385F2F", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "csproj", "colour": "#C26C73", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MSBuild", "colour": "#6BF0F0", "exportable": true, "hide_tag": false }, { "name": "packer", "colour": "#8D2A19", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118567, "uuid": "86b2128b-da36-4ef1-a764-fdb09a4ef590", "value": "T10F96027B07C087BAF3D44BC4845A241E26F9E565B9213199AB7329FFBC2A9C7407C643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118567, "uuid": "6cd524cf-0d19-4cb5-b531-05e3a072fc4c", "value": "1536:S51cozcDGLumsdMNOfBCMs3Iq1T+4gSBALAG2y/6ElEhYGCDw7TOKYHWZ5UUN9YH:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786118567, "uuid": "f975525f-d573-4bb5-8c5b-68d8970ddc19", "value": 9256933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786118567, "uuid": "3b164515-eb6e-41f3-966b-4d113421cd2c", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786118567, "uuid": "4de607c1-4e05-40b8-8ca5-d47855c2f300", "value": "DocumentFormatOpenXml.csproj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21fe5dd-9297-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786131565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131565, "uuid": "a374b1c9-b706-4c18-baad-2350d14b6699", "comment": "Malware payload", "value": "90e9e6bc2527d2a24cd307c7bd087fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131565, "uuid": "4dae8437-cd7f-4626-851d-4e8dc52bc981", "comment": "Malware payload", "value": "f3281eb760215be7f4984ef49a431cdc84608624296860f8f4a3914795e02e4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131565, "uuid": "f78c2326-b58c-448f-8351-b22eaf061c3b", "comment": "Malware payload", "value": "68cd1afab8ef0a6ebccf95dd0601c5f68724b3aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786131565, "uuid": "f6a8c447-2315-4f42-bcc9-53acea3613d2", "comment": "Malware payload", "value": "24308d9a97313e68c62a1862aa9bace263baca62960c02a005e83df1eb0ab966b0bc0aea8ab064d5c0daa87a27549ddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131565, "uuid": "e953a47a-c014-43bc-8842-7e241ed3614d", "value": "T15A63EA06EE926AF7C45FCE70552DC24A00DA5CBE92E9511E31F8D98CBBBD3064AD7C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131565, "uuid": "3e8952ce-b9b0-446c-87b9-9ace4251cb75", "value": "1536:gTv7AJjuCnu+1uhKsuzHBAI2nkkRqdLDW:ajwuCnFtA1Rqdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786131565, "uuid": "42ce1462-4ea3-49f7-98e4-d947a59d8059", "value": 72836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786131565, "uuid": "21bbbdd2-f2e8-4543-a66b-1584698cebff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786131565, "uuid": "28f2aa35-1f5b-4be7-b386-1193a196df95", "value": "main.mips32el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14f091-922e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786086295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086295, "uuid": "1653e297-7ca0-4609-a6ab-4e7d0944ca00", "comment": "Malware payload", "value": "d82fe3cf6d7046a071e55bc808269259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086295, "uuid": "c4661315-c214-4d2a-b183-aca820fa8797", "comment": "Malware payload", "value": "f4148cdf601fe5d83e3d4dffd9ebe2557161ab706fbf59489a468757e5770068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086295, "uuid": "0b31eb2f-f5de-4623-b49a-9b1ba7f2bd6d", "comment": "Malware payload", "value": "ad3b106dc0d6b2e1dea4f007275d482934aea106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786086295, "uuid": "00d2e7cb-1fd1-44ec-b52b-6821ce7a74c7", "comment": "Malware payload", "value": "1ddcf29551d26e4056000504f52082d5493b13ea20baa1df33e41d77f378a71333371138554d4327447a75a29a4cb453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086295, "uuid": "1ce6d472-8c1f-413e-90b0-99a27e0536a3", "value": "T120F42385ABFF39C29EA61CAD41F7DB0B47D61F9604FBCD0448A6028853D9123CA22FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086295, "uuid": "1b3f2f72-78ac-48ae-9910-d437e539a900", "value": "12288:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt78NpI1jSvvkmlkT0teHA78/kV/7UYzGrW:VoG13EsScEPHXMWvDa1kt78govVlkTuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786086295, "uuid": "0184c523-8755-48ae-95ea-44655fb83e22", "value": 764346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786086295, "uuid": "e9f8a1a8-a214-4129-8eac-3e1eacbcae07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786086295, "uuid": "13f22e27-f006-489d-83fe-d8c046d3637c", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555ef5df-9222-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786081158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081158, "uuid": "250849fb-3e43-45ae-aa3a-0faed03ea6eb", "comment": "Malware payload (Mirai)", "value": "f2528b69908b661c4ad48c360afe787a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081158, "uuid": "9881e2b0-0070-4357-8492-b0a84ac94689", "comment": "Malware payload (Mirai)", "value": "f4a6c3bfcd44c3c0b0f0be490a0c4b2d06783ee672308cb814e7c11c6f090782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081158, "uuid": "ef638055-0f2a-4adf-9b51-b0bda864bd24", "comment": "Malware payload (Mirai)", "value": "899ded182b405e90f472fa10098f48e6beaaef25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786081158, "uuid": "2ba9648c-2fa4-4844-999f-75c0a9edbaeb", "comment": "Malware payload (Mirai)", "value": "3740035efe8a1ba4770f15b448115cd18e4c62ea279c2b3696240d5801966edaf7c110483f0f283abe3409c6512f530d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081158, "uuid": "8284075e-a320-4167-a29c-4b6eafed61fd", "value": "T1F653F15173C56615D69374B87EDEB1A1B38815BB06315CF3C6ACDF961822261903FCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081158, "uuid": "4435253b-7abd-4a35-b592-a213ee0fb3e1", "value": "1536:2M26DlnK0hsW1WnjOrObzi4TeqsV5TPGvX9mCFQy704u+qgw0rt:c6DlDj1Wjbbzi4T+5+HQ4u+qgwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786081158, "uuid": "d9327260-b320-4e00-b783-4e4532675031", "value": 65148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786081158, "uuid": "4b8a1b80-a82a-4278-839a-a593b503c0bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786081158, "uuid": "36e76f8d-d630-4118-a42a-55d256d5a56c", "value": "f4a6c3bfcd44c3c0b0f0be490a0c4b2d06783ee672308cb814e7c11c6f090782.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae20f00-9231-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786087824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087824, "uuid": "eee395e9-c463-4f4c-a989-8f46ac73e3a4", "comment": "Malware payload", "value": "63859e4e6a1c020e427ca79255e1b55c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087824, "uuid": "bbcb1129-056a-4624-a17b-42934cf6fd5e", "comment": "Malware payload", "value": "f4d2b5812f522b66a4a6ea5b979cae2b73486618708158e5ef61c469b2306f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087824, "uuid": "c54ec663-b9bd-479c-83a1-fd6d404e1f44", "comment": "Malware payload", "value": "c13d809a8fb865020c138df195de5a6f9c3f6009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786087824, "uuid": "8eb15116-cfb6-47b2-92a9-dc4e0caeafec", "comment": "Malware payload", "value": "49d19b328ef140a005e77a9eb2ed49774418481d71faf28579ff4323d0dd2ae3b200c813b95d421e2a00cc418798f4c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087824, "uuid": "5b3d74c0-8dba-42a4-b611-5a33aa7b3370", "value": "T14E37CF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087824, "uuid": "2d71999c-5c29-4f8b-a6e4-7384f24d4d1c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQi:cqYUQuVDt0TZEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786087824, "uuid": "6a2a2ebd-ddbe-4065-8f0d-06ef8870bc68", "value": 22806528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786087824, "uuid": "92bd87f6-c317-45f4-b3b0-e2041d0030af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786087824, "uuid": "0faa5aaa-51ef-40b1-9324-6bfd8d755658", "value": "f4d2b5812f522b66a4a6ea5b979cae2b73486618708158e5ef61c469b2306f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569aec07-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786097910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097910, "uuid": "e801645e-b372-4463-8223-3ec8c682a43c", "comment": "Malware payload (VIPKeylogger)", "value": "80baa455746b51a4bbe919fa099f5314", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097910, "uuid": "c9460098-c143-49f3-acd0-b24ce76e683a", "comment": "Malware payload (VIPKeylogger)", "value": "f771cc2cb117ef62e4e03e919b7600b66ea59dae7e9a532c46b4318afeed10d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097910, "uuid": "ba65e765-38e0-4068-9278-3ce3051b00fb", "comment": "Malware payload (VIPKeylogger)", "value": "6f72d99c1c4f2569d0a88b67b41b1a62b951deca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097910, "uuid": "d1b9bb1c-c655-4c85-b9f8-952f8d29dff7", "comment": "Malware payload (VIPKeylogger)", "value": "9469b00c9ffef29f536987408de8391398ac8bf58a1491dc1a278c18d30bac032fd2184a2b8b59007290bb41aad103c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097910, "uuid": "3de66558-7cc2-4b29-9461-7881e554741f", "value": "T1E3E50782679492737B20BBAD653ACE31990EE00369C1DF49715CE708362DD8FA358BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097910, "uuid": "b0fdb81b-e5f6-4fc3-a7f9-e4ca640e4cba", "value": "49152:ACQ7CgbDU4Kil990A/Ccy2tdhDVq6JTXxM+tca7g2w2rtBjydB+syaReN7JCRMXU:ACQ7CyDU7q9eA/CAdhDVq6JTXxftca7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097910, "uuid": "e23303aa-3ef0-47d3-8edb-4cabd7000cd3", "value": 3067058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097910, "uuid": "6fadb635-8308-4728-94d5-ae311f72ac9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097910, "uuid": "7235148b-9862-497c-967d-83a06d236fa0", "value": "JUSTIFICANTE.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8908fce-9248-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786097645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097645, "uuid": "7b5a04dd-ccf4-4426-92aa-e020804e104a", "comment": "Malware payload", "value": "5e83b5c0a53dc653c8c8f1bb846b48f6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097645, "uuid": "c37aebaa-6da5-450f-97ee-2628f7a0a190", "comment": "Malware payload", "value": "fc95c3f88a4007752428e95b6fa225491dcbce0cdd4daaa75aad542ed6186ebb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097645, "uuid": "5618bf4c-a8a2-4d29-b1dd-9f7ea7d50a38", "comment": "Malware payload", "value": "ee859f08e8bccd4d0004534a709f20760c7dd292", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097645, "uuid": "947e4fea-96b3-43b4-ae3a-08fd62980cce", "comment": "Malware payload", "value": "18d78bd5da6af9679ff4719480dce58ee1f2011267d67a216903860ad359d4e0b096d10ac845e5bc486fb441fa6bd1c7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097645, "uuid": "ebd89bae-71ac-4181-8c7f-226fa8d33fe3", "value": "T1FFF4AFC125E81300F1B7FE3ADEBAAB40053BBA81DD32879C8960CC5C1564541DA39F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097645, "uuid": "a6020879-8287-4058-9e85-d4adcf36f353", "value": "24:8d/QngRiqX+yDW9KT629p/BxU/n9IW5MZ/RrhwUDmI:8lQgQqXFDW9l0p/UFL5K/bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097645, "uuid": "87056bf2-a2b7-4175-a891-fe50cddf443c", "value": 774868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097645, "uuid": "3d45e2af-fc31-4900-a1de-fc8ee8840856", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097645, "uuid": "165892cd-7128-4592-8ef6-19db63a960fe", "value": "JPG_014.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f16076-9252-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786101941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101941, "uuid": "7aad25c0-caa9-4cf9-b905-e7085ff5ec29", "comment": "Malware payload (ConnectWise)", "value": "7da1c529f1cde0f28f08d5e90a64f19c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101941, "uuid": "87687b15-777b-40ac-81be-f3a976d66002", "comment": "Malware payload (ConnectWise)", "value": "fd2479e51259747153a3ce46264e0f3f3fac1d6eadcc0efb915ba5f35ccc5b18", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101941, "uuid": "44e308b9-0146-4428-90a3-6ec4559039a1", "comment": "Malware payload (ConnectWise)", "value": "802f55bbb5a7039babe432b2d784dcc699fa7a13", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786101941, "uuid": "d78b40ed-e94d-459c-af50-707793453f0a", "comment": "Malware payload (ConnectWise)", "value": "0ea091e868d2ffdc9255d98367e02e956055d7ba03f5c175325d2a5c4e79fc8078b1951876f58d0e19a0122cb8d8e475", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101941, "uuid": "3cb21a1b-0662-4649-a897-041e16be3d92", "value": "T108D61211B3D594B5D0BF0638D83A92656B35BC008B66C6AF6394B96D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101941, "uuid": "94ab82cd-ec86-4983-a0ea-20b20d088760", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101941, "uuid": "5a075269-d766-464c-9813-dca59fbed368", "value": "393216:Yq5VDBCDxXQEZq5VDBCDxOq5VDBCDxdq5VDBCDxq:YpCEZp4pjpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786101941, "uuid": "1abef93d-36ea-4684-a91a-d2e6092af6e7", "value": 12807224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786101941, "uuid": "19b9dc1a-a242-45ab-957d-b7c88ddb59d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786101941, "uuid": "b6d72b40-0d7e-4b9e-ac22-e690ee6baf20", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc0bd32-928d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786127074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786127074, "uuid": "b8c90191-ce5a-43e1-8dcc-0d4b7e5468b7", "comment": "Malware payload", "value": "3371cebcb886de3bd6b7b9f207b66c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786127074, "uuid": "b06393de-988d-4f7d-9f7b-03ad631d8426", "comment": "Malware payload", "value": "fd2986878e0c725d5d346ce9629d52b4c58630074657c8bfb92c7d5d8fe7aa59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786127074, "uuid": "111b4cb3-ecb2-4ee6-8d59-d8483e59d435", "comment": "Malware payload", "value": "dd9e240073ca4698e9f84e328c78fa1282d0c148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786127074, "uuid": "a07c9fbe-6e0b-4a50-907c-92fd23fd2a31", "comment": "Malware payload", "value": "cd0ce0efaaa77bf810bc0b294cea4754c5cdf66a7405d9072d83214ac00e67767d28af48e7f0e2d14b19611771c4ea3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786127074, "uuid": "0b64caac-fa2c-44c3-b5a2-084ad375e0cc", "value": "T1C4F51A3BE4A294ACC0CBD031665BC5B7F970B8A90221756B16D06F317F36FA05B6DB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786127074, "uuid": "3708c615-bd0b-4f67-bcd9-ed1528f108f4", "value": "98304:fbmu1vuF7o1Yhal6OUp9+eKGGF555555555d5d5FF5FF5ls0zsGK0K0K0SxvSxvV:R1vuK1Yhq6OdSDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786127074, "uuid": "4df24a1c-15f9-408f-b7f4-f24e38e7314d", "value": 3578029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786127074, "uuid": "7eedc712-53a0-4379-bd31-53ca7edcf498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786127074, "uuid": "c211a761-b232-403f-8367-520b02c09ee3", "value": "log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e13f17-9249-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786097907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097907, "uuid": "14d6f0f7-218c-4481-9aa7-d71e498aee23", "comment": "Malware payload (PhantomStealer)", "value": "e151a77190e7beb810eab2b7d29f9a27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097907, "uuid": "35ea119d-547a-4d99-b0ab-fce23793993d", "comment": "Malware payload (PhantomStealer)", "value": "fef95745615ed2cafdf1d9b2834b07ca6a39493e0e8c1a2eb07e909286d9c1e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097907, "uuid": "d9409dce-8a4c-415a-ac62-d54710b50aa2", "comment": "Malware payload (PhantomStealer)", "value": "ed8e8dd8e19469dfead5f50050c7c3d906ad6de9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786097907, "uuid": "bcdc558a-a0ef-4e40-b82c-c37163b6d45e", "comment": "Malware payload (PhantomStealer)", "value": "c01c12cd53ccedf7a40eaa6d212c53df4819dbd39f14581961bd1945773f7d49c93d9b2d16ecca1aab14c719abbf2aca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097907, "uuid": "1771a0b4-9b41-43d1-9f0d-ba3a4200feca", "value": "T10925F8CF6371091C649A7A0FC8386E9E7A9BCF830510BCBABDA45957C50C34253B5B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097907, "uuid": "9a551c14-bcef-4899-b591-1db493b2c2d6", "value": "3072:YcnMd8rgnak8NKoaqz9kQ9562BOFmcu3wuyd5b2QHPnW/EHpPT2suroXR8SpWuAU:Yq7KKQRPWkskVxuD5DnwnizmaBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786097907, "uuid": "b21ae669-bdff-4a89-84f8-699ef3f36ac0", "value": 1031507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786097907, "uuid": "ee58fd27-9fba-4b1b-8c6f-3c08b4bcfc44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786097907, "uuid": "56696d05-8254-4157-9287-3114e8f70bf6", "value": "doc779342454PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }