{ "Event": { "published": true, "date": "2026-04-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-29", "timestamp": 1777507381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "245f2e29-3c0d-4e31-9a57-1bb81c09c3b7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50131214-4405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777492503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492503, "uuid": "40f92572-9c1d-4dc0-b34f-34f45e1db01b", "comment": "Malware payload", "value": "be0301468462180d2e414790aa3cd2df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492503, "uuid": "10fbf688-c43c-436c-8847-f4c0f2cf2fa7", "comment": "Malware payload", "value": "0029c449ebfb124513326af650dad34a38140de6ee99b180175c7fbc56e487d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492503, "uuid": "198d7a13-8b76-4589-9b63-f48f811d327e", "comment": "Malware payload", "value": "5b419c96916cfce09e280da174b662a94fa11a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492503, "uuid": "10207b5c-9d18-46e3-b39d-3f9fbab66abc", "comment": "Malware payload", "value": "b22b808fe759131b61c82683aef42a927175a74bada992482f6ffd8188ab0430b4c6995439d5b539d065e58a70b58b0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492503, "uuid": "fd37e87c-98a8-493c-843f-535045d38d48", "value": "T1A085F757E89590F4C0EFE174C726A213BAA13499473437E36FA18AF11B26FE466BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492503, "uuid": "a13678f7-4df5-436a-9886-90b1b0d1dd0c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzr:cqYUQuVDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777492503, "uuid": "4724417c-7b81-4776-8f76-ef6c10a72769", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777492503, "uuid": "7d9d041e-ec3c-41c8-bcea-b9acef47ba9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492503, "uuid": "10e9ab8a-e956-4449-9988-da845a6ad953", "value": "0029c449ebfb124513326af650dad34a38140de6ee99b180175c7fbc56e487d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476188c1-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478744, "uuid": "74cd60b0-de7b-4b4e-b588-e6f3f5c53db9", "comment": "Malware payload (Gafgyt)", "value": "48aac2f3ec1517a8f6764f3505a7ebe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478744, "uuid": "5282ef73-0d62-48c1-a186-23bb9ef90046", "comment": "Malware payload (Gafgyt)", "value": "0109239f186713152a7bae70350fbadd695f61c0bb1f427f8325a1b464fc8080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478744, "uuid": "d354e877-57d8-4b74-90a4-2d95ecf557d8", "comment": "Malware payload (Gafgyt)", "value": "22de36c57f23368b6471c30e31e079f64ae23e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478744, "uuid": "4d417bcd-898b-4712-a63e-c8e79d32fc06", "comment": "Malware payload (Gafgyt)", "value": "90973b3ea6c694ebd47026b8d7c916fc8ebc2e171c5d0f98c781e8f02aa41f8742bc8d0035ec6faea62a158a9fbc966f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478744, "uuid": "3b1a7712-30d7-415b-b399-8380f530e9ac", "value": "T10F931B41F9418B13C2D327BAB7DF475C3B356664A7DB33016A29BEB41B827D91E39220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478744, "uuid": "9c93209d-8567-4340-b203-9e54e142e14a", "value": "1536:hMNFsaLINaZRqGogDZtTl61uHzSPuIv9eQOZOw9HvqCinwqV5Y+HjMemC0rQOFWz:WNxsYZRkg1618zQGqCiLY+HrmC0rQOFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478744, "uuid": "abf232e5-f893-4386-bd60-25104c786a06", "value": 95949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478744, "uuid": "946e21fe-11b5-4c25-836b-e9bea6b7ad1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478744, "uuid": "24a05b48-01ed-4980-aa33-33bb3ea1fb17", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f12ca7-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777455420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455420, "uuid": "e301fb9a-bd9e-43a6-8cdc-73dda0eb8bf0", "comment": "Malware payload (Mirai)", "value": "a4fdd256703c4d946149805314251c7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455420, "uuid": "06172c3f-e6fc-4ce2-abe6-e64eaef19b98", "comment": "Malware payload (Mirai)", "value": "02e54b01bd57ae3d3ca09871a4766b89b032c3e2b4654cf69cbba430854d5337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455420, "uuid": "973f4c54-d6e2-4872-9449-842d0e589510", "comment": "Malware payload (Mirai)", "value": "f5ec4a647137ff078e9f9fa8a763b8d0a7b6d6d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455420, "uuid": "7ec768a9-d8e9-4d7b-be75-70e9479c498b", "comment": "Malware payload (Mirai)", "value": "2eb906392eeb85385ddc61b18b12c173852b51a7f9a43365395dae172360e308122d128ce5266e8d49ee7d63d319f76a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455420, "uuid": "8ac82d51-0693-4452-ab31-e6ecfb0ee149", "value": "T1B8632947BB42DE77D45310F102F76B664A32FC3A6C36C682E764BCA0AA915D0A61737C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455420, "uuid": "db35b4e0-2ce5-40e7-ba4d-f95f2868ebc3", "value": "1536:t+E8zCO4b+XNWegiUiKBgZle7i9VEVx/SCaaoFLjJg:6maXNWBBiUYc/0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455420, "uuid": "f298abca-450f-47a3-b9a2-671af264eca1", "value": 70236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455420, "uuid": "c6023456-c121-46a2-abce-bdb20d15aa2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455420, "uuid": "bf7dcd77-f06d-41bc-9669-433fc5c7208c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2013d7c7-4416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777499724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499724, "uuid": "fdc54b9b-9e15-4c0b-826c-4fb0a7853f34", "comment": "Malware payload (Mirai)", "value": "47876d3be8c3c755913f6118e87aebce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499724, "uuid": "4d707aab-9f8f-4b96-9147-cc137f1b378c", "comment": "Malware payload (Mirai)", "value": "02f4cc2631d467285e7da67c1cc6a94f5719bce4e26ce26ff8605ad37697abbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499724, "uuid": "1a37b403-8331-4bd7-b20b-96e579137d90", "comment": "Malware payload (Mirai)", "value": "f7cafb3eaa5848cf6fd223d367d337d0e78a21dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499724, "uuid": "c4822f34-3c10-4f06-a18a-e7080e29bb22", "comment": "Malware payload (Mirai)", "value": "65725cbf4466267f8ee20d1bcec24f2e294c37e917632ad8598c56a16c2f08555ee8b97e09b8569e1ea7fef44bf7a340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499724, "uuid": "b44902a4-e037-4bd0-a769-64a742dba1b0", "value": "T16893F842BD429F13C5C621FAFBAF059D3B166B79D6EB3202D921BF9023828D70D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499724, "uuid": "176c7d89-905c-48c4-afa0-0022c49f14db", "value": "1536:YVWF+5w6vhbcHjrC9nz7qz2ipOqfwUv5aU1aiI6/9FpjNtaMVlxJa:YV4JZjrC9nz7qyCsy5z1ai1rJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499724, "uuid": "28b49a4a-5c51-46ec-baa9-e059b6bf241f", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499724, "uuid": "def9f143-286d-4a3b-8a12-dfcab9017cc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499724, "uuid": "eb7cb558-cc40-4d72-b79c-c5fd18f7b8d1", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4770c2-441f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777503638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503638, "uuid": "ec617380-f305-4b0a-ac09-99f502cc7d28", "comment": "Malware payload", "value": "b55b3f479ba53f266aa0a4f507ee891c", "object_relation": "md5", "Tag": [ { "name": "forgotten-packet-iowa-application-trycloudflare-com", "colour": "#914640", "exportable": true, "hide_tag": false }, { "name": "quote-texas-son-manufactured-trycloudflare-com", "colour": "#26B334", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503638, "uuid": "9a4c05b2-0124-4681-861d-f19a9234cb7c", "comment": "Malware payload", "value": "030c24fa24b752544228b0c31e9fb17fd5bb42eb1ca2b1e8e7f460df7dbe7b0d", "object_relation": "sha256", "Tag": [ { "name": "forgotten-packet-iowa-application-trycloudflare-com", "colour": "#914640", "exportable": true, "hide_tag": false }, { "name": "quote-texas-son-manufactured-trycloudflare-com", "colour": "#26B334", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503638, "uuid": "746b3100-32ce-475d-8510-78ec1cbba508", "comment": "Malware payload", "value": "4bd47d08ab544ed8ef78aa07580fa4fd9a12e2a4", "object_relation": "sha1", "Tag": [ { "name": "forgotten-packet-iowa-application-trycloudflare-com", "colour": "#914640", "exportable": true, "hide_tag": false }, { "name": "quote-texas-son-manufactured-trycloudflare-com", "colour": "#26B334", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503638, "uuid": "063cd14c-83f7-48aa-9d31-98bbac26005c", "comment": "Malware payload", "value": "91cfc8fc739d3eb37100b3f98cac7e0a12a0dcb40a12abb35455c487ecb37948a9db9a48df06148eb9fa736974d20dc0", "object_relation": "sha3-384", "Tag": [ { "name": "forgotten-packet-iowa-application-trycloudflare-com", "colour": "#914640", "exportable": true, "hide_tag": false }, { "name": "quote-texas-son-manufactured-trycloudflare-com", "colour": "#26B334", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503638, "uuid": "0021b0c6-165c-403b-a683-945eb1172503", "value": "T19313C431A3A45D2B38AA654C622C4458FF8B1E9FF1014FB6CDB205BC2EAF5C88BDD540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503638, "uuid": "d1468322-99f7-4795-b04e-2d94bff76eac", "value": "768:vWgZP+W/AX6ti4sDd+WWCbd1XMDtURFowGK/0E:rkW/S6t65V51WtURF7/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777503638, "uuid": "da88b3c3-b72f-42e3-836e-0b12669f6988", "value": 43530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777503638, "uuid": "8c64e1d6-f782-46c7-95cc-e34a692483c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503638, "uuid": "06d9992b-d514-42b8-88e5-ef52fb9e3ad2", "value": "archive0331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24de7fc7-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451628, "uuid": "dab9e8cb-b49e-497e-9d86-b233110b2414", "comment": "Malware payload (Mirai)", "value": "5273990e7bfff8fb587898842948010d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451628, "uuid": "f0369b31-9e9d-4c46-8326-499c61aaa327", "comment": "Malware payload (Mirai)", "value": "03613a1db3c53c99bb2687ca37250918830c93af387433bfc781a1b425a24147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451628, "uuid": "736cfabb-0600-417b-96a2-b28b84b118c1", "comment": "Malware payload (Mirai)", "value": "c325e34268a3df77992a1903c3e6178cf192d74f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451628, "uuid": "27984dca-51e1-4580-a01a-dc547892c917", "comment": "Malware payload (Mirai)", "value": "612c225201b4435a4e71b0532fe1b421dcf4efc3a574d932fa45733a9871f3b766f11ec863de26cdfac7c8c34a8254f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451628, "uuid": "4e847b07-35e4-47fd-8b1c-dd401ee59474", "value": "T134E32A47EA408B13C4D21775B6EF4246332397A593DB3306AD28AFB43F8679E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451628, "uuid": "f87777c5-cee7-4418-8f03-725cf7f2973f", "value": "3072:Pfvva+BtNP8Kl1kbooqQuwNlrmNc5M/9jJCM4:PHva+BtNP8OyblvNlrmS5M/9jJCM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451628, "uuid": "9de5a5e4-d3df-4723-b9cd-3145d519dd3b", "value": 151944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451628, "uuid": "f24736c1-ae1b-4a06-aedf-1ed49b7f0c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451628, "uuid": "68412bf4-453a-4cb2-8c95-69e4e99a09ad", "value": "asuna.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22584ff2-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451624, "uuid": "b175de32-2a03-471d-ab89-83cc8075646b", "comment": "Malware payload (Mirai)", "value": "25d2ff2d5e084f1e78b036e3e109cd5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451624, "uuid": "503efea9-a589-477f-a9b2-cece0c7d84ec", "comment": "Malware payload (Mirai)", "value": "036f40658e50de29ffa853c0d9e5b9f1b5504ee7eefcac83024cc36902018ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451624, "uuid": "056acab8-24f2-453b-b69b-3d2dea0b242d", "comment": "Malware payload (Mirai)", "value": "a0ba87bf56a78b87b2a9fb791fa535ef9718c149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451624, "uuid": "4b2527ee-4504-4bcf-b59c-2d2b684bc81b", "comment": "Malware payload (Mirai)", "value": "35da359e77bd2135460f8f7862b4508ab69a5b43ac5c5f61c37cdbbcaf8576bc7283c3b2f2b2edff5db559ef533f10fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451624, "uuid": "893507f5-5916-4dd6-8d0a-22309a11f193", "value": "T177634A02F30C0943C1A71DB1393F1BD0DBBAEED122F4B6816A1EA785A671E331555ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451624, "uuid": "3587f17b-bec6-4784-aaa7-0186fa163a8d", "value": "1536:QL45DYShmVPtMqfGNeDM/hPQhygkNX5AX:QrPVP3pAPQhfkB5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451624, "uuid": "1740fa98-5d48-40c0-b5df-2572d7fc73ec", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451624, "uuid": "8edd005c-98a0-43ce-8c9f-fbfc6f5a5253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451624, "uuid": "29c88733-1405-4c2c-89da-a4c37c00f331", "value": "asuna.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e4209b-4405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777492405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492405, "uuid": "b4f07cea-43a6-446a-a1f2-628a78a1ccd0", "comment": "Malware payload", "value": "46ca4c9a9de3d8e2646b16baa947e86a", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492405, "uuid": "c13ec06b-625b-417b-954b-65da7db61dbe", "comment": "Malware payload", "value": "0372675e4fb8b4ce4c61ce73fb98799ddbb0799fd305557ac3d7365b9db0d4ed", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492405, "uuid": "daa57bff-d510-46f6-b689-fe626bb5dd46", "comment": "Malware payload", "value": "26fd50e6d500b43a9e848f8408fc6e373feed969", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777492405, "uuid": "bc2b373e-1128-4f36-804e-caa5788de33e", "comment": "Malware payload", "value": "c8558b6ba1606312da97c05476ace50524ec853bd91a436382e9393d02760a57370012bfc771131d031181051fba1fec", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492405, "uuid": "7fb9c65d-dd4c-449b-9d79-bc6dabb89e69", "value": "T15DC6F1236A492139E29917353A76DFE0A73B6F506C1F880F96F4347ECB351E029366C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492405, "uuid": "654c23fe-a6fd-49bb-beee-788473187a19", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492405, "uuid": "18fd1712-9ec4-410a-a0ec-78bf4d29e94b", "value": "98304:UL8NcXluuX+/d/J/MAcqLAqWNDXE1VMLn2Y9ZN6hSM:f+l72/OAnAqWND01V7Y9ZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777492405, "uuid": "e97292d4-5750-45b4-ba22-ece40293999d", "value": 11895174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777492405, "uuid": "a5eb9c98-f931-448b-bcc5-e79957f13159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777492405, "uuid": "751b4021-cc59-4dd8-a3b8-c0536fb394c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1385db0d-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494978, "uuid": "2f39a63b-6c6f-42a4-988a-18153553b9e6", "comment": "Malware payload (Mirai)", "value": "74c489fcae516b7a95cbe62e0d15c5f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494978, "uuid": "b9f9de91-8e48-414a-9a54-2a50280d31a4", "comment": "Malware payload (Mirai)", "value": "0433b543b7b9757fe9ecd86df3e43b60de89a355955ec22f727f41c05d275f87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494978, "uuid": "3b1adb23-cadd-49b3-9923-1f31a76f6110", "comment": "Malware payload (Mirai)", "value": "c03fcca0a6ed56ad6cc128147844865550777426", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494978, "uuid": "a2c6351b-6734-4b9e-923e-e1a5e70459e6", "comment": "Malware payload (Mirai)", "value": "da8ea2a649ea941bac1e57408cfb5e80d2d2451aab3d0ddcfbaee166077814023427d6c30db668f88c236cd9a2796489", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494978, "uuid": "6e8cdba9-7b5f-4da9-bacb-34c02504428f", "value": "T15583E942BD429F13C5C221F6FBAF019837266B79D6EB3242D931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494978, "uuid": "5c928437-8122-4504-8401-315523eac6b5", "value": "1536:PKDLhQ3BlLywjmConIxqPONb6uKBJw3Q2LKvDHytGwoUi+j0AnWPfF7a:PKDqXjmConIxq2B6uKeL4DHyOAWl7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494978, "uuid": "f636c015-6f36-47eb-b37c-bb4495f945a9", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494978, "uuid": "4f8856a3-654f-44e8-8b0b-800021e0def8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494978, "uuid": "52e80469-077e-4be9-a86f-b5344634838c", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6f8ada-4402-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777491346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491346, "uuid": "51294bef-475c-410f-b540-8d4294801638", "comment": "Malware payload (PhantomStealer)", "value": "34a6760afc712dee5d0c1db490160fd1", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491346, "uuid": "e2785173-c826-4914-81fd-2e69143a7962", "comment": "Malware payload (PhantomStealer)", "value": "04443d6489d319281edaa13dd08fac81fa70c7d496bbe125d223e62227034930", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491346, "uuid": "a9947bd0-0b6f-475d-8e44-7232007ba818", "comment": "Malware payload (PhantomStealer)", "value": "771d8911ba9e46fbbaa7f72b762f8c8fafd0686e", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491346, "uuid": "48d1585c-e135-4cb9-b182-73673ac1f90a", "comment": "Malware payload (PhantomStealer)", "value": "7dec471c5839932494c62e86ec89f1563a685df10019f6f25a6896e19a994463be21d74887be6d1854552233861334ed", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491346, "uuid": "c05b7f67-c8a4-44e2-881f-e5e03d0c192b", "value": "T198F533600FDA7CFE469CD72860AB7F099BF10E260066AA5753C434C7666FBC3425792A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491346, "uuid": "668a8b67-4b57-43a0-8870-cbbc4cb68b24", "value": "49152:GI1c2Dz/lR4Xg7mFWTdsOfNjJHm0lxEjnr:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491346, "uuid": "c8db1bf1-4cf1-4b51-bac1-e6a64987e7eb", "value": 3415531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491346, "uuid": "6afe89be-9348-4eb2-b089-cb4461e3693f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491346, "uuid": "a97717c9-79a0-42b3-bef8-23fc62362ed8", "value": "KIEDRL98.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14410a72-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494980, "uuid": "4511f13a-6ec0-4708-b8d1-21529a0489c0", "comment": "Malware payload (Mirai)", "value": "01ba0912da03b5cfdbd3af9175de69f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494980, "uuid": "3d58b188-2664-4919-8025-50c509514e8b", "comment": "Malware payload (Mirai)", "value": "044caccab43be73f941ab0c42c9bb9bf07a005eb6f046a73ca41adc86abc94de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494980, "uuid": "d6052e5a-09a8-4e77-9fb7-ac0aba9b8ff7", "comment": "Malware payload (Mirai)", "value": "ad1ff06683a5fd84bfdcae2603139969d19c69ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494980, "uuid": "acde8995-f08b-46a4-9a43-ccfd13a81421", "comment": "Malware payload (Mirai)", "value": "f7afaddd64a202770f419a7b90880c4d86d64db0c35533695bedc7f94828c09ff27d4d9daede6896524e61a7e437f868", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494980, "uuid": "7d1b2e78-c2fa-450b-ac0b-55f23fbc1656", "value": "T104B3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494980, "uuid": "b92681e4-e08f-4262-91a6-29621cde9188", "value": "3072:hqiKVqVEpOFnYfG/7/0lZYz4BmnlsQatFbR17z9c7YfNpg0w0zIyf:hqiJPdYe/7/0lZYzWylsQatFbR1Vc7Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494980, "uuid": "83c7adc8-4893-4db9-afe0-e11452228141", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494980, "uuid": "a7b1c9d5-d956-45f5-ac5c-a8607df40d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494980, "uuid": "3786cb3d-e958-4b6a-96e9-2248e8da62ea", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45db4bbb-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470581, "uuid": "066e6b76-841d-4a4c-b8b4-3866dd7caf40", "comment": "Malware payload (Mirai)", "value": "c59e1f315ae80c0966e8041c746a70da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470581, "uuid": "49728f60-1738-4ddb-9810-036397bb7174", "comment": "Malware payload (Mirai)", "value": "04fa32912daf175a94b6521bc7ff55c98366895999bd6ca2071d461240f4aba9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470581, "uuid": "85c5f1b4-daac-4711-9a24-c2fb492cec21", "comment": "Malware payload (Mirai)", "value": "069e4955a4177429db8355311255317b0a009253", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470581, "uuid": "61fbecfe-15c2-4ff6-8d9b-e40d965f829d", "comment": "Malware payload (Mirai)", "value": "12b865afd17be27d75fa1aa008719c7651e45c67812c6e4b4f2a4f726db3ca5130136035278e0fdb20dd17680f1d3a18", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470581, "uuid": "0f6a62db-025d-4c43-a15f-778add3c8f9f", "value": "T15CB3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470581, "uuid": "c9fcd545-ebc7-4b71-9e39-61f21e01ad66", "value": "3072:hqiKVqVEpOFnYfG/7/0lZYz4BmnlsQatFbR17z9c7YfNpg0w0z6yf:hqiJPdYe/7/0lZYzWylsQatFbR1Vc7Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470581, "uuid": "d12e1fe6-495e-48a3-9673-064e42e992ea", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470581, "uuid": "7f2f7f79-3bed-4cee-b8ec-dd331cf44891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470581, "uuid": "3152a64c-8d8b-4bbc-b6b6-076699211cb7", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791088d0-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1777485700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485700, "uuid": "a68929de-54b2-4b14-acf6-0c92f2e2de16", "comment": "Malware payload (NirCmd)", "value": "2b403d973e78a1f8bad2a6ab229bf0ef", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485700, "uuid": "edf41f43-db9b-4a4f-afc0-245b01932610", "comment": "Malware payload (NirCmd)", "value": "05922302dba21eedcba563de8dc18527c1cd362961709e2f5595fb73bd03b265", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485700, "uuid": "d161f958-7801-43d1-afe4-9f25eaf0b75e", "comment": "Malware payload (NirCmd)", "value": "1119a73eac8996b45801e15339edb02b05c052da", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485700, "uuid": "95b053d1-b530-45d9-a6c8-7efd5b4ecf62", "comment": "Malware payload (NirCmd)", "value": "98ababaf2b8ba8103a60bfd0a3a4570212c449c10b52f9cea583d425c0d847a73609b0b047667dbcad8cd2245f1a8244", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485700, "uuid": "7d8cef24-c95c-4ded-8452-3c8cac45fac4", "value": "T118A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485700, "uuid": "99bd118e-18d3-4c80-9571-133f063a6bcf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485700, "uuid": "a23c97fd-5e94-4206-bf89-8f0162dc99a8", "value": "49152:ABRwTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aGTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485700, "uuid": "8a5d52fc-441b-4f87-9a2b-2b4dac2780ea", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485700, "uuid": "8bcd5650-8c02-43a0-bcf4-ec4f95e8f0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485700, "uuid": "1ddd0987-8d90-4d18-8866-c97653b6fae6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3238769-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494870, "uuid": "2a6d1e68-fcdc-4cb1-8044-3a2fa49c9a70", "comment": "Malware payload (Mirai)", "value": "5c0d52657eb2645c323a12f835a48088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494870, "uuid": "f9f882bf-5ff9-467e-b57d-5480d9fba9c0", "comment": "Malware payload (Mirai)", "value": "05ed61f3d09cd646cccc6b0c3164ddb39a47084e328567986c0433a7cc545ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494870, "uuid": "bd1b4ba6-d63c-4cac-acc6-f76d71d55f64", "comment": "Malware payload (Mirai)", "value": "901bbc59a79ac136a8d73a8d3f2e40c728cb0c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494870, "uuid": "cfee474a-e78a-4369-a85f-70d8b7028a82", "comment": "Malware payload (Mirai)", "value": "4f824405d350475a9d1c7e4f63bb627e4573fc9e103bb694eaa71f5bc71355049a736d32350272b75dbe09707557feee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494870, "uuid": "db69cd6e-bb60-4c05-8292-ca0242725c5a", "value": "T1B2738D82FAC3C4F6EC5300B28037677ECB31E516903ADA46D75A5E31DE27661A71B368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494870, "uuid": "d47af51f-99cf-4140-ae49-8158c7b23e84", "value": "768:PzLfuv2EACJOlf5sWVTChK/VN3LgIxoh7ogwAJGfrLODhAaJUOArTooui7a2NJFd:fK2LlRsWQKg+ohNIMEvoLaa234FuB11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494870, "uuid": "4d07fe9d-b4ce-4fa8-a06d-7c0511239fad", "value": 77048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494870, "uuid": "c9fb140f-0606-4cc6-a5ab-68aeec35f10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494870, "uuid": "dbf2cd37-b490-4bce-95be-649631b8fc26", "value": "rage.x86_686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d55773-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451568, "uuid": "9f60626c-3e8f-43f5-93bc-f1bbafdbe697", "comment": "Malware payload (Mirai)", "value": "02dc8995f8368a4a8ec06b54cc2d780a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451568, "uuid": "1adeb1cd-b1e3-4445-9524-110868cb95d0", "comment": "Malware payload (Mirai)", "value": "05fc8f2dd981d9bd5ab2f888fc8f3315a374fbdbbd9c3831433d7a5c83ef23d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451568, "uuid": "60b24b82-e680-4467-8e69-4922c285bab7", "comment": "Malware payload (Mirai)", "value": "a2a5b976abf0ff2c262a49d625ca3dad30af1b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451568, "uuid": "dc83304c-4343-41e8-9c49-98bb227f7a48", "comment": "Malware payload (Mirai)", "value": "bbf3618b24cdfc2760e4a03cc8281ce22e240122c63f413eeaa4ceeba3d5044183a76e64a44f267474470a899dea2031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451568, "uuid": "f08ad629-ee1f-4500-b718-1e2e6c49c8ce", "value": "T135E2E1EE90267A86C4DE6E7EB4C7D3E14F50719134AE470EA76148C07EA2D2372AC53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451568, "uuid": "b956ef51-c123-4b7e-8bf1-bc2d366d0c40", "value": "768:JzR0ULedxsO58uAHQs+9LzlfimuhbwjDEVUQJr3ypeWto:ViUKDauAP+dzHuDiMupRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451568, "uuid": "75bfa9cb-58ab-45bc-bc4a-262fdc2dbb31", "value": 33316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451568, "uuid": "317fcfa8-4b12-4e69-93be-9ca423efb548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451568, "uuid": "dea850fe-e9a3-4b05-a261-f2b8262de9f7", "value": "asuna.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c15f7d8-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440634, "uuid": "bac57fc6-2b07-4a8a-b4a1-8f6bcb6efc06", "comment": "Malware payload (Mirai)", "value": "7ce6532af3916a744f64f615b9e1c830", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440634, "uuid": "b23d7e4b-3717-41af-a3b4-8adf95123909", "comment": "Malware payload (Mirai)", "value": "060c70cf43c93ff3abd7c741767790c37da6977a5dc5c78f3f1903ca3cbe5aef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440634, "uuid": "ee5d93cb-18c5-4c74-9945-0272f40c7039", "comment": "Malware payload (Mirai)", "value": "2408c43568725ac2ed76209f6213516e9cb4d635", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440634, "uuid": "b58c058d-43a2-4f68-9abc-33d045903f09", "comment": "Malware payload (Mirai)", "value": "c13564e8a870855fcdb5fca87424743458d8f87aa5369e6b58a6d68fb7f11f4cf41428aaf6863399a771824068a6518d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440634, "uuid": "3937a466-946b-4bbe-84fb-e00da23173df", "value": "T1D8E42955F8809F61C6C539B6F75D42A873074B79D3EB72069A244B343BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440634, "uuid": "292b0071-3496-47fa-a154-d182e34ce23e", "value": "12288:btveboe8B1rUZbahsuCpfJHzQYW6jbeFx+c6kf005X8pcpCjN:Jveboe8QZ0vCrHzQX6fDwfLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440634, "uuid": "aa2cc9a0-8eac-4624-88c3-d577024e3b6e", "value": 694840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440634, "uuid": "06634f41-9ba7-4dfb-b767-acc3f65fd845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440634, "uuid": "c8a9c444-d867-4e19-ac5e-43ca3ed4f049", "value": "x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657776b8-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777448730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448730, "uuid": "8bee1b98-1db6-40ed-8a07-fc4c73ad542a", "comment": "Malware payload (DCRat)", "value": "072b45fb8eabc0a6b35a66e8fac134e6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448730, "uuid": "d65f71c2-f38c-46d2-9fac-63d989425d4c", "comment": "Malware payload (DCRat)", "value": "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448730, "uuid": "c55f09ea-372b-4247-8c52-1bb5b41ddc05", "comment": "Malware payload (DCRat)", "value": "03ef34eb3988a671bff188d0d9deccd6b15a9a91", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448730, "uuid": "5a233543-4285-4b55-9b2f-c326738f38b6", "comment": "Malware payload (DCRat)", "value": "87a9a420d536ea8267e76c5e202322b80690379b0192f61d8112fc54f3adefc91e3df5945f5bec2136ff4b59595f4267", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448730, "uuid": "8391aa33-ad25-4861-958c-2c0d07710f84", "value": "T1CE555A027E44CE11F0091273C2EF454887B0E9516BA6E32B7DBA776E55123A3BD0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448730, "uuid": "73a96cbc-3c4f-4b7a-8ce3-e44a034aebb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448730, "uuid": "2806e65e-3f9b-4472-bb91-686321504280", "value": "24576:9aW+kpR3A6u2NTmjuj3IhW5WzYcsEhnIEwPbU64JitpEfYWY:9aHkpYC/Ihr4EhAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448730, "uuid": "1bb339d1-e066-4b76-b662-053829cc3066", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448730, "uuid": "760faaf7-def7-407a-b012-e312e2e2c7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448730, "uuid": "22263508-ea99-40ae-a3b7-e9ac8ec20bf4", "value": "072b45fb8eabc0a6b35a66e8fac134e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233ecae9-43d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1777471812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471812, "uuid": "f3c0713d-8a01-46f2-9d81-4ab98960ee41", "comment": "Malware payload (Havoc)", "value": "3fe903c9d39790de3bf6c1a8a2217d29", "object_relation": "md5", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471812, "uuid": "048f6df7-7026-4ea5-b9fe-cdf38068d08b", "comment": "Malware payload (Havoc)", "value": "0743154262c5ccf24794168ee331feeefc6539386715307ee44d5d9b6b321077", "object_relation": "sha256", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471812, "uuid": "0105cb3e-f55e-45f4-a0e8-0e6fa6fbc198", "comment": "Malware payload (Havoc)", "value": "1922bd8df7bf2964c03fcc7dff510e9ea283ae3a", "object_relation": "sha1", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471812, "uuid": "325d21f9-20bd-462b-a2f8-02f18232cb73", "comment": "Malware payload (Havoc)", "value": "66b1e924f97fd40bce958bcd2de237471e9329eeeb43a5a193adb5ad7228615f5028b18248caada34f96871ff86269c0", "object_relation": "sha3-384", "Tag": [ { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471812, "uuid": "d30e5099-6163-4112-9a04-94caeadc3803", "value": "T1A9B5D129FB934548CC3A41B1A5B8B304D561378847002ABE617FD9F52677E41BBAF38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471812, "uuid": "3d9b7d51-7fea-42ff-80db-a185822e0b6e", "value": "24576:DN+47oyrLhUM0VYroHgQHHpbCw+sYA/AnQMUIJDQQbetfJw0Uhza2z4Li42GD7Vu:DNoOeeusmYA/JyJD190Uhu557VVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471812, "uuid": "9c68ae6d-f673-40a4-b47a-71df35d4fc5b", "value": 2426880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471812, "uuid": "6d7c344c-9854-40fb-ad5a-c21528cd6ab9", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471812, "uuid": "d847c5a6-5b8e-4ed7-9160-f00149181cb2", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cd686d-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451574, "uuid": "ca9adfe8-a617-4ba6-afd3-5e469b029f2d", "comment": "Malware payload (Mirai)", "value": "f5b7e47d924209eea4f4daf9555b3d89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451574, "uuid": "d8449bec-dd4b-423e-b883-6cd101892f90", "comment": "Malware payload (Mirai)", "value": "07842517414eeaf9788c9024c1c9257ca26bef24dc35f285c3d142a916621ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451574, "uuid": "99c2fea4-9165-464e-a054-ece6561355c0", "comment": "Malware payload (Mirai)", "value": "ae553036f4d8980bc15054ccf28b9fd17744ccb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451574, "uuid": "a2e716e5-a62f-4bb8-808b-eb03de7d1564", "comment": "Malware payload (Mirai)", "value": "ced7faba31bebe4cf0fcad64e8b2e49aa2224339e2e10557da5a130f5c2fdb1c221274ee647f254db634b933155b7c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451574, "uuid": "12c93a32-48a3-4a96-b4ce-61fed902c5d4", "value": "T1C0B39DEBF34B11A1C45246F047C78B9D2D632281AF1795E77C2E2A7868B92DF4A05FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451574, "uuid": "12cb787f-5f0e-4bfe-b0d3-885048649f83", "value": "3072:cO5Gh5msMAiPmXtd4eJPcMgRqqr8igAXq:cO+mbvPa4eJdQWMXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451574, "uuid": "b5d55d35-67be-4801-b32d-bb7b09105ed1", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451574, "uuid": "f6634965-5fc7-409b-b31f-c0469c88f7ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451574, "uuid": "74b326ca-0a48-41b9-8fa5-cb2bdf438243", "value": "asuna.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4978415e-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470588, "uuid": "ebbf8970-a081-44c0-ad9d-a792ae4751c8", "comment": "Malware payload (Mirai)", "value": "fc7377b6813e8c007244f79578ffe329", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470588, "uuid": "b2ef85e9-cacd-4a3a-903a-6b81573f6caa", "comment": "Malware payload (Mirai)", "value": "078e27ebf7d0670e4d8d98ee110c065990417858110a607d04a617e3a17771e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470588, "uuid": "a64c95a4-4678-4393-810f-3583c95251dc", "comment": "Malware payload (Mirai)", "value": "ee515941dea3c3b06726e7b5a250d6c11180fb28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470588, "uuid": "fdabeb8e-7ee9-4a60-b131-ee0b57eb5f16", "comment": "Malware payload (Mirai)", "value": "4a89a6782f4b0bd6ed04f2275c692e5ce2abd0e8e659544cff637969d74d485df5145a0a9b912de6f3a5a02bc8e4aaf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470588, "uuid": "a615201c-d846-417b-a9f4-2e04ddfc8738", "value": "T1A4733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470588, "uuid": "34eeeb7b-6ed7-4a25-834d-07ba06f703ae", "value": "1536:+pwtq/0FORx0SFXyRwBjniiQv1MjDPKM2nu7c+GYgKCqWU3cgi3:+pv0QRxJcScv6fSMrjGYgKMEnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470588, "uuid": "1fea74ab-133a-4cdf-bdee-59e2eab20918", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470588, "uuid": "6bdb7f21-f4cf-42d9-a608-280c4d47d077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470588, "uuid": "d14717f8-fed1-46bf-959c-aef85dccf576", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0031a531-438d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777440829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440829, "uuid": "6a737ca4-ced8-4819-b15c-5a2fb9d36607", "comment": "Malware payload", "value": "e47127856b879178c925560059a1d72f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440829, "uuid": "f1096e03-f6ff-4386-9f35-d059cb716be4", "comment": "Malware payload", "value": "07c9b54d8d32fa387b5e40c1107a4fa4a1feadb56305178e3935d36676d27f5b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440829, "uuid": "a6f954a2-04d2-4eb4-aa84-a6c935ee97ec", "comment": "Malware payload", "value": "912612f9cdaf321547abbe9378419c770d1d08d7", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440829, "uuid": "e7443cd0-165e-4a7c-9a31-93850d284634", "comment": "Malware payload", "value": "285f10fcd99c708b7233d74fdda8b25b596013ab3ace7dc57c9bfdd2eef748a722236bf5f21bfe5a41250ab3e16a374f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440829, "uuid": "2649563f-9df7-4f33-9bea-1b1fb35514f8", "value": "T107D3EBD899EB8CA48F1F6468461F5C178A9DE923031DC994FADE9FC43F015B035BA9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440829, "uuid": "8166635d-07a7-4ae4-b9ab-a075ab4070f8", "value": "1536:cYFTywLEETNkm6c7nPVt4hS51Ln1L+cd/41uf9/hrAjTPvolQAz5Q/B:lxNkm6c7nPVt4h91uF/hrMrog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440829, "uuid": "83d20ce8-7370-4931-b512-0a37be1e6601", "value": 133659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440829, "uuid": "90996ba3-872d-44a2-bd26-bf595b59b3b1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440829, "uuid": "d0aeab7f-fb6b-4996-90f2-871517ca2e1f", "value": "Dataset_London__72.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ba2156-4393-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777443652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443652, "uuid": "c8406eaf-9e73-4e9f-9147-7aec1f23725d", "comment": "Malware payload (Mirai)", "value": "434d2be2df07d43ffc891d6ac18d2818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443652, "uuid": "bc69bc21-a8ef-44fe-80a9-9e7548d9bdee", "comment": "Malware payload (Mirai)", "value": "07fe97122812da1bbbc9ace1ad9e421874674403556b853efb6a9e2bbfca64d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443652, "uuid": "33b3cbb7-de8a-4110-8761-861d9fdab215", "comment": "Malware payload (Mirai)", "value": "38b8791c8396d1df5ebf7d832b32c1161c1fa0ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443652, "uuid": "748f1870-4f36-4fcd-ad5f-27ca1ff67f86", "comment": "Malware payload (Mirai)", "value": "ae826c23eb5ef59695e9616a20ae4b300514340558f94f36df16b69a1b00b287c13cb32860afb944d02b0944a24970d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443652, "uuid": "91e21ffd-3431-4fb3-ba81-687f17d56188", "value": "T14A430891B8819A23C5D4137AF5AE56CD372423E8E2CB731BDE214F5136C682F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443652, "uuid": "678fd790-e164-4d0a-ade3-8fdf1508125e", "value": "768:PVQoxeQ7ApJiHB6glNfw+84psrFjuyoPirTNc6VB+tzR/iW1mA2EDEy0eYjW9THL:Woxergl6+8tFjpoPivXgzA/LCf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777443652, "uuid": "9fb801e0-c38c-4111-8600-9699e2ce8dc4", "value": 56080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777443652, "uuid": "49412ea2-ec1c-451a-9ddb-774ac86d9f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443652, "uuid": "0727b44c-5307-40e0-851d-c5250e3e4056", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb3ecf-43f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487127, "uuid": "46cb2c0d-4065-4c38-b5d0-f63bd591a12a", "comment": "Malware payload", "value": "4fe8064d0242ff07886282a0c302bc11", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487127, "uuid": "ff19b16d-ade3-451c-852b-dd383f761569", "comment": "Malware payload", "value": "0ae6331c7e488dce88c1a1b504e2fa3d43f674b0b3e5398e9d18c04ca6e860ac", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487127, "uuid": "289f6f87-77bb-4235-9ae6-523cab49947b", "comment": "Malware payload", "value": "079a196fe660920b91dd22da4ab6e0169f1e8eee", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487127, "uuid": "1cb2efdc-dabc-4780-9af7-581865bc7034", "comment": "Malware payload", "value": "373b93b2b8d313e560412c286e9a71e4eb01057dce58b673253ae1f134cdfa937fdf14f8b90559cb497fb72cd7f5ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487127, "uuid": "80d3aac7-d7db-49e5-926a-eeeb13e7083d", "value": "T1C3537D1BE31725B1D70CED53827892D09CC156AA6FA613B58F3D3521318AF1ADC7B0EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487127, "uuid": "cf62408e-130a-4d58-91b1-9dbc39575907", "value": "1536:/zo40t/EZFQUOGpI2kd6vVeRWv8jXLZ//lByc5j:50t/S/wd2eEUH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487127, "uuid": "5e2ecfb3-2535-4c3e-886d-c016400cab58", "value": 64608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487127, "uuid": "e928800b-11dc-4d91-ac96-2ce33cf19905", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487127, "uuid": "a4742b79-f0f6-4431-8faf-0515ace75fae", "value": "ecabe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba7fd3e-4366-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777424098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424098, "uuid": "3dee8ffc-56eb-41e5-b5c9-fe8c0c983998", "comment": "Malware payload", "value": "5d5a2ac0acb770d3fdb4cf3a0f0cad55", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424098, "uuid": "461e26e3-13f4-4952-94e1-3dc67d0807cd", "comment": "Malware payload", "value": "0b3359355ee28e517b7959afb1679f932a0fdc48eb3d7e6f30fcfa88d0867c8a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424098, "uuid": "57eadabf-5bb4-4f7d-983a-6662721a9c5c", "comment": "Malware payload", "value": "f8cbecbc251efb5a8a139bdd00c0e840be1201c6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424098, "uuid": "92aeb24c-020a-4e6e-9b79-cd28dc21988b", "comment": "Malware payload", "value": "fe97243eb9edd0b3b4158b8aa013f51eee6bfa1282ac1b160838350ef82c6cb6193f5c657344e4cae75315e2241e3f45", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424098, "uuid": "943a2ba5-ffe9-46fa-a4ef-c77be424ae85", "value": "T1C3F60267D748A12EE0280D76FD31E5BC503FA66F791A480AB0F51D6CCB2B5627D2E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424098, "uuid": "7f912e54-a5ef-4a79-9029-5d180a2c2d23", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424098, "uuid": "c25e1978-62a8-4a74-ba06-676ba638e4e3", "value": "98304:xL8Ncwa6AEouGQGLDyR94UhsqwScBY4JSE2L6zBV:IL8EQlnycUhYSZ4T2L6zBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777424098, "uuid": "a941f431-4d45-4797-baff-d0ab4beb6086", "value": 15279067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777424098, "uuid": "7c0d24c1-0530-45f5-a615-652f9de3de03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424098, "uuid": "386e5bbe-c024-4d8d-ba02-e8727e7fc92b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9af023c-4422-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777505216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505216, "uuid": "0ea5080e-e905-4432-9bb6-d8d31470d8f8", "comment": "Malware payload", "value": "1282736b9547394d15ffe620fc9ab179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505216, "uuid": "3903d1de-fb89-4663-a779-b36c1080d1bf", "comment": "Malware payload", "value": "0b5f3c0ec7162fe390af8cf6bda06a551eb206e7ea354a61fa832d07e0fe6dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505216, "uuid": "2c057de0-bc7d-4309-9574-155d7c5206c2", "comment": "Malware payload", "value": "1b4b63c3ee6d344a7de4267f4c6ef1c7d9e74d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505216, "uuid": "0e98b918-860d-4d99-9f23-bcba7da8d9f7", "comment": "Malware payload", "value": "795e444fe88f1f84f09eb353bb5f85a04b995ccd8176e385da2b0ff6df821ce96cd7d09d77220b843ce177ffc966b184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505216, "uuid": "f53b68ea-827f-4915-97cb-2e2042dbf738", "value": "T1D4A57C0A7C9144FEC096773248E272A1BB70B8490B3667C71F926A783E77BD05D7A709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505216, "uuid": "c27696a1-e997-459b-a314-187d9a923de0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505216, "uuid": "a762176f-41c3-4c9f-aad3-a9402bb0ee4e", "value": "49152:IhiB721uTzMOKMbvYi8FFj3bAOeu/18aed0W:IhSnAOKYMlbAOeu/18aeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777505216, "uuid": "c20fab27-36d9-411e-bbec-67915647dcd9", "value": 2187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777505216, "uuid": "3a070cb4-72c9-4227-abb1-e31feeed64b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505216, "uuid": "ab365092-966f-4f8f-a730-ffa8034e1f4a", "value": "Silent_game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023b749f-4400-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777490225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490225, "uuid": "9532d488-390d-4424-b1bf-5218f1ce4e46", "comment": "Malware payload (AgentTesla)", "value": "bdb9c5a3f4a6426c004bdf3265a08ea5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490225, "uuid": "d5c66c04-5721-4d97-882d-6be8e4802744", "comment": "Malware payload (AgentTesla)", "value": "0c14d699e3a268a09d461786a335785ef818c311c4f43f6efde1a28e6f23b71d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490225, "uuid": "ed7ca8a7-8cb8-4e7a-86ef-76789c2b2ac7", "comment": "Malware payload (AgentTesla)", "value": "07696ee1d5713acb9ed7388c8398ab3a4192cc4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490225, "uuid": "d2e1b4dc-2c3c-4fae-9cec-f25697da8d8a", "comment": "Malware payload (AgentTesla)", "value": "9e7c2be564d5e36a18eef55ea9b4781920ed68d6012dfda2c5ee525fcadbe6fc22467dbed9c569c2750e7da7b832abd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490225, "uuid": "51f8754b-2074-4ba3-8f7e-6c7e620c85aa", "value": "T1C935232068901CDD4B28C7BD607ACE62E9910F35CA1A3C873AF141579AAF791C78FED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490225, "uuid": "c08b128a-3046-472c-aec1-c1b5ad12e1a9", "value": "24576:wfpt6YcbrtDnp45uv96VL3wnxV0HDpHNJv/Jm8hgpP1:wncbp7sYb0NHfvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490225, "uuid": "d5b9f1d6-23db-47eb-ac7e-8e0d302c3c59", "value": 1070696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490225, "uuid": "53f2f3a0-3fc3-4507-b410-6ca73f0634b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490225, "uuid": "3d2ce48e-12c7-48a0-95b9-b6e555702a87", "value": "ps_siB1QD91BhCP_1777486468964.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce1ce4e-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440636, "uuid": "5a29648b-9bcf-4ea5-a966-865a219d2b5d", "comment": "Malware payload (Mirai)", "value": "d0d490458be6db158be03879bfb6640e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440636, "uuid": "b05cbf61-d716-4f10-b9a3-c2e65cb498b0", "comment": "Malware payload (Mirai)", "value": "0e05827c51c11d38205af73dbe8ee2e2a62c6e5ce0d403f9afca21133ad51946", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440636, "uuid": "0a219cff-4121-4401-8e03-25fd0d681bcb", "comment": "Malware payload (Mirai)", "value": "35914ef588ddeae50ae90e287362ce7e8e225da6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440636, "uuid": "7459165e-7f8e-4cee-96e0-d41d0d265020", "comment": "Malware payload (Mirai)", "value": "bf4f70364f30ff6d75c9f2794535045097b3621e48d63f72968dca4eeb8510ca8918ff2c2d216315168d2ffbde766340", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440636, "uuid": "5653aa28-d2ab-4458-ab8e-9fb33db4a57d", "value": "T1BB056B277B11CFA8E314C27009F3CA515AE521A61AF25489B2BCD31C7E6162D2D5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440636, "uuid": "caeb64b9-33aa-42fa-bc79-90680d5ecdc1", "value": "12288:wDS4eaOO/N0tKYCjKdwZoBv3FzUCdRrJk/UIjUAQWlFePCqMB2J8p7gUZUjMx:ES4eaD/N0zIoBfFwCdRrJknZQWiGeUZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440636, "uuid": "f28bcdb7-ceca-4e85-a8cd-7de7d45418a4", "value": 858760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440636, "uuid": "74d575f3-3787-40cf-a8e3-354e73b264f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440636, "uuid": "3d034683-ce26-4285-9f82-ca94b554beec", "value": "x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6c845b-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441360, "uuid": "fabdb74b-2300-4c92-90c4-b8ca154ad15f", "comment": "Malware payload (Gafgyt)", "value": "2eb0c4be8008dc2fa3d003cde283ba8e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441360, "uuid": "fb722c33-dcec-4889-ac26-a47f5c9b3578", "comment": "Malware payload (Gafgyt)", "value": "0e806b8dca46b39d4c3cc4f7f74ea6436a0330a981adee4961b9dfa688097e6a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441360, "uuid": "439e651d-218a-4da2-9ecd-01d26dd1119b", "comment": "Malware payload (Gafgyt)", "value": "fe09509e3328d32418150c7c039e01d9b57e384b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441360, "uuid": "6dc9f168-586d-41de-9d88-f05201d5705d", "comment": "Malware payload (Gafgyt)", "value": "9391769d97620dee01da2a92da76dbe447b86d16fb5b983c4d21db8d4fd6d24a62bc25c87b3271696e4408d712da7de8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441360, "uuid": "b33d3f1a-71b2-45dc-950f-36a4c75001fe", "value": "T19FD33B05E8509727C6D227BAF79E428D73335B68A7D733115A28AFB42FC1B9D1E39021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441360, "uuid": "5d1e6da9-b78b-4357-b65e-581ee54f3fe7", "value": "3072:8pfNtKdcp3eQwPGyxPtJa2mgQupNOXPxux45hLturOw2gicfmyhQCYMhEFg:oyxPtJa2mgQTuK5hLt0O0myhQCYMhEFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441360, "uuid": "9f0887bf-f90a-40ad-bd5f-794d4052792d", "value": 142847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441360, "uuid": "7af4c26c-7273-4151-bf14-1b12ac91ab92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441360, "uuid": "ad67d09d-5771-4085-bc11-a7d343122790", "value": "assailant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9577b04a-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440650, "uuid": "c8282fc8-970c-4ca6-aff0-e287ee7d039a", "comment": "Malware payload (Mirai)", "value": "e151f253fb38e179852a34f8f37870ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440650, "uuid": "b5caa1ed-3ade-4f2d-b5ba-794c3c01e12f", "comment": "Malware payload (Mirai)", "value": "0f78201a163c7032d4427ab5f82df55306fc18be3130d8bcfd0cdb3d9d3ec113", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440650, "uuid": "731e038f-a47d-4133-9a0d-b5e350fb462f", "comment": "Malware payload (Mirai)", "value": "8912142c2ee312c059e1058f6bb6c36fb0a63858", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440650, "uuid": "98d2865a-bb32-4d62-b586-b3eaf3b3328e", "comment": "Malware payload (Mirai)", "value": "b6c7188fe2cd5fa03fe124cd1dcc70ad3e0468290a9f4eed9772c59b2f8e36c6d756027a6fa300ae9c80893fd1086afa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440650, "uuid": "8af1f707-47c8-414a-aea6-ba549f3f0463", "value": "T10C6312E02BB5178C1276E8393ADE306F8124622B379A29241DD791CEF85B7039573DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440650, "uuid": "55ee73e0-f8a7-4c93-9687-46d809328896", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzd:8D+CAXFYQChaAUk5ljnQssd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440650, "uuid": "1e31ad35-66f3-49e1-a590-3f099446255f", "value": 72186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440650, "uuid": "fda0126e-281d-485e-91e5-6b14a053ccbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440650, "uuid": "fc7c5e04-b1ff-42a8-81eb-38675acccea3", "value": "mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9d8805-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "c9417dd8-f9ef-45c9-a118-db0abb53c58e", "comment": "Malware payload", "value": "7f906ab14e54ae8534cf33db7e1705f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "15b6c3e1-9a0e-456e-a1f7-374f61b17788", "comment": "Malware payload", "value": "106803719e4aaf7439378baa6a6400d7b40ea0e71fa0f0d5199a7037a6e1a470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "c3178820-db7f-423a-9c88-aa760ea7f39c", "comment": "Malware payload", "value": "ec4f2e5aff83f789e702a52eefbb100c7d6c233c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "974874b2-f17d-48ef-9da7-163fe0640b31", "comment": "Malware payload", "value": "d581884804e06f86c7286e5db4bfd3465ce2d2b07b97ab5da9d1b9316f4aa992d267c59a3403f88f61c167d99cd75506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "4ebc0e6a-6f50-4566-958f-4d0f457f262c", "value": "T1A6183343A9F9DD63D5EB6F3067F001E3919B94C61988089A95463BFAFACC2CE115C332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "62019f1b-5d8f-4bf3-bc92-b7a44ac01fe1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "29686b33-9f9e-4ebd-b9f1-26e9b8f41a58", "value": "1572864:TD2YVsHauCo6FALauLYbTWhEngG0PXJIfKWcT/bkRV:TD2YVs6uCHWX6TWDIfK9rYRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479991, "uuid": "db62b944-849d-43c1-b46a-0fb61d185e17", "value": 89221112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479991, "uuid": "9ff335f7-0450-470b-ad25-77bebf158d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "9925171b-3801-4e85-b0de-79b3ce1c89b7", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf13370-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777448716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448716, "uuid": "3b6eff15-bf68-4873-ba9e-75564fefaaae", "comment": "Malware payload (NanoCore)", "value": "a7d758a63249f1ac40f950f577fb12e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448716, "uuid": "f1ef0bc0-e25a-4763-9a96-59a7c3ab1a13", "comment": "Malware payload (NanoCore)", "value": "110030d023a26c770d0591ec3bb4d8a82e1f236960f616ec446543e683c9b627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448716, "uuid": "a9067ad8-c143-420b-8bb3-675759dfdc39", "comment": "Malware payload (NanoCore)", "value": "8ac852b3e2a7b2b5d424393573f3342a9b85781d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448716, "uuid": "e6e82b92-0b81-405f-ba5d-6df48e24fcfa", "comment": "Malware payload (NanoCore)", "value": "0c6527a17aaf068a19e21bddadaff15639385857fc8a401e94d77eb3193890598d96db66dba3d43ded69d3907546942c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448716, "uuid": "4d066192-3937-48f9-8695-9aa7ee097beb", "value": "T1A914CF1677E9892FE2DE86BD612241539379C2E3D8C3F3DE28D415B69B263E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448716, "uuid": "600f64d0-86e8-4cd4-9275-a3bf69cc91c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448716, "uuid": "b19a304b-4344-4138-907b-cfc23edb4e5c", "value": "6144:MLV6Bta6dtJmakIM5PUBPnGZd3wwMi5Tc:MLV6BtpmkkMOhwwMi1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448716, "uuid": "dc9f9e90-e16b-4598-b16a-c5559ee7de85", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448716, "uuid": "147be070-b414-491c-8c1f-68f552233917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448716, "uuid": "7d89f6bb-2d93-451c-abbe-428d2efb8a1e", "value": "help2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c0501a-43ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777467118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467118, "uuid": "ab20e513-20ee-439c-8290-01a178bc3eed", "comment": "Malware payload", "value": "0ee875c8232d83dd7d487a5d019d633e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467118, "uuid": "fe549195-5c62-49c2-8977-63201e80b005", "comment": "Malware payload", "value": "1133d3c0de6fd0d5f2dc036ce04eaa88f0b388c4bd88ba703afd0e53e6147d78", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467118, "uuid": "88349e74-9773-4849-aad0-c48fc6623f84", "comment": "Malware payload", "value": "9fdc9995121e86918ce9c9d34cad2c95cbc7e0a6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467118, "uuid": "d855a7b5-3435-41d5-81d7-d938ce194256", "comment": "Malware payload", "value": "afb9cc8697d5bfd3dd476e9809ccc3f91f882c11944164ed2b838b1b1b4c7920ef9ebea60fc9ce1a79061b8c55b7fa55", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467118, "uuid": "662ede60-a5f3-447c-8476-f590fa175d53", "value": "T1C7437307B632A0D9D4B9D03DA6A6B232F8703C5C8B369BC79B1246271724BF5B53DB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467118, "uuid": "9766f36a-72ef-4a45-9475-17a03e65bf47", "value": "2db40272b3ed1a1a576dba195f9d109e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467118, "uuid": "1a2602ed-370b-4c7d-8a5e-38eb06eb02fb", "value": "768:D9GJV6a1+S5m6fMT6s4wffMZeFXt8Bh6QFIDGJhf:ZGJV6a1NMT94Qoj+Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777467118, "uuid": "47208ad8-519a-438d-aee4-13cab46ee0d8", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777467118, "uuid": "4cc0969d-d8b6-42a3-b5de-eb02df3e7889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467118, "uuid": "e29b1db2-ec6d-47b5-b73c-2b8b09b41a14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001d2c96-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451567, "uuid": "22fbbded-e221-4b92-8a81-ad8e3ba70f56", "comment": "Malware payload (Mirai)", "value": "1b7159879598c7b0379cda28c8d06079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451567, "uuid": "25b8047d-7089-4322-be99-dd23b133866b", "comment": "Malware payload (Mirai)", "value": "1143aa0aa41d9ebbee4c37dda59ab92241a61589c97aa39d948390c118fbef29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451567, "uuid": "73448a36-51a6-4a46-9480-80a7c20961e2", "comment": "Malware payload (Mirai)", "value": "91dae0ea231f1b8ac304eba397b8f84263e5719d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451567, "uuid": "3b02c9c0-6397-412b-9a45-49b07e6b5dec", "comment": "Malware payload (Mirai)", "value": "b3e028cd53aec00172c32624213a9db4e4e3e4842bc7603dc91270bacd85586d01c7014d29ec5719e45a01a944858aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451567, "uuid": "6bda5edf-8ebb-4b9e-a808-e4ae2973ae30", "value": "T1F243022A7F118446E0E5B63352B41C11F9EE6FFE10E1B0672916DF38DB95F186AB0E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451567, "uuid": "29fcf4d3-c3d8-4e2c-a906-43f9a3f82504", "value": "1536:ReQtRSIvDFrHP4XcLyaIQWwCeLhfGFfRxnPGuUW:5vDu6yhwCeLdGVvneuUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451567, "uuid": "a62f3755-4b77-41e6-90d1-a9b1b64aa120", "value": 57424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451567, "uuid": "a1134f11-0491-4fee-9f2f-f3a8c7b41264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451567, "uuid": "12c1a9ce-b697-4a4b-bc5d-0b26726b2eb9", "value": "asuna.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f374af03-439e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777448539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448539, "uuid": "2ed43ec2-9b24-4dd9-abce-cd35050d92f5", "comment": "Malware payload", "value": "c182cdeeed33fb0e92bcae2bd7db97b9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XDSpy", "colour": "#E87B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448539, "uuid": "b437dcab-fbbb-4f3b-83b8-c205d99cc14c", "comment": "Malware payload", "value": "123bccb921a14219ea7fe358ed8a2a67de485220a4423198a59f6b5db10fb11a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XDSpy", "colour": "#E87B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448539, "uuid": "6daec9aa-e0e9-419e-a680-2f4e0edc6963", "comment": "Malware payload", "value": "9c9afa623ffed81d4be6e86553d259626f4842bb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XDSpy", "colour": "#E87B54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448539, "uuid": "5c93c5a8-aecb-46c2-b3a3-65382a95bc1f", "comment": "Malware payload", "value": "ea99b43d397291d8da7d77cdbdc6e9283b43f69aa3b5037efccdedbcd66bf56d0b7a98c109386940f8e0f8e4d829ded8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "XDSpy", "colour": "#E87B54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448539, "uuid": "cf39fb4f-58bd-4737-9578-a5f17d2be5af", "value": "T17F11669BF80E54A25507B79564EC0EA334A0CC412026BE11B3B1C83F31F75CAB1A66B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448539, "uuid": "d268d4f1-c296-4aa0-b624-249b4e5b9bd0", "value": "24:0OYqOY2j3OY5OYweAOYJBmOYlHy1GIoHocFOYJKpXOYw+FB2OYTOYyOYH:0gcj3/SeApmLWXS+X21ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448539, "uuid": "1350bc2c-90c8-411e-aa32-892bcd9e981d", "value": 865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448539, "uuid": "ffe6819a-bf7d-415e-99d7-b6c421d397f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448539, "uuid": "14c500b8-f31c-4575-93fd-340b8eca15bc", "value": "whatimean.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa491d24-43f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483769, "uuid": "f8a211e6-15d0-4aa2-90a6-11ad6e59595c", "comment": "Malware payload", "value": "6fd995161aee23804a6fc4fb3a3d9c4b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483769, "uuid": "21e57cdf-1f5c-4714-b112-ac3f6d434947", "comment": "Malware payload", "value": "12c96ec91705d12c6445152adfc218793a47c2be2d057f99346b1beb7852ba66", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483769, "uuid": "39a979ce-0755-4fb5-930a-93c55ccbe528", "comment": "Malware payload", "value": "3e32c7111ebced13092f4a71a88b9fe1b1900fa1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483769, "uuid": "baf3a178-e2dd-4221-9e48-245fe8e4079c", "comment": "Malware payload", "value": "e46d728b553469d03ad2c8bf8ea4673ade6a1da1d999344095a9ae3b98a56462ace283c612c1cdd2f59adc08dc2d7d6e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483769, "uuid": "88f6e6aa-1540-4a61-9f04-f276c06aa7cf", "value": "T1AA23F0E313AC0AEDAB8059D6820D760748FBC27B2C5D518DF9E25A47F13E921B616F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483769, "uuid": "c4e578cc-2ed3-4bd3-a1af-b69e6abc6eb6", "value": "768:UgWNtOGnKCrIcbjbikMDCo27/geoyspkkOyFFzE0c2:QNDnKCrIcbjbikMDCo27/geWkkBvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483769, "uuid": "ce4d17ae-fb16-4b38-96e3-1b1ea7b4b686", "value": 47176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483769, "uuid": "5ec0c71c-2554-40a7-ae5a-4132ced0bd37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483769, "uuid": "77ee1246-83fd-4351-becf-ebcc601dcf47", "value": "cl-ncl-start.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006ef246-43ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482920, "uuid": "23a21ca7-4ff8-47b9-85ce-cf953052f5e1", "comment": "Malware payload", "value": "48e757c227bdc2b5402038f4e6e5f036", "object_relation": "md5", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482920, "uuid": "ba3ce7c6-b5d8-49bb-9d8d-07e9090ea18a", "comment": "Malware payload", "value": "12d20fc0045eb4aefbeef0498e9c787c7ddcbeea433f99d9430e995a23f63b58", "object_relation": "sha256", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482920, "uuid": "f5413a9e-26ae-4ff7-937e-72d5ef8a5af4", "comment": "Malware payload", "value": "83d10f96dd98a9350b399a3b7c99cc29c21c8343", "object_relation": "sha1", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482920, "uuid": "0ba473cb-8abf-48bf-b5a9-941349dabe78", "comment": "Malware payload", "value": "6cec2c4785ad1c55fc1156c6e314a97d7a1a4efe66fda2e3df8ac01e6821c5284177536b196ee8ba833a7087d5ef981e", "object_relation": "sha3-384", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482920, "uuid": "c5cbe5f8-9cf4-4b52-97cc-70249d72a491", "value": "T15A7302D717D90EEE9B9199D6C28AB60668BBC07B2C1D128CF5E24647B03ED20B715F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482920, "uuid": "e9f08597-b65a-439e-ad07-d21758df3bb6", "value": "768:bQx2uDehSMCnONhlJMKe0FIiBJt7LsIXIQHxg2aU8O8Av4pruUYfkdc4GsQh:eF8hlJNzyqxg2aU8OX4prupbsQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482920, "uuid": "fddcb0dc-e08f-498b-8545-a1b8210dd478", "value": 77685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482920, "uuid": "076ead99-168c-455d-a2dd-9c584dd66765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482920, "uuid": "69bf37f6-abb4-407c-addb-3caa6c20b9de", "value": "seo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb37eff-4416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777499722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499722, "uuid": "a6b9305e-103d-47b0-8b4f-c2d524306a54", "comment": "Malware payload (Mirai)", "value": "6000d7e19d4a22abf218eec3f36797d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499722, "uuid": "009f2d3c-14be-4567-bdcc-a768edafb9a0", "comment": "Malware payload (Mirai)", "value": "1319fc34a179751881b02a64be28a48be30ec0aaef7100e964995d60ed478973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499722, "uuid": "25dad867-611e-44d4-bc31-5a12dae8304f", "comment": "Malware payload (Mirai)", "value": "c13dfecc8263cceaf88ed88db759b38d11d70ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499722, "uuid": "58b15e92-978d-47a6-a212-fafb29c80295", "comment": "Malware payload (Mirai)", "value": "59fdbc8b7068695ae89cca69c51370ff578546d6de29a0dafa34288c07870ec4dce89d89c4977584f240f518d9d185a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499722, "uuid": "468a0b11-3888-4d1c-984e-959f6f44bedc", "value": "T11AC3B91E6E21CFBEF65A837407F78E31965877D62AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499722, "uuid": "ceb7f312-16fe-4eb8-a240-7516c7f45a96", "value": "1536:Nw4lPfv7d7Y/YLEdso1LVNyHvftEiAxfDIs1ISFl6Sae/NufhaR:blPfDdMDdso3sHvftaxfDIsRcS2haR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499722, "uuid": "23e6f7c3-55c2-41a3-82b6-c4bee6a4cf6b", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499722, "uuid": "277938f4-41cc-4570-a630-77e78d84541a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499722, "uuid": "8315678d-eb6e-422b-8066-277305291952", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0402ef9-4373-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777430038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430038, "uuid": "b6aca2f6-2eba-47cf-85b3-68e8555ccb59", "comment": "Malware payload (AgentTesla)", "value": "cf49a181ccb6acc7361aa40dcfb4ab46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430038, "uuid": "e8d46018-4c94-406a-b951-ca4af38c9733", "comment": "Malware payload (AgentTesla)", "value": "13a62292bc7cca51bea58a94a8bdb609f10b23376a1c940b36c3453d95a70e9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430038, "uuid": "0961ebd6-d735-4fd2-a63e-394a63dc2e21", "comment": "Malware payload (AgentTesla)", "value": "d3ce1ae68e3cf6f201ebb7728b753c6ab0090581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430038, "uuid": "a4e7b038-cd80-44e9-a804-7158cf0a959f", "comment": "Malware payload (AgentTesla)", "value": "d82c3e495e4f83ec4e40bf00d55fbae7ec99e647e996f9804456e76a70a566a6c14d23f960985a70fb761eef8a99383a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430038, "uuid": "f3c9d78d-9a61-495e-8ee8-0fcb6f786bdd", "value": "T1DB85BF15B3C85BA9D85AC534CA27A722D2B174260772A1CBFE9623491EB3FD11F7E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430038, "uuid": "047ed845-3c99-45c6-8d97-3dac18e9eabf", "value": "e69ec9920252efc67032a564d752219a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430038, "uuid": "1f40d761-777d-4973-9d4f-c2b2de7a0d57", "value": "24576:VjTqq90OJmKFKcDsJbapynEUGUN1Cd+a9BEZhVPzV2JByCQIUZ4TRLq:hTqq9XFKcDQbAyn/cgEE1PaomTRLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777430038, "uuid": "e766f59c-01e6-4a51-9df9-4438f798beb6", "value": 1803776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777430038, "uuid": "523f28b4-98bc-4816-807e-2365508107c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430038, "uuid": "4f95ba66-fb77-4195-b942-f2c4b0538923", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cad5681-4413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777498564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498564, "uuid": "e8dae432-ed63-4863-8609-49fecb5f3c67", "comment": "Malware payload", "value": "9cf71a6a4c4d871006e8a4c517bc062c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498564, "uuid": "1f19d662-34d5-4d49-8e0d-f58e0113f9e5", "comment": "Malware payload", "value": "13b9a3a7a1fca6fc88ddc0e20cee94f6ec10f7fe7b62fec9d1e398dab09de4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498564, "uuid": "937fa7fc-0d80-41ae-a2e7-042bcf96db0d", "comment": "Malware payload", "value": "092bf8a1baa67dae6b98a74bd8bdbfc601ec516e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498564, "uuid": "ccdff4f7-c85e-4dc1-bf7f-ae918d1ee3f8", "comment": "Malware payload", "value": "b04aa7143c5fdac81967396109f68c0476cb648ca15765be5c105856e8f3884d6f1682c3a9d2293715523705b0750bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498564, "uuid": "441a561f-0419-4fb6-a5ee-c73446b511f6", "value": "T155C53917FC9558F5C0AE9232896295567B34BC480F3123DB2E51BABC2FB6BD09DB9700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498564, "uuid": "53e6c20a-18d4-4be4-9f34-8a64191fd962", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498564, "uuid": "fb40f5a8-d555-45b7-beb6-985c22407746", "value": "24576:0JJL1TIebkqY+jc0pHvuXR2fEb0P4Kw2QGSsmdzq+Fecuvs9dPYfPoWrQ3zmzPab:0JJhTIebkqY+jjuEMb0WGSTd3WsZWpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777498564, "uuid": "5f9d4ea0-e340-488b-abf4-470012b0595e", "value": 2586624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777498564, "uuid": "b2834d0c-9ea6-4710-b97b-fe44bd1c050d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498564, "uuid": "35287564-b0bc-4284-b26d-76ea25db56e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fec669-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494976, "uuid": "d3a93ac4-dd67-4cb1-80ac-a2666816bb1f", "comment": "Malware payload (Mirai)", "value": "91cc7502a23e9fa6ce530a6c611abde8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494976, "uuid": "2bf72b37-bc85-40b0-b30d-0ef02d82155f", "comment": "Malware payload (Mirai)", "value": "14af1db05ccd96b327ba4cbabf8977d1311985916224a665684b1dcc71752c45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494976, "uuid": "9fe00b3d-7b81-4358-8c8e-6a2e6f8c3405", "comment": "Malware payload (Mirai)", "value": "bcfda0df43082ef7acf2cbf3d15705aed01cc54e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494976, "uuid": "cf9d18b5-0c91-4c09-bcab-506ae647cd81", "comment": "Malware payload (Mirai)", "value": "ba85cbb7ec420a1804572f624b03149bb682a29ebd5f022d8b39e3ddf9f8dc58a7f2a9426485127f34bb3d4994b469d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494976, "uuid": "e5dad03d-4007-4caf-9d42-b28bf71e6817", "value": "T11783190377094F03C16329F0267B1BF097AABDA119F5B684752EBEC59271DF22182F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494976, "uuid": "c7f15d0e-b839-4d65-bc06-618e9581c64c", "value": "1536:cLItDM2wcb2owb//uQOilzeqyObqEejWmJqRT26MIXbospB30:coGoEzxKGmD6TH30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494976, "uuid": "843dd9f5-6c22-4cb2-95e8-a7f74d59cdb9", "value": 88708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494976, "uuid": "91912e1f-7ff7-4a6b-b6db-3d2bf30bf3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494976, "uuid": "4e29f6e2-335d-47ff-afa2-d3c14443c029", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960cc849-438f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441940, "uuid": "65f82f9f-d84d-439f-a5cd-93315f980f50", "comment": "Malware payload (Mirai)", "value": "8339a2c770d875fe14d82bd583456083", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441940, "uuid": "a7a1258f-9f72-4d01-bcc1-2e41d8ca2222", "comment": "Malware payload (Mirai)", "value": "14f3f39158aa6b9c2f08c52b4a98ae4784d36b30c8d85cba1bd859ca34d7c8de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441940, "uuid": "7ba0a8e9-9b27-40be-93d8-0c9377635f4e", "comment": "Malware payload (Mirai)", "value": "7b409cf352ee15f6225536ca06bb8889921be04b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441940, "uuid": "e2dba080-f02b-495c-bcef-83866b05eae6", "comment": "Malware payload (Mirai)", "value": "c163f87f4dd493b0eeec76a9146f7af6aaeed7857de267595b862542b6e165678afcfc3259a770122e0872cc62333521", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441940, "uuid": "a6ee4da4-a897-4703-9f90-c600cc931561", "value": "T11F057D89EBC7D4F1F56300F1068FD7F71A74A2265013F6F6EA892A667031B512E1632E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441940, "uuid": "782a286d-8a5b-4075-a73b-a72540ccb092", "value": "24576:Ot6f6/YwO6ha9Gh4liJvjUj3sWY2msl6SPrB8K1XtNmSDcEhB:WO6ha9Gh7h0rY2lPrSl6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441940, "uuid": "da4bfa51-9359-47d4-a496-721957f1ea95", "value": 844712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441940, "uuid": "6dfcc6f4-8cb9-4120-825b-128f194a4b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441940, "uuid": "3a196163-80a0-4bc7-9d65-7152f648dd05", "value": "agent_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef0f016-4399-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777446169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446169, "uuid": "b98c6675-30de-4766-aa8d-e921c28c7aa1", "comment": "Malware payload (RemcosRAT)", "value": "e3991b4093fc2b451f2fcb06ec06722b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446169, "uuid": "5965ce19-a632-49cf-a1a0-7ca05602b72b", "comment": "Malware payload (RemcosRAT)", "value": "1543fdc5f493fa98fcd62464216a34626c74edae2785a7502f044ec443771d6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446169, "uuid": "c1b8f48a-0ed5-4155-b42b-848e31717193", "comment": "Malware payload (RemcosRAT)", "value": "f02dd0c2170d4c2ec1b87416b0e6056c17905b1b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446169, "uuid": "7bc34012-5a22-4803-a7cd-b4d87d23678e", "comment": "Malware payload (RemcosRAT)", "value": "c52f67e320eafdc4715f538b0beb6d33beccb47ee8cfe511d917d266d2ddb00687efd34519817f7a6b6bb1438ad04636", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446169, "uuid": "66f96021-eccf-46ad-b3bf-32c8d3a4851c", "value": "T132166B4810627B9BD4BCD7604F3EDAC96D4D898FF864C8873126DAB84B05FE53686273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446169, "uuid": "98ff28d0-b630-4380-ae54-e823b8dc52fa", "value": "98304:8ZUoXMSUCvYG7Bu2dP7IB8AZKStuP0PAQm0WiU5YcoWoGORHrjYF+JPo0f04YFwn:8ZrXdUCvRB9P7I7AQm0WF5Ycj8LjYEJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777446169, "uuid": "df627ff6-f169-4256-b226-7e6592b3f4e5", "value": 4046161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777446169, "uuid": "bd496b9c-66cd-4efd-8831-147ef6a4a9a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446169, "uuid": "96517dcd-dc1c-4023-b4ca-fe2a285ab429", "value": "Technical Specs.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81227cf1-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442334, "uuid": "ca11e96c-400f-472c-97d6-dfc2047b7392", "comment": "Malware payload (Mirai)", "value": "66e5c5906f542921d5da2272d0531a35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442334, "uuid": "b5e78548-a67e-46ac-a134-9961ba8b0859", "comment": "Malware payload (Mirai)", "value": "15d4dd1997b3c7a4f1142e78d0f9fa8598d11f749a013ac5d28ba889050ee168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442334, "uuid": "670b7677-8aad-4cc7-b4cf-595cfb2c0085", "comment": "Malware payload (Mirai)", "value": "7eb744bd7d1dffdbeb1f5ed5476d3c84e1f5e41c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442334, "uuid": "0bc45617-8224-4f5c-921f-b70a8ae7b3a2", "comment": "Malware payload (Mirai)", "value": "4b5ba69c36e29af021e5b8c4beb8b58ce9877fba052cf74ced63b45b419f34cc781725a4d71fc35cd27480b04531f872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442334, "uuid": "4202bba9-8d6c-4f84-8a3f-1fee36c77502", "value": "T1A5B38CEBF2470260C8624AF007CB4BED3E2323815F2785E77C6A657969791CF8902F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442334, "uuid": "46e122ac-4c0b-4011-8777-e4dd07f3a827", "value": "768:miF5ayaD9tj1WHcDFIbIfTONawqgJWSpXqki6c6r23ejQfSdVEdrEpln63SWi5gx:0yEW8BPK90SpQDcs6jEteFWogQm/LWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442334, "uuid": "7fb66b82-cc47-4aa3-92fb-3d1951449ada", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442334, "uuid": "ad0b494a-1d2d-4711-bce5-b781d82b8006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442334, "uuid": "22515a1b-686d-42c3-81e3-e945a78606f3", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83f39d3-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493215, "uuid": "8a20f749-b1c5-4094-ac8b-477b32b47fa5", "comment": "Malware payload (Mirai)", "value": "25178d7629a3e3d5d9abb6cc5db6e7be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493215, "uuid": "6376f51f-1aa6-486c-a243-7dfb49a1d498", "comment": "Malware payload (Mirai)", "value": "161807b655588356de90be6924bf5085ed881f68ae7bb0ccac765a7901c374a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493215, "uuid": "e64d2f0f-2cbc-49b8-84f7-00f40f54c69a", "comment": "Malware payload (Mirai)", "value": "7e1a9e4b5c20fb504f11e9bd52a4c4217d64de4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493215, "uuid": "32f6917d-cc15-42e0-b5fe-af8c9292c19b", "comment": "Malware payload (Mirai)", "value": "877b886721da355bab1dae9fbe25ea3f734b2e4f6211edab6fe0b7411b2dc03a804af0612165b23a258e3149baa45638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493215, "uuid": "fb3ee84a-a019-44c3-89e7-f65242760ae7", "value": "T130438DB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493215, "uuid": "3ecd3f19-dae5-40c9-a905-8c64f397cf76", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfmA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDVA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493215, "uuid": "d846efa5-fad6-434a-b29e-ea4f33d0366e", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493215, "uuid": "a66f0fca-56d3-4c9a-b8a1-85e2f8e0c192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493215, "uuid": "5c78160d-792a-454c-b7bc-3454af12bec8", "value": "RpcSecurity.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbb7f19-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440637, "uuid": "aab8a882-26f3-414f-ac8c-ac20e8d96803", "comment": "Malware payload (Mirai)", "value": "3f4e7d291ea3f0221377d1f7734068b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440637, "uuid": "b654fbfe-e9ee-432d-b0b0-021170082e9e", "comment": "Malware payload (Mirai)", "value": "1674dd29c43a15e5c9bc8a3789b47ee5eb5eabf079c298b524e2980a7c4414ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440637, "uuid": "807b1628-92da-48a1-84a7-011f6dda6e1e", "comment": "Malware payload (Mirai)", "value": "c519110585102382c6f6d69415fc2a08125bca8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440637, "uuid": "38acb9ef-36d6-49ac-933c-48d0d9d9d4e5", "comment": "Malware payload (Mirai)", "value": "1bedb33c5f84f5d3e4486f56da65e15597a79c1ffe313791c42ea34733b0e594f660904b0401960d1cd49d2b99392a81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440637, "uuid": "d6fc986f-66ce-47a3-b937-116062537fa4", "value": "T163054A06AF405FEBC4AFCD304A3EC75710DDE9D752C5A62A71FC4A8DBA5825A4BC3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440637, "uuid": "5fb74253-aaec-4e21-8c02-94e17219274a", "value": "12288:SGJXPjr56y98FEDH2Vg94WKyVQy3x5D2qd1UZ6TsLkFNkBeJah7F0SH3uxkSgP7p:PArhp2JzZTyLRojcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440637, "uuid": "435e9e37-abc4-44f0-8ba2-31faea83b58e", "value": 862856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440637, "uuid": "38b9a713-2c3a-4228-87f6-9f49794ffad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440637, "uuid": "8578fd7a-871b-446b-9fdc-67996c6f5001", "value": "x.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711ef3df-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455622, "uuid": "1833f626-b767-40a6-bdf6-29fa33a25069", "comment": "Malware payload", "value": "4b7b70e2815ed26a27eaed8871f63887", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455622, "uuid": "322441ac-5054-40f0-8401-8b6ce00dc5cc", "comment": "Malware payload", "value": "167d6a1b824c414c6f7a533d03544f3eaadbc865920daa6c46d9ca715c2a1024", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455622, "uuid": "1b519ec1-4387-4c65-84c6-d381b840daac", "comment": "Malware payload", "value": "06f65418b9290774e2ce924a4a8b00319a357b8b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455622, "uuid": "c818bb58-20ed-417a-b06e-8470a8757958", "comment": "Malware payload", "value": "59a65d39809a7804d71a9ebe102db38278f2eedd46a4f25f3575b7127e09d648365d66aa5644005c0398f29cf290cbbe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455622, "uuid": "ae6cf1d8-fcd7-421e-9f60-6ffd8811207f", "value": "T110372311CF242E6C462C2145104E6777DFBA230C016DE2D39AABBC8C7999B5935EF2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455622, "uuid": "fc53c5dc-b075-4e4f-aaa7-24732c56b6ae", "value": "49152:fCeIg5PVUGXekwB1t7ryBLzxwB1t7EdMQIeIYix4yv6lwB1t7DwB1t7YQZcwB1tB:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455622, "uuid": "d0711ebb-c5f8-4b51-913b-964da882f3a1", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455622, "uuid": "deece998-f7b5-41b3-8f70-5c73f0669891", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455622, "uuid": "3d0c2138-a60a-499a-9092-4015422ed507", "value": "invoice-1645080830.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ec6ec9-43f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487137, "uuid": "6f14153b-9351-4f18-99b8-f8a7d88b8b6d", "comment": "Malware payload", "value": "4c31f566b9a133784209feb5affbd254", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487137, "uuid": "1a3f0b9d-e28f-4e3e-b9cd-d8473301a7f4", "comment": "Malware payload", "value": "16c5a724e49adb1a8e3f551b056d91018279a6d885a9dbbe59f7d22f395c3a6a", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487137, "uuid": "6730bab4-e0ce-4d8c-ae2b-870e14a823df", "comment": "Malware payload", "value": "6b3563a409e2cfb07137a5ce152f6bc9c01c9abd", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487137, "uuid": "b5018a07-d04f-437e-bec7-d10266ff4567", "comment": "Malware payload", "value": "b020d71ed88f793726a43915c15ea5a58705cbc27e1964f72b8d10359acdbc50715996339883b6ebed75c8d58a53a816", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487137, "uuid": "654acee0-d21d-47f0-95b2-b23923b5bc56", "value": "T18EE2AF63034615494EE6077FF92AC6E9E92CE67559AF52AEAD1022031FC0D9BF9D0CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487137, "uuid": "d0548465-1ea3-4028-adbd-4d7b9a351988", "value": "768:uIsy2FyLhZ29woBbJ/8LCW8wH7bUYRkAbPS+xO52NuylWM1c5hqr:RMYhZ29/B98LCWH7bUYlbPdxoByc5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487137, "uuid": "c10fc010-0a44-431c-849f-064797d46845", "value": 33188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487137, "uuid": "4dc37a7d-a310-41d8-9dd5-8a4d825b7cf5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487137, "uuid": "0840bba9-f986-4912-a3da-c885a903f951", "value": "exevi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a075fc48-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494785, "uuid": "62b01cbf-d1e5-46c2-9160-5d5442ea0b6b", "comment": "Malware payload (Mirai)", "value": "718e31328e4ac3e03bce6515ce82ca67", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494785, "uuid": "1049f907-8bfe-42ae-a46e-d4ebd8ab9966", "comment": "Malware payload (Mirai)", "value": "17ff24858841003cc214e43ed18bc14768ab455301607e2489b08524159d2d77", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494785, "uuid": "390d0d9d-0a41-45ee-a087-6c13737b5a20", "comment": "Malware payload (Mirai)", "value": "88ab3e3429b7b5f16ed6c1d22be9b8e37429b6d8", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494785, "uuid": "bfd0d514-3a93-4b66-8aa2-380e7a5d3792", "comment": "Malware payload (Mirai)", "value": "0601829333960d10058d0efb7257ca40f23e8abc1c9336bc097f1b08d1fd6649a3848ce741cd1b90c5d12e1ad3d89e05", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494785, "uuid": "96c09120-ac2c-4dfd-a21a-8dda1005b8b4", "value": "T15DF2E10AF1B98D25D9FC51FB0CAFBBCD0C22E24FF84494CDF5DD229A867978051196A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494785, "uuid": "47b66b9b-4636-4912-8487-d375d8dfac41", "value": "768:VgBk1l8sZzDLa6ckqG5WTGV+ofa3elgIcTztHM5hFk7pGnbcuyD7U9Ucv:VgSn8mDLrcZGATA+r3el5ytsrG7UnouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494785, "uuid": "5da5632f-58dc-4d63-97c7-622bc7933d08", "value": 34676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494785, "uuid": "7a0ed668-8e5b-4dfc-afd2-5c0c1b0758bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494785, "uuid": "80d43f2a-de6f-48ae-a911-f01e74d74039", "value": "rage.x86_486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6884417-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455416, "uuid": "0a0eddf8-0734-4148-9e75-6f2f7f05733b", "comment": "Malware payload", "value": "01298fa7258daab3e256dee8ca578880", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455416, "uuid": "3457f0dc-37a6-46a9-ba2e-55f66a5befa4", "comment": "Malware payload", "value": "180a2ae9b3678ebee5ed0cd18779721fac169c4e020c5932e3ef8478dd024c33", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455416, "uuid": "09764c58-6516-4a64-b8d7-00501c053045", "comment": "Malware payload", "value": "5ac8e5b906c0b49ee8823aee581de05e9b501b0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455416, "uuid": "7ce1cbd7-1975-4919-b102-8a955498e46f", "comment": "Malware payload", "value": "847daca6892bf1ec1f9c1e263ad099bdbaa991c49b907f5e36a2392fa4d63a02c2e519451a2be0e1dee43d87b3ad2cf5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455416, "uuid": "4995228d-5843-4cc3-a94a-8ac154f72891", "value": "T178372319174A8E4CCE6D81BB30250F1A2ED44F98687AB140F772A8FC5F96B7419FB358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455416, "uuid": "4babd311-32b3-4ed1-b4a0-97417dc94042", "value": "49152:/5M595j5a5I5+575B5B5h5P5sSxaz75g5t5b5D5USxaze5D5a5y5A525h5/5V50W:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455416, "uuid": "fdb724f3-5cd7-4777-99b6-6dda34c70331", "value": 23684342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455416, "uuid": "5ca96af6-aa63-44f6-af37-1c1eb4806960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455416, "uuid": "57a4651a-b363-4c05-b7ba-de96c77d75d0", "value": "invoice-1645080830.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fe7c51-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777495296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495296, "uuid": "b938a2a8-ce04-4e73-a2d9-f1b42c541d7c", "comment": "Malware payload (Gafgyt)", "value": "8c6343c54e89aaa78c20abdee8650f73", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495296, "uuid": "7377e7c6-1a02-4df6-ad55-de7f200433aa", "comment": "Malware payload (Gafgyt)", "value": "183f83e3394183e2bfdf381a5a9b300d84efcd9dafb3971064ffe863aeb3749b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495296, "uuid": "6d0fd622-6baf-4bac-9814-942b5eb9c8ad", "comment": "Malware payload (Gafgyt)", "value": "084828d406731c180ef22eca2c935e54447b04fc", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495296, "uuid": "5dcb421b-9548-4daf-ba17-5c479371a09a", "comment": "Malware payload (Gafgyt)", "value": "8154facdc2ff6f5214c58ae8bba26926d9a30c7e1bb7d762ce029e111bdd828da6a983cbe0a2f613cf77742bfc2fb2b6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495296, "uuid": "468d5d57-db5b-4c70-aa05-a5c5e1261a9f", "value": "T1CBC3C506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495296, "uuid": "10e88e60-0ba4-4970-b90d-de78ba7a135f", "value": "1536:j4w4zW/h4SZsqEznYHgiDSAPDfO4jaXbzjZjCfPNXm/iRK0UgSSWL:0xW/rZsqcYffHjarzjD+XWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495296, "uuid": "3a6f26db-822a-46e6-9cf0-ea55e8d6789e", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495296, "uuid": "166441ed-1b7e-4eab-8fae-525b3b481e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495296, "uuid": "ff220386-394d-4226-b497-7c3b65ac20e4", "value": "night.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b8399d-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455520, "uuid": "28826890-d3db-4b23-9ac3-18b832d75be8", "comment": "Malware payload", "value": "6a848834fb15ffca9c32c742184778f0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455520, "uuid": "2c6af26f-47bb-4e6b-b3e8-5877446facb3", "comment": "Malware payload", "value": "1a3d9cd429b0538525daef9805e90ff4cd9e7f910f1e2f77a6304ef8cc4e5a9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455520, "uuid": "dd0142b2-a187-42ce-91ee-d6e61db5f5a1", "comment": "Malware payload", "value": "9290619604fe401ddab774e999ae3ebab63aa027", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455520, "uuid": "d645d326-09af-4387-b44d-b3417a4df0cf", "comment": "Malware payload", "value": "eac5813e6a8be7e93d64b94138211f8495b6fa501cca120abb6f6a7b3b0ea389858d416096259ed33c2ba39b0857b5b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455520, "uuid": "3e9a0e36-2f1b-4376-ad14-af52abf78e6b", "value": "T1F03713429E0FE9BB8044594D70AF429D47A2CE869C35DCB7FB6F19D7C60EA02184B6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455520, "uuid": "729f47ec-f999-4443-b65d-fa7db2b5f8a4", "value": "49152:ri/6Zi/6qi/67i/6Ri/6Ui/6Oi/61i/6si/6Vi/6Pi/6qi/6yiOi/6li/6Fi/6mj:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455520, "uuid": "d82844fd-2826-4fc9-93a2-def6a63a100b", "value": 23164063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455520, "uuid": "40c18011-a16d-4c98-9289-abccb2883805", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455520, "uuid": "cc9436b3-35b0-44b9-a53b-c03a63d40942", "value": "invoice-1645080830.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4695335-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "2f880acf-380c-4384-922b-c4d5611169d2", "comment": "Malware payload (Mirai)", "value": "c92c5728f12bcbce376a46a985a8c3c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "5fdae290-990f-4dc0-861d-eb3b59fbf7de", "comment": "Malware payload (Mirai)", "value": "1a6613ecfa6d694b3adcba43c2b7d882cc070623b9234a6914083f56fe2f5881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "0c1a474c-41e1-4a7c-984f-b16adb2ea936", "comment": "Malware payload (Mirai)", "value": "f0a7711d1f235265d4c20957605e4490bf1382ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "d7539ee2-4051-4638-9e58-2f92052e4b3e", "comment": "Malware payload (Mirai)", "value": "5f4ed2bcffc9dcd87a660d205f27868889e97e8e4d0a5e0c04dc4eca46345b4d3f65d9127ae3b7aaf58c15b0981bdc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "6076b8c1-da3a-410a-b8cb-bdc0ecb0c42c", "value": "T116B33A05B31C0947E2632EF03B3B27D1D3DFDA8121A4EA40755FAA8992B2D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "707ab687-ec06-45f6-8690-250006010641", "value": "1536:j6xdBNKMAKNlWjciurDUVvvAGxq0hcVZfmUQsufSuJqv9BZuP:j6xfb+j5u0wI5Lg1uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494846, "uuid": "32f0f1b7-ae16-40c4-bcf1-de858e1ba11d", "value": 117508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494846, "uuid": "8df97d86-6012-4401-83ac-871d870c3615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "7c8bd199-4ffd-4d3f-93b1-7b3315c67c46", "value": "rage.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b1feeb-4399-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777446263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446263, "uuid": "7adf7bc0-b076-4e8e-b6a9-d2b877a2e287", "comment": "Malware payload (RemcosRAT)", "value": "1d0ad6edc34b9307e7f8924903ea192d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446263, "uuid": "5d60ad6d-2b6e-4a4c-8c63-115c516a29de", "comment": "Malware payload (RemcosRAT)", "value": "1ab02cada7c38a4d17e4cb430de8d33dc6914fc7c6bb8b51e12d018f5c518a45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446263, "uuid": "fbb6dc81-e040-459c-a9a8-7c465f54b17b", "comment": "Malware payload (RemcosRAT)", "value": "01e6f6d7cbe9c9a80510b4f4e6984b73e43df14e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446263, "uuid": "805eb2b8-359a-44bd-b6de-3a75d517782e", "comment": "Malware payload (RemcosRAT)", "value": "7c855bf444e3d7db195a4dd2a783f06547b030043599be4b667e7f5a2b0e0b9983e75af3a47140d7b7bf1dccb805ec1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446263, "uuid": "b50b736f-9eb8-4230-bb9c-323cb4fbb2d1", "value": "T1B416488414627B97D4BCC7504F3EEADD6D4E888FF860C88334259AB84B15FE527862B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446263, "uuid": "9d291b12-f688-4ed3-9ec3-64bed04aee27", "value": "98304:ChVKqIkqH/Xaf3NMFGLqsElnOVAuEwvWkbpm58jIdfyDfHC1eQ0AZQF:gVb2qdMFiqD9OSuEJymWzH4JPZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777446263, "uuid": "e40e98d7-e022-4d54-8cc1-ecde74596916", "value": 4046161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777446263, "uuid": "249d1475-7248-49d6-aa63-a0deb88f2fe6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446263, "uuid": "ccdc2e6a-eb00-4f75-b597-f303e8c46380", "value": "dwg.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b38af6-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440349, "uuid": "a25dc074-269e-426d-aaa5-20183a63eef1", "comment": "Malware payload (Mirai)", "value": "1c5e0436b8a968d400d8d619f2f98aa7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440349, "uuid": "2c4b6f76-4f90-46fb-807f-a4645c41548f", "comment": "Malware payload (Mirai)", "value": "1ac08c5a6d2021ea8cb9eee96b43b90bb89f32d8da24e01265d98d59bb0756e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440349, "uuid": "5061eae6-61e4-45d0-85de-1c7746b0a221", "comment": "Malware payload (Mirai)", "value": "95cd2f237f96c580fb84068b9ab1d579e80d2486", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440349, "uuid": "b1a8567a-a72f-4af0-8857-e6ee9114efd5", "comment": "Malware payload (Mirai)", "value": "ff0b1574eeee5fc88a52d114d71a70931c821ba014670d91fc1558d47f5a429451f244fd9e333d63687a91d632e2569d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440349, "uuid": "d51d0a33-249d-4c32-a84f-c82279d022b8", "value": "T1F4A44955F8809FA1C6C12976F64D86AC73134B79C3EBB20699245B343BE786B0F3B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440349, "uuid": "4c362bf7-f020-4035-9364-09cf8f60919f", "value": "12288:BHZZGuOUdk9bsKeTs55/a+eoDVgpjofxj1:NZZuUi9bsKeMTekxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440349, "uuid": "babbcd0a-f03f-4bb1-b59e-194af56ab29d", "value": 488564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440349, "uuid": "5c79cd4d-1e19-4181-a27e-afe4c7d2e587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440349, "uuid": "d6d0d0d4-fbf1-4f48-b482-50bef06f3e75", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ef08e2-43a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777449295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449295, "uuid": "260b7a84-bea6-456f-90c8-950f328738c7", "comment": "Malware payload (Mirai)", "value": "972bdf521b4f637fbcc53268c6dbd2a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449295, "uuid": "2029a5cf-91fb-4a75-a02a-917912b29a02", "comment": "Malware payload (Mirai)", "value": "1af8832628c15965207d4395262a9f6b608f26a16be4e764527dd630e371422a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449295, "uuid": "0b8cb6db-c71a-4e8b-8bac-2f95342623c6", "comment": "Malware payload (Mirai)", "value": "81c85c11a3e28ef23c82792bf73a441738f52699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449295, "uuid": "c63c812c-348c-4ca3-aa77-c9ef4c2ff7da", "comment": "Malware payload (Mirai)", "value": "411369e470ef6687b337543f3ba9b47e55f439017792a9514b34906683234908840b4e2d6427133e058d7f3fe0afe171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449295, "uuid": "443ce9ad-c6b4-4c87-8fef-ce19fc817573", "value": "T19813E189D1E18A57C9FE2D3AADCEB71F1819C4CE1041A8EADBD891735442E1D63B83C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449295, "uuid": "723cd8c4-adaa-4a3f-b62d-34bd34a5c51d", "value": "768:pXDTRqq1Y6FFsaCFScFsvjsRI+wGi7tojK9LvhYlOxdAHzWYFbk9hnbcuyD7UgQe:pz1FYJbFoQRI+wGKlDxWHzWYG9hnouyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777449295, "uuid": "69607d2e-0d3d-4f82-89c1-df855ccc478d", "value": 43616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777449295, "uuid": "5190fdaf-236b-4353-9cd3-eb5b87bfb582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449295, "uuid": "3ea9ece7-f22a-4d1a-81d2-9ac1bb78073e", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58ab9ce-4410-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777497424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497424, "uuid": "00141c54-47ff-4ca9-b43b-d2cfca4b0e63", "comment": "Malware payload", "value": "108e5c7335fd7d0696bdb80525a767b8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497424, "uuid": "0eccd81f-85a6-4c87-91c5-53f121bf382f", "comment": "Malware payload", "value": "1b67c039fa3e36bebb8846d8578ef436ac79dc7a9f29ff3a5c0aa89a4a14ee61", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497424, "uuid": "276bfeb3-ae42-47c3-bffd-6ce2e86e0197", "comment": "Malware payload", "value": "b7471c062a0cc224891c998004e551680078a613", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497424, "uuid": "ff96b1f7-a010-40d1-a418-3a50aa8a5c00", "comment": "Malware payload", "value": "16ec611c8e031ea9fad2183deeadc0165344bb6c129d1c1ff033c79b3551f680874670ca70138963a83405f177a2b176", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497424, "uuid": "bca7f004-54c9-49fc-95e2-538f8a9ee405", "value": "T139867F4DE8E7B051AD2198C31F9EE7F1091E6316B99A1C52357C034847D48FF2B8AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497424, "uuid": "cdd1e570-7f3e-4fd7-80f4-ce9120aec9f7", "value": "2ac0c4d3fec4c7e9ce9158815bb62c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497424, "uuid": "add61005-f763-463b-9c90-1d78c52df98e", "value": "49152:+2QbkQDVp1wlGaEYFjRcxusT1/B/3xO2f20u8BeF5q1OImV1WpIXj7dJRaZOppU8:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777497424, "uuid": "68552336-5841-41f4-95f2-7f55f7725ccc", "value": 8068464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777497424, "uuid": "e1c14459-db25-446a-8ac5-183cb294f328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497424, "uuid": "06d13176-6f5c-480d-819f-1de5aba26f71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd25f45b-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495290, "uuid": "42603718-ae90-43b5-8310-55972eb66d7b", "comment": "Malware payload (Mirai)", "value": "244dea1c7cd2d4d1e1abf290e6133cd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495290, "uuid": "d306fd5c-54d1-48c9-b4f0-1ae3350fb224", "comment": "Malware payload (Mirai)", "value": "1bda3476c6ffa91016575d0844d5acd4272b664580a3996d9c6fe17b2979adc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495290, "uuid": "0fdb1cdc-e93e-4fa8-9d39-e28a20ff1048", "comment": "Malware payload (Mirai)", "value": "3091b3fc48d38e6d2c46349acbdf6eedfe837d6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495290, "uuid": "4b70439b-f455-49de-8415-9ca5ae161e29", "comment": "Malware payload (Mirai)", "value": "a011fb0402c9acc15e581931478bbc7112def4ad1ea6270c49bcfef62e4d10cff5144c42c3c41aee8629de1449413a3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495290, "uuid": "b1b5b408-c842-47ee-8482-262b44e8be2b", "value": "T11173F842BA87CAF3D41704F041F7B63F8E31FD3A493285A9EB65BDA2DA235C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495290, "uuid": "b039180a-2f96-423e-8bd3-d850a21a8d64", "value": "1536:cfGl11IuDxOIX9GtkxBP4nIjn3DC3wPrCWD8ZM6iwHvbi3aGiE3uM+GA:YGl16uDx1XPBP4nIj3rPXQZM6i2ji3XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495290, "uuid": "5eb66d3e-852e-477c-b8a5-0ca82ff3866b", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495290, "uuid": "0d0a78e8-6732-4f17-bd7e-4b0fd56b5387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495290, "uuid": "6b8ce59b-c95b-4d88-a285-a850ddd5efa2", "value": "night.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6facb37-43ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482878, "uuid": "14108f33-e4e4-4eb0-8ec9-6dfc482fc928", "comment": "Malware payload", "value": "8b3261d79f954fd995b380e539240e44", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482878, "uuid": "9b671b9b-5b36-4c55-a992-d554a6b4acb3", "comment": "Malware payload", "value": "1cd4ea346d5f0a43c5f5934fe07a0cea3a6c6ddc447ee267ea7f6e2bc64763c0", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482878, "uuid": "5bb871ab-1c7b-4f01-90bc-7b4a69970c9f", "comment": "Malware payload", "value": "9770c88e572f4fd8172e7c2fab96e6a55ae8f05d", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482878, "uuid": "17ab90e9-f59b-4879-a8ae-9e820ba368e1", "comment": "Malware payload", "value": "b96018d4dbb0a2c86d490a5857e0432a35679e34e68581e42ea4e88a5a55dbabe6ab131b25cbd2b901bcb6e5192ce09d", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482878, "uuid": "ec001bcc-d478-4ca3-b3cf-8fb61ed344d7", "value": "T1AAD39C1D15CB02C046E368E88BF6A806F7635633452CCA987B3DFEF15F111AEE4E6598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482878, "uuid": "6098fa69-49e5-43c6-b5bf-45aea99948cc", "value": "768:XJhGXwLk1OArwm10olFyKWYtd8v0ubKvtlK8uxK5FadDPA0RPGzIXUKY5YAIQU2m:XjXLk1OAr/1RYI3Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482878, "uuid": "5a14ddd0-c6ac-4752-a96b-c511fb38bd4d", "value": 138760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482878, "uuid": "1e6c06a2-ce21-42b6-8038-bcfec48f4952", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482878, "uuid": "241af704-38dc-43ce-bcac-ea343266fbbe", "value": "Meeting_Delta_Session_462.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fc8a0b-43c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777462797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462797, "uuid": "6645b542-4cd9-4fda-a08a-a46f3e9bbb45", "comment": "Malware payload", "value": "5605275889294ca04098aabe6a23ffc8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462797, "uuid": "17a4ff1c-fd15-4410-aad7-2e9e891e2738", "comment": "Malware payload", "value": "1ce316723076684c70905793b42fb2375c1b723e2ff51bb4bba7e007b7ecb71a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462797, "uuid": "b4171019-7be8-4de7-9beb-4f34c46e8941", "comment": "Malware payload", "value": "e454c0c2682acfa41d2f5fd93e98972149090919", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462797, "uuid": "89207281-100c-4532-bb91-4ab6d74a8a60", "comment": "Malware payload", "value": "ad1debdda49aa2cfd826de2d87b790d8cd54e56715ebfd0027eaf2683ae3351e61039587264d0b2928cdc698f1a65b78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462797, "uuid": "157526e9-787a-43b5-958a-9ab70f29a948", "value": "T1B9137D6526953C25AE99883B5C7F2F0CB9A983E1304891DDBFCA3CF18C4569CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462797, "uuid": "7901fdc4-a7bd-4323-ba2d-886958391695", "value": "768:bzs9NyXsZztCe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b4HusZicy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777462797, "uuid": "eb67bc7c-4340-4aab-b857-4a025acf00ea", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777462797, "uuid": "0391e40b-5b7f-4f28-8b8f-39d50e2072c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462797, "uuid": "56027122-3b73-4a0e-84e9-4234bec2fd52", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2057cc6-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441557, "uuid": "6ccd965d-da63-4ee9-86d3-47c81490fca6", "comment": "Malware payload (Mirai)", "value": "7feea8baaf39609246fa0602bad03e92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441557, "uuid": "d94c8940-fed0-4f1d-afbb-50beb12eae0f", "comment": "Malware payload (Mirai)", "value": "1d16c38071dab0cc53f33061bbaf325e36a4553564325ca47d525179e3aca75c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441557, "uuid": "79ead20e-beca-42ec-a1d3-d3bef1a89c42", "comment": "Malware payload (Mirai)", "value": "277cddfeaefc19b5c6895ef2486f484bc99650f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441557, "uuid": "15ef9ca6-cce8-4d2c-bafc-2a810aede269", "comment": "Malware payload (Mirai)", "value": "b9064c9fe5c4ed64bd48960fc5b9d2f71748644c9eeb9e036b933f0362bd51bf9c5ed14fa519af7781692a47ca3530de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441557, "uuid": "7716712f-aa49-4702-8cba-9c2e716392af", "value": "T1F8C44A55F8809FA2C6C12976F65D86AC33074B79C3EB720689255B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441557, "uuid": "e2bc1c55-b55b-4ea6-9620-dffefef937a7", "value": "12288:+ID93RBC47P+zyq98N1g4q9qwQIiLZgpkItiP:TRBC4aOU4GqZIsm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441557, "uuid": "7cf40b51-f595-46bc-aa07-9137c6156282", "value": 558232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441557, "uuid": "8e226777-fc29-4d89-91b4-f24a948892e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441557, "uuid": "5430a83e-418f-4eed-9830-de21b06fcfb7", "value": "agent_armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc04b47b-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440339, "uuid": "f4655773-6166-401c-94a0-b282daed77d1", "comment": "Malware payload (Mirai)", "value": "3ac717091fc02a61ccf1e6fce3dabd2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440339, "uuid": "3e89413d-5e68-48ae-bf42-353e362f8ef0", "comment": "Malware payload (Mirai)", "value": "1dd182b830bb5d913d3176b8c0366be53dff8143018cc52711ee61dc8b070bb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440339, "uuid": "20d217cb-5789-4823-b815-d44c10f6d0a1", "comment": "Malware payload (Mirai)", "value": "dc72ca3b6e1b667fe367118a3ecd649772a63d65", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440339, "uuid": "75f3a6ca-b4a9-4093-9076-c2fbf038bc59", "comment": "Malware payload (Mirai)", "value": "37f82b822d2072992671724dca9764ca487bf7bada224b73b2562d3f73daa48d87b6e5bec7211802e2e28ba359114b47", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440339, "uuid": "7056e7fb-cf1e-4762-b440-be6462ed7bc1", "value": "T1F0E3881A6E328FAEF67C833147B74A24A75D23D623E1D684D2ADC1145F2028E545FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440339, "uuid": "abd929b0-d3a4-414f-8222-2f44902faef0", "value": "1536:fFff+Q5rzEwvJ2sjaj9ffNlOyOGLVew355cgNFQuYTNDg3+RxdoWhlS:fFvEY2sjaj9fFlOyOGLL5c6SgORxdllS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440339, "uuid": "cc28b9b0-2a08-4a37-ae10-ae5789013094", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440339, "uuid": "5891b86b-dc6e-4a0d-bafc-c9ca22ed69fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440339, "uuid": "f575bfc8-1701-483e-80ec-34a0d069f8d5", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413142af-43b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456830, "uuid": "11a0e3fe-6024-4b89-95b9-f8df709be145", "comment": "Malware payload (ConnectWise)", "value": "481743678f5857a526de140e0d35387e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456830, "uuid": "987fc3b2-5a92-419e-ba78-032454eef1c0", "comment": "Malware payload (ConnectWise)", "value": "1e1620eafe240d12f33b7c346b1032eaa8ad646031cfb32dfe5cb083554212c9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456830, "uuid": "2bee19ea-db87-426b-acd6-c25644ca96f5", "comment": "Malware payload (ConnectWise)", "value": "20606528c8d5137ce5e39fbf201ada3a4e4f529c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456830, "uuid": "a1320c01-166c-4af9-90b9-dde81bca1024", "comment": "Malware payload (ConnectWise)", "value": "d7e7a52d2620647bb50f78e36c40ee3881d761437b7af0378da2b77a711c718a7673d667d16343a0aff1eb89907dff10", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456830, "uuid": "e67cabf5-6a26-41cb-9750-915ac495defd", "value": "T14B56F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC08E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456830, "uuid": "88f1e4fc-a000-4fe9-95f4-cac599a67b42", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456830, "uuid": "08903d77-f1e4-458b-9bcd-f1f780aa7587", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456830, "uuid": "eb77fbc9-ff16-4c5e-98b9-6ec57422d62b", "value": 5966336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456830, "uuid": "9ada3173-b6c1-42f3-9a78-1b1252d250fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456830, "uuid": "e770bd1b-d0cf-43bf-979a-aa50f75e47bd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dc7590-4421-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777504518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504518, "uuid": "bba0d30b-b5ca-4fda-8c8a-513966ebcb8d", "comment": "Malware payload", "value": "a7f4ad1736fef0181da7de3fe95d6982", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504518, "uuid": "6a88901e-641e-4be5-8f15-ffd9ff98e1dd", "comment": "Malware payload", "value": "1e712cf5f203b60e7424de18e1d1a7ef2c9b0f5f327381b14064160160f0bc3b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504518, "uuid": "a32eedf6-8483-4b0d-abdb-6d947fb67a3d", "comment": "Malware payload", "value": "413944e2b1017622fc6106e1733a134d1f745ec9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504518, "uuid": "fa5dbab0-1887-4bf2-b8d9-461081bf740c", "comment": "Malware payload", "value": "7df44d78bab3000f1f31c5c21af9d0d48a0cdddb2fa412fc205e9cff93885eefbbac9b0cf49e15e47cc416c4119156e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504518, "uuid": "3faaa484-7c4e-4d84-bde7-d07a000e5cde", "value": "T166137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504518, "uuid": "5395d5cd-4601-4fc6-ab64-b12854a607e3", "value": "768:bA+Y9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bA+Fcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777504518, "uuid": "8e8aa015-a1b5-4dae-87c6-1ddb138ad919", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777504518, "uuid": "83de8a99-c3db-468f-8820-0dd038cdb639", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504518, "uuid": "d40eae75-f2de-471d-8b29-d7ece8c811f6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6976a52d-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455609, "uuid": "8eceeefd-cafb-47f0-9027-0cb5e07ccabc", "comment": "Malware payload", "value": "c6b4b7e111e8437086fea905b574193e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455609, "uuid": "c86fbcb1-35f5-468e-9915-4abe48e2777e", "comment": "Malware payload", "value": "1e87ec4914d25240f7eb38d362a32d38a7579c4279da5386b39d539e08bfb39b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455609, "uuid": "1dfdec94-288d-4c30-8b43-bb78d05ee56a", "comment": "Malware payload", "value": "0b6048bf95bb3b112d8e96cee76672932e954dfe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455609, "uuid": "bb28ceff-da26-4135-8296-0441598f7496", "comment": "Malware payload", "value": "cf073e4e6ac31d16fef191fff933c645f524182bfe0b253ab15c853d08a1d6044a21f14c88be217aee824b0e980a1c86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455609, "uuid": "1089c36a-f89c-41c5-9ec1-45e681879d07", "value": "T1E03723095A3BC5AD45B806DD1A7E1F8F3DEB4C00295AA4CAD38274DE1A6FF1A00D35F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455609, "uuid": "bc056f98-5441-4d5e-b9e2-8a25a54c0a1e", "value": "49152:8xAlGxAlyxAlvxAlWxAl+xAlcxAlMxAlExAllxAlexAlqxAlvsxAlSxAlBxAlTxp:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455609, "uuid": "d998ea04-9bc7-46a6-afaa-f3ee6ae02385", "value": 22643794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455609, "uuid": "0f6a7bc1-e3bc-4aea-b5c1-20b6f6b712c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455609, "uuid": "272ab881-eb41-4b30-bb05-bcd119424221", "value": "invoice-1645080830.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97903acc-438f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777441942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441942, "uuid": "10afc0c8-fdbe-4d38-97cf-8fb020756bb2", "comment": "Malware payload", "value": "ebe35ddb4f57e72d06bd59ba8b88c712", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441942, "uuid": "459b5b15-3195-4e0b-b03e-303a8e3bc025", "comment": "Malware payload", "value": "1f34e1c472a94cbc539c9f1c3c11af0dba3bcae130216b3df31c9fa5f24a33d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441942, "uuid": "804232ca-58be-4b3e-81ea-31c6f4e466d2", "comment": "Malware payload", "value": "5e9698fae25a4de2e5b2c5bab8a8139f6e0c66dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441942, "uuid": "2816463c-17d5-49aa-8887-24a0883dbce2", "comment": "Malware payload", "value": "b558951d0c281fb3cb070ad68f1c7a722769a2658cc11e55bada1991ad77167c3f7d57b5c75469f7a90f82102f35126f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441942, "uuid": "08ea4a92-8b27-4f5c-957e-fc56f9dbc8f4", "value": "T1C601AF6A3869BEF9F7050DB4E5885A346081C2150C81FD11B8ED1A58F12ABC9769D46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441942, "uuid": "5709a073-5834-4a2f-92cf-a1db92648af4", "value": "24:tP8yn7rnrg7rK7r+737i2+KZTJcYsUMMiMe:957rnrCrAr+jO2+AJJMMiMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441942, "uuid": "7f2ff2cf-0a04-48f5-ae73-21dcd070a14a", "value": 798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441942, "uuid": "e9ee707c-ae3d-4d09-8661-4c8b511a39a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441942, "uuid": "6d8515aa-5e6b-4ad7-ba28-c35f98766afa", "value": "u.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2f03e5-4374-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777430407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430407, "uuid": "1426bf76-8470-4749-bbd7-1146a893606a", "comment": "Malware payload (MassLogger)", "value": "fb9540718fbafb77b02c5f640f617c03", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430407, "uuid": "4c14d85b-be93-440b-81dd-1b50c99eb005", "comment": "Malware payload (MassLogger)", "value": "1f7315e324283f4b07b77e6e537f51ebf801f210f2780721a5c34468d1066ede", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430407, "uuid": "135ee691-d453-433c-bd4a-9721a1d4a9b2", "comment": "Malware payload (MassLogger)", "value": "868330b82b67c40abfba9a4dd7cc6fa525abad98", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777430407, "uuid": "3e5b18a5-a96f-43bc-8bc3-a3343180d20c", "comment": "Malware payload (MassLogger)", "value": "5f1922f52948b4cdd1456604a6c551c0b86410ede9c62a74406077b87848b0864c1aceca0df6c163889c9d68d1e29981", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430407, "uuid": "4e9326bf-46ab-431a-90f8-8193b39602a7", "value": "T1EB03B7EC7AC6B2A14391A1B72A2BE555F2AECCC43D8C8064F5F4E89DBC34714D436938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430407, "uuid": "13d92fc7-691f-4f0c-a50c-c595f0b2b742", "value": "768:DOaCWLKIKRwaNAn2uleDFJoQFLyt0CMwuHK7gvLi0phO2uRZbJP:D9CWLANAn2gIoQIh7gThphQRZbJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777430407, "uuid": "62e8e0fd-8388-4ad9-8a27-45f39668b30f", "value": 41119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777430407, "uuid": "c604dd90-7dee-4fab-aa8a-3212cba694f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777430407, "uuid": "14c944c6-2dd8-4be6-bea0-48a00d8bff46", "value": "EDIT PI-74625463.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e6b805-43f1-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777484138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484138, "uuid": "de6025cf-e9a4-48e5-9afa-09454b99f1ea", "comment": "Malware payload (ConnectWise)", "value": "c4aa8e97910c3af8067dd10853de3a85", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484138, "uuid": "0c0a8488-fc1e-44b8-b46b-034cd96545c2", "comment": "Malware payload (ConnectWise)", "value": "1fe3f7d271f954e1fe5bb335ab7089eb172adce18fbf4cf4c57b8313fa87f206", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484138, "uuid": "54b947e5-2003-4250-97f4-58d39a2a72d5", "comment": "Malware payload (ConnectWise)", "value": "fc80032dff97bab07fd0ab51e963a81a5f3346ea", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484138, "uuid": "e4dec8c3-6ca6-41a8-b351-eb6e07c5f56d", "comment": "Malware payload (ConnectWise)", "value": "ec84a38eadf1dc92da03d5870c58246ea857d62460c778de48b7a2c28df8f10893163997b276b1aeace62cf864207b8d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484138, "uuid": "d3944c1e-1912-4844-a6a9-f49f15301877", "value": "T17F646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484138, "uuid": "85238055-da3d-4489-aae2-207bb239b9c3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484138, "uuid": "90c7c550-f45f-47bc-8c38-37f7f4cd0bea", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9I:R1iw7gryNkSV1hy1Z1u2JLu9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484138, "uuid": "98153c39-c35f-4538-8be4-1fbbdf201bfc", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484138, "uuid": "625cf34f-1eff-4477-84a0-3b22f63ad53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484138, "uuid": "66d60e7e-051d-4675-9a72-57d3a319a8f4", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43129bce-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478737, "uuid": "b59e7bdf-b656-462a-84d3-798b4146a537", "comment": "Malware payload (Gafgyt)", "value": "b7ac972f2e7365a80537b47e8a26ed4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478737, "uuid": "bede61c8-e721-4818-89a4-9ab18ecdaf9f", "comment": "Malware payload (Gafgyt)", "value": "20330a19551567abbba5bef70e63f5c2643aa3780b0c8ff211d3901ef2671a7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478737, "uuid": "f517c788-34b7-4c53-8fcc-4f4af2bd81a7", "comment": "Malware payload (Gafgyt)", "value": "d1d52e408ccc0fb4dfb5e4f17300f343d4d26d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478737, "uuid": "62563d4a-faa8-4f6a-aca8-794df6bce995", "comment": "Malware payload (Gafgyt)", "value": "1f4a810b007d01cf515b524f225714f8612517e802cb49db3990cc2c08cab395b4e7823f028e9d264f3103ca17671cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478737, "uuid": "c2aafd64-62b9-42ed-86df-6340dd4654b0", "value": "T1F2930893F801DFA3F40ED77609D34B257230FB614A932626722739AA9E762D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478737, "uuid": "ee730db5-21cc-47f4-9ffc-f04db8f44ab8", "value": "1536:01Iah0Tad58FbLRUXfIgxrBvjWdzI4NdToyezuB5DCg+bmQEVMXjpGtfLLe:IT0udQdWIm9lCdToyezuWmQEVMX1GtfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478737, "uuid": "ed2b8698-5ce5-414d-a98a-885663d070fe", "value": 89122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478737, "uuid": "5503bcda-1470-4b6c-8483-f16b74056a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478737, "uuid": "6323a84f-e18b-485c-ba1f-6b9c417f6e19", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fdc41a-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470575, "uuid": "691e0348-4ea1-418a-80aa-6b5f4cf2c273", "comment": "Malware payload (Mirai)", "value": "4bd4029c48b5b7b43e715baa91bc6407", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470575, "uuid": "5b6995a1-9872-4fa0-9e60-2f0a8a76a0d1", "comment": "Malware payload (Mirai)", "value": "207ad0598b432a2f9e55fec2b49ca64591bf96a16c423dc1487e0fc4df60a315", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470575, "uuid": "547ccfd8-8503-4079-a800-6fd897a82840", "comment": "Malware payload (Mirai)", "value": "7babb9fa9648a96aad6f040a9a60f4a6fefec28a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470575, "uuid": "4bd40449-e8da-4007-9d0a-05cd77dea31f", "comment": "Malware payload (Mirai)", "value": "8973fac557d1c2986dd06d65f0bd7be0fd5d10cc02b7bc4aecfcdf39224bff7fa17b2df8ed9e58dc6cb4d4ebc2dc1849", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470575, "uuid": "7a61eb9c-f4c7-4038-95cd-f766f9458739", "value": "T121931A46B9819F12D4D621BAFB9E414933536FB8E3FE7112DC206F50638A9DB0E73612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470575, "uuid": "1882421a-039a-4f07-a196-299291098169", "value": "1536:BNnYuF3dS5Gns0vTMgvYva5M5ZcPHIFlluMiZfhLsoY7b2Ou:rNS8nVvTMgvYva5M5ZcPTnfhLsog2Ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470575, "uuid": "ad8b56be-0c8f-4c82-b158-79bacd1b006c", "value": 90580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470575, "uuid": "79e080b7-c8a9-46ae-8a5e-1478bbb2df05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470575, "uuid": "baf9bbba-a34d-4685-899c-1624f6c16ef2", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4c648a-441c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777502622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777502622, "uuid": "598f6998-e578-403e-9c2e-3eddfddf8d73", "comment": "Malware payload", "value": "0f6b3180bafa3f71869b3d15ee5075c4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777502622, "uuid": "3b9b27f4-8baa-4b1c-93df-3dea8555c541", "comment": "Malware payload", "value": "21b1efbc25de98cec4a811e29602308aa71f109dec1ac5d3ce422e99e38f6dbe", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777502622, "uuid": "ab16071f-bc3b-48cb-9c9d-9bb28d598592", "comment": "Malware payload", "value": "5bdfa04473a3ac63d1aadb3cffe6d2a39195ca4f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777502622, "uuid": "c2cafb67-baad-45fa-9aa4-bcc360900061", "comment": "Malware payload", "value": "738df9ae8386f5bf2449d345328895b80346ad6050c8aa270e34da6b20686501ad8f9f8b6db53aa8a891bc296af86c4a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777502622, "uuid": "d1dd12cc-cabd-48f2-b73f-02d0b5cffdec", "value": "T1785733FEE2755717E537C03494E83188867F2E5F5A061CBBBA29375684F73E0207A286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777502622, "uuid": "82a5e005-4f98-4f91-b0be-667d539f4cf3", "value": "393216:v210tbNCCTg5fJ4Q44hD2aJc0ivlJpUPPW/oiug/pjVMafdKyOjQLD2v4WYM6/NK:v2ijzs5R4QIR0BOqKdOjQGvxYaNpIpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777502622, "uuid": "eaa16c18-083b-4914-9994-4bd10e0d1cf4", "value": 28946432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777502622, "uuid": "aca54f3c-2610-45ba-8338-7b319621d434", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777502622, "uuid": "7e5f0468-9775-4308-8743-c1b675c56e16", "value": "Ghost Override.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc436fa3-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493221, "uuid": "3975d4c6-5ff1-4af4-9f2d-73c3a9ccfbbc", "comment": "Malware payload (Mirai)", "value": "604cb92ddcf85b2bbad20f7758c88c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493221, "uuid": "0027ac16-6b19-4208-87c4-c220bade5ced", "comment": "Malware payload (Mirai)", "value": "21b93c1efefb3639cbc51388391c61fb8b07c6e829a31bffcd1e24b0d0ccbefe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493221, "uuid": "f3aa75c8-5d3f-4eb7-a381-ff1cebc6c432", "comment": "Malware payload (Mirai)", "value": "1aec0790e8e89f0b0800e80d620f3ac4b975c4ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493221, "uuid": "ba0a7bba-30c2-41c4-add3-1fe370835fa5", "comment": "Malware payload (Mirai)", "value": "6c7cfd5fb26519747e0f53268f087c3e6acc675aeeb1a98e05ed842314ad7f4eeaceeb183ed36ab127f7606180ef3cd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493221, "uuid": "6d4226ff-8669-4e93-84a7-7b0ed0cc6541", "value": "T1DD432B95F802DE7DF80FE67D44164E09BD3063C261830F2627ABFEA36C720A66D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493221, "uuid": "49a5b50b-2b12-4a8d-8c33-7b7886902313", "value": "1536:/+dPsTgnLbMuv5tqbaXnb7f98V8TWl9ouSQy8fNLvA:23rqbobZ8V8T4oHQD1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493221, "uuid": "5881f680-5429-4337-98c7-b5a64e3e723f", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493221, "uuid": "0b16b5dc-bf40-4e8e-b504-9ce5bc4152e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493221, "uuid": "66b3fb49-5b31-4dfc-ae8f-af4fdab6d2f4", "value": "RpcSecurity.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800e852d-43bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777461230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461230, "uuid": "b05e12dd-407c-41ba-8aeb-1491ed493f56", "comment": "Malware payload (Mirai)", "value": "c0f5a498fb3939e15aa1ea28a6c729da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461230, "uuid": "91acf95e-41b6-468d-b80f-be2a20aaab97", "comment": "Malware payload (Mirai)", "value": "21cb7f98e76061e51bcbfb1bf279f229264fd67db72d30c61586b0ac24901ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461230, "uuid": "c798fd16-b266-4f3f-b942-e0bc982df01b", "comment": "Malware payload (Mirai)", "value": "45b3f5cbca0264091e5a87850ed3868761e3e000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461230, "uuid": "de80114e-ccab-4e41-a102-eb48aa9a66fd", "comment": "Malware payload (Mirai)", "value": "1b682cac23db451e354a1643afe41672aad95ed4a58f2f39c4e9357af5355e8dafb60aa719d8bb93061afc806e244afd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461230, "uuid": "60382636-dba7-4587-b661-d23e11d8666c", "value": "T13EB3C607BF118EB7C82FDD7306F98B1124CDB85725A5376A3670DA5CB61A98B09D3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461230, "uuid": "d3676759-2ac5-49d5-b60d-afcb10753186", "value": "1536:Pn+rorL8etFYuFyF4scZzqZbx55tFAwND3iMi8xA5WQgJoFLKUG:Y6bFhsTgK657gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461230, "uuid": "ef3c1214-15fe-44e8-9b4a-b21a6f093299", "value": 112504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461230, "uuid": "418c8fd2-88b7-421f-b789-e38001aafc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461230, "uuid": "7d1d9f0a-568d-4c3e-ab55-994e620a2728", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0bfb73-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777494993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494993, "uuid": "d9f9ffaa-87aa-4d91-bdcd-b1836f933f30", "comment": "Malware payload (Gafgyt)", "value": "c6775b3886260c7957f4704526c583a8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494993, "uuid": "fac5ebe3-b101-4e94-9e47-601506bc7124", "comment": "Malware payload (Gafgyt)", "value": "222a9ad3c41d8c05e631b672b5781af692d42757b13b1d9d768c8cff97ea6599", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494993, "uuid": "4042c4a1-39f4-420d-ad96-b714b88ed274", "comment": "Malware payload (Gafgyt)", "value": "a83f93c6c00725653ccb9add96cc7de4d5aebdee", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494993, "uuid": "b0d0eaa8-46b1-4dee-9039-bd03a966b9f3", "comment": "Malware payload (Gafgyt)", "value": "cedf800908ddb12c03cc247059d2a9bdedf98422019ec6919508082aa8f05d3257d2ec771860da51949a7cb223cc9f8e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494993, "uuid": "d687dfb4-e7d8-4513-aa12-3d8c7d6a31db", "value": "T1B5C3B91E6E21CFBEF65A827407F78E31965877D72AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494993, "uuid": "61513496-4c80-4f79-9d8e-a2910c0b9179", "value": "1536:tw4lPfv7d7Y/YLpdYo1fpNeHvztsi8ZPDoM1ISWlKnKevNeThtF:7lPfDdMKdYo3wHvzt2ZPDoMCsnShtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494993, "uuid": "37f1a17d-4f27-47cb-97af-6de3574b679c", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494993, "uuid": "dbeed04e-1b9e-4c7c-b155-28383e7870f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494993, "uuid": "3f36e92e-794c-4a32-ae2c-6ba971d8a215", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62018924-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442282, "uuid": "de16733c-c964-47a3-a12c-d53206acb30e", "comment": "Malware payload (Mirai)", "value": "60f17199dace738aa6f62e55fddcad2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442282, "uuid": "aa6e4161-f3f2-4667-ba18-c560467496b0", "comment": "Malware payload (Mirai)", "value": "227528d539f2dc72bb15aef4664e62fb2e644448afae17b6c46a49de491bb88b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442282, "uuid": "7e7b536c-731c-4533-ad57-523bcddea303", "comment": "Malware payload (Mirai)", "value": "4beccc3d58a0493fc7623fddd3d8dc14aa215bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442282, "uuid": "478c7de1-3e89-471f-8b74-4246f1d236af", "comment": "Malware payload (Mirai)", "value": "1bf1941ac0f76bcce1843289c00a8d2e55c080f43de8437de670525e88fc7df8e23ca447c9338930baf75cbbd16eb4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442282, "uuid": "b9d93f8b-c939-48b1-a729-a4d1cb00befb", "value": "T17D43F781F44B81F2C44B483050A6F63FDF31D9EA52B1DA5EEF999F32DE67542A101A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442282, "uuid": "31144e85-dddd-456d-aa72-f2eff3d0361b", "value": "768:WJ546RNQulWIFkFjrKWElrKe9CWaSHy691CO1zBAx3/9S2BZqiUpWDG9qULaUSvs:manIFkRrcpRdaO9uSiUcC9XLaR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442282, "uuid": "b7554604-e620-4c1f-a839-db6ff2c9bb74", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442282, "uuid": "74a3235c-f2be-416b-8989-736300de8236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442282, "uuid": "b238fbde-ca6e-4146-92a4-f1429214f2b3", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dff3c2-43fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777487995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487995, "uuid": "a6589d5c-13c0-497b-89d0-76389e017d02", "comment": "Malware payload (Smoke Loader)", "value": "c752be5840f1aaf5ad9bd27a983087de", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487995, "uuid": "b850e209-62c9-4007-86d9-db0f7e6a3448", "comment": "Malware payload (Smoke Loader)", "value": "22d2b639c9ad6e5ec5eafff275ad8791e35ebd8f6b66f3839ae8b1aa47b2fe06", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487995, "uuid": "58db7122-c5f6-4b05-9a8d-535790a0cf83", "comment": "Malware payload (Smoke Loader)", "value": "3c2030cc556e173787936bd4f4af52e990e0bf53", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487995, "uuid": "19096f71-4384-4e63-892f-a7095b8e7ff2", "comment": "Malware payload (Smoke Loader)", "value": "2b8f16ef827af1ff86e428ca6cc4769a8b0576175e7e174d39b4734a00190f1f03121b3fc34a4ed8a2c0d6ed20741957", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487995, "uuid": "bc01b410-15a8-475f-ae88-4dd17e76afbe", "value": "T11D659E52B2445F6CD2A2C27D82AB823AB97932493332DF7705999D31AF9BEC54F0570C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487995, "uuid": "7b119623-0329-4470-bcaa-b12e422678f3", "value": "0b5f92f4d6635d03e5f7b86c992bd05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487995, "uuid": "d4cf1def-c430-4376-aadf-fd9cd0a4a43b", "value": "24576:Xkmmd0jk+SX/m5ptSymnSGIQTfG08GsY2FeaaVMDFIT:0mK0jk+/ptSyOSGTfG08GcFeaaVMDFIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487995, "uuid": "baeb07e9-4f56-49f6-9d80-ac3aa37e741d", "value": 1521185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487995, "uuid": "9cc6ae30-c734-4ac7-af92-41f2cb28cca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487995, "uuid": "c8b4f5f0-439d-4e72-86eb-3c306a5ffd8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd90266-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440340, "uuid": "b6ca6804-52a5-41f4-84bf-0962399b71bf", "comment": "Malware payload (Mirai)", "value": "24b84b074287f41bf21f970fa482d47f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440340, "uuid": "f22674d0-bc29-443e-a89e-ba082f318aaa", "comment": "Malware payload (Mirai)", "value": "2331af164953b582ffa4bd00789a5e3780a8e22e3ac6c45cd34e289b0eb4036a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440340, "uuid": "b218f570-daeb-47d3-8dbc-8db355783714", "comment": "Malware payload (Mirai)", "value": "3686cc2b3b485ce44aebf91130353afffd023b5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440340, "uuid": "b99cdd05-04b3-4538-97af-1bb8fa9c5e89", "comment": "Malware payload (Mirai)", "value": "a126c3509a6d70b22970a6730f53bd4ae26e91b171bdc5f5ccf9e8a72f8a52d5ccc1c45d7698397d715d559cd7bd44c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440340, "uuid": "e58a2e8d-bd46-492a-9e96-202e24dcc876", "value": "T14DE3C81A9FA10EBBDC6FDD3702A9064235CC954712A43B7A3674D538F64E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440340, "uuid": "37ed1a6e-8694-4d55-bbb3-658b36eda99e", "value": "3072:WBE+rwbBgJNrzKk83R5SXa3F0kVBbJnC1:WBxrwGN9832c0Wbg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440340, "uuid": "dcba6845-d948-4437-ab10-22236b468680", "value": 156720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440340, "uuid": "eaa3b277-af1f-4fef-9c84-ad76929d466c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440340, "uuid": "3077d75b-2e6b-4919-8a94-15367280f664", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bdf1a3-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777448724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448724, "uuid": "a4ddd312-9ed3-4899-9d81-025278ac4640", "comment": "Malware payload (njrat)", "value": "42818f04a77058512374e21e2b8cf98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448724, "uuid": "581338a2-0700-4e93-a301-1b97ee212a5b", "comment": "Malware payload (njrat)", "value": "234a85a7e731c6ec52cc76c701c957c091ad2c617ded1120df0cf4d1e7843e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448724, "uuid": "087e4c2a-fc90-4853-aefd-22786603f7f5", "comment": "Malware payload (njrat)", "value": "8ebe30d4b74065144657b3fb41da1a4bade589fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448724, "uuid": "8f6da634-2691-48cf-a770-39c58534ac7a", "comment": "Malware payload (njrat)", "value": "b6de6a24b84c6fa81771b1672bde9e1cda77dcff21f5458445a7503db4c160c2ddc880c4a0008a3ad8964ec5418453f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448724, "uuid": "3a95348c-ff73-4c12-802e-a85f6fed5db9", "value": "T191C63314EBB102FCE0B3A674CE879941DB75B84A53B0DB8F1751A9A31F271D4AA3DB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448724, "uuid": "f0719ded-9120-4fec-9827-7777b233127d", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448724, "uuid": "6e810123-cff1-428d-ae3f-fb3062e1df2f", "value": "196608:rcnCmwXXFByGrF/jlEfUEowKaL3XS9RyH7aL2gqbgyE1loxBJ+78+n:rcnCXFR5/YN0aL3XS6Gabgyc8BJ+78e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448724, "uuid": "277fbb0e-6a56-4fb7-8304-44f73ef17685", "value": 12412935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448724, "uuid": "97e6c8d0-7e5e-430a-8f51-d3a0cd6ecdda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448724, "uuid": "261be481-8985-45c0-94e7-f055ae25f7d9", "value": "FiveMHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541a3a48-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777470605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470605, "uuid": "00349ecb-3c22-44d0-9d2b-1bb45785386b", "comment": "Malware payload (ConnectWise)", "value": "3b0b4564615a767c913f1801b77d7a90", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470605, "uuid": "7ae0033f-b7f4-4858-9567-4edbf66b7126", "comment": "Malware payload (ConnectWise)", "value": "24195dabbf6944ecddee249e79a560212d12ec6e6fef0740bb4929220f36003f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470605, "uuid": "2170b756-f9e6-4e5c-bf0a-af576e45fc77", "comment": "Malware payload (ConnectWise)", "value": "5f28379dfd593d318c27186a86737dc58c9857ae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470605, "uuid": "ef3603a2-d4df-447a-9523-a60c5fabd2d0", "comment": "Malware payload (ConnectWise)", "value": "9f8a52b55c34a8ca0522e44610ba8b770668631f93bb8451fa22cc0b392034ecef09db63f4b0acee1024adf7cb50e963", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470605, "uuid": "c2b248f5-e9ae-475c-86d6-ef4c2c296f70", "value": "T1DA56F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC08E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470605, "uuid": "13cfc883-bdd5-4e9a-9162-485ee2e65d58", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470605, "uuid": "2092f7b0-0e07-415a-bb5c-fec86b7b0012", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470605, "uuid": "fe250f46-78a5-4766-8f68-fb8e09c07ec2", "value": 5966464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470605, "uuid": "7f34ebe4-805d-4b40-abf5-47dbc5b9268c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470605, "uuid": "80d0d684-15c8-4bc7-a3b1-31eb3ed9275f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be301550-4368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777425257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425257, "uuid": "23ba7d16-66b8-4e56-8a90-26a3c1136c0b", "comment": "Malware payload", "value": "da3b1e978d1234a9442511134af537e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425257, "uuid": "623faa69-360e-4237-befa-508473c8d4ae", "comment": "Malware payload", "value": "2432edf497da3600a5d44a5572ed70273251b1bdab3c8f8b3ac1948bc26da73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425257, "uuid": "c278c071-96b0-4235-98f2-e02dba209263", "comment": "Malware payload", "value": "c89f7367aaacb1a6e0513c19eed9285fa4a14ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425257, "uuid": "f3cf9722-591b-422f-b2f1-4c62cea17dab", "comment": "Malware payload", "value": "9ab04044cb1fdc00c2bf087aa641465a2f83dfdcd6797fa0948a3e0923cbfb4379a4eba13d7dace8d9bf78b60e05eeb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425257, "uuid": "39e7346e-16bb-42d3-97de-9e7625e94a68", "value": "T188129406B3F54A3AE9EA0B3D6DB392410DF5F313982ECB2FD8C8414948526C27951B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425257, "uuid": "cc47c04c-e3ff-403e-b337-2fa8da805e11", "value": "96:uFQocxW8PoFPPEyUPlb8gH4/HJzIUo7DsCrM2TMryPOVWSxoOu:uyocdPeXUPlb8gH4/HJzHiD1MQeNWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777425257, "uuid": "395af642-2cec-4fa4-adc0-98869f04d26d", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777425257, "uuid": "9affaebf-e30d-43f2-ba67-cadf04ece567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425257, "uuid": "7ff10212-fb9e-48b1-9a09-e74b346a0160", "value": "dz3837r1afd_a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e78390-43a2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777450095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450095, "uuid": "408a081e-b4a0-4018-b4fb-dd25288d0ada", "comment": "Malware payload (AgentTesla)", "value": "922b18dd4d09458db1443b7b6e392dfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450095, "uuid": "8e5edc27-8d79-47d9-9049-cc068f9204c8", "comment": "Malware payload (AgentTesla)", "value": "244c62ef5913051fb08d69f1eef5e72dde85afde90e1c5f015965d1e4f089a42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450095, "uuid": "c2797109-f097-47fa-9299-5bf96dc20c50", "comment": "Malware payload (AgentTesla)", "value": "3b962d637c119a3722584dacff072060cf1265b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450095, "uuid": "9d3ca696-ee1f-42a3-9ffe-a15a0151b938", "comment": "Malware payload (AgentTesla)", "value": "54ae3ffd806a76685722c08e3d4a739a5af25477a642097d259c0c700132442ce9aea2d99a6dcf5319959268050c163b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450095, "uuid": "20ae5e49-2360-46c0-afac-a18b6380daa5", "value": "T105168EC26C2B14D0CB4D77CEF7264F8D37588A487A20BEC9B7E96A88371215E9C6D534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450095, "uuid": "9e38f513-d4e0-462c-aa02-6f9b963f4cca", "value": "49152:fad/J22W1jG+gr4+Px+nbVRxsfRjgkxV1TqpeBjA:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777450095, "uuid": "bee62a58-c8c3-4044-88d5-8106a2a014e3", "value": 4324298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777450095, "uuid": "5e320a16-a735-427c-9a90-d1d1cb8cf74e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450095, "uuid": "5777948a-0b98-4765-94d7-2453ca1426bf", "value": "Yak_Final.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f71ccc-4384-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777437163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437163, "uuid": "c63f54fd-306f-4919-b744-de1a3e703e17", "comment": "Malware payload (Mirai)", "value": "a7d3692d9ff510fff94e534ca7f599b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437163, "uuid": "0e30358f-0058-474c-9478-54e80de30f2f", "comment": "Malware payload (Mirai)", "value": "25112fd12f18b47c1e28a7cded19225041a8d8137402b5d24367b0e482d7e147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437163, "uuid": "b7f73b78-f6dd-4642-af4c-5af41e9dac6b", "comment": "Malware payload (Mirai)", "value": "9bd04b9b1bee970d18a8bf341fd83e945aec5851", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437163, "uuid": "0539c82b-64ab-49fd-a865-8532b3e5824e", "comment": "Malware payload (Mirai)", "value": "7fc9cdda4d02d47d82801bc350c03ff56eecd646845d002b2fbf65c7d9bc0737dabe00b6651ac8b94440175a819b4d51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437163, "uuid": "30353e7f-3cbd-4cc0-9010-b5c798efb71e", "value": "T163B2E1E1F8164A3ED04F3B7D207AC098E9F2A4A619794582FB95587D20D3050FD3E4BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437163, "uuid": "692095df-c6d5-469c-92b6-b06139a121b9", "value": "384:MiV62ogcJgPR1bK5JG6sw4IGDXkXet8HEVUpscviHtz9gNIZGLQB85LglrTv1Rx:1logcJMbbK5JaL/DXkXZk+1v2KIZY5LK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777437163, "uuid": "13a1076d-b139-47ea-8da9-a6b3f4047f33", "value": 23456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777437163, "uuid": "9462869a-a011-402f-8bdf-4c2f7efb32e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437163, "uuid": "14304fc1-97b5-4e38-b6e4-c7bd4b73cbbd", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458b429f-43d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777471869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471869, "uuid": "7dfc9df9-3ae7-4711-ab26-8ecf8348ae72", "comment": "Malware payload", "value": "6446461a5f8daee61acf8b0c8404f989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471869, "uuid": "ef6f6160-261c-481f-ba73-e538052a2f6b", "comment": "Malware payload", "value": "259c93ffe7cb8bc4905b5ba7b80f5baa6b713a321ce327b5b20a13d34f3fb652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471869, "uuid": "d756251c-1d75-41d5-9b40-cbfb455a7c01", "comment": "Malware payload", "value": "b759fc06f1f845acc52f8d901070239f2e210351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471869, "uuid": "f86b61a6-3ad2-40d0-81a1-9954e65f9bdb", "comment": "Malware payload", "value": "7b951b02721678af937bb0962d9680f49bc05257e86ce2d8da17504daa96b34303729977ffa598e1497543bb63954f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471869, "uuid": "1541771e-4af3-47b7-befc-1e74443415eb", "value": "T1B6F419E722E27ADCC51EC4BF8252BC6EB3D7F87D011396E38119A26A5F6AD047E10714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471869, "uuid": "16088fd9-9705-475f-84c6-85b46116ed56", "value": "674cbe5b1cf59db7644406be8ae51963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471869, "uuid": "0cc4292d-c028-4f44-8405-09ecc1e49732", "value": "12288:xG+sy213uRiAxM1TYyea6KKjvcmXncvy1HjH85EZ0/0y3:Q+lGEa9rScvyh7V0X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471869, "uuid": "4f579dde-0991-44a0-887b-565baf629648", "value": 733233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471869, "uuid": "1401a5b1-1ca5-4940-b28d-115f48c7063a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471869, "uuid": "4a2be72d-3df6-4dbc-b629-cb5bbb3fa0ae", "value": "coinjam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4603afc6-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478742, "uuid": "e84f1a13-d253-4041-be37-44687414d34d", "comment": "Malware payload (Gafgyt)", "value": "0f5e9faebaa5cdddfac31b3f2194d66e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478742, "uuid": "c4b397f8-594c-4468-adb2-834f20234018", "comment": "Malware payload (Gafgyt)", "value": "26449195ce8015a47c6477c461fa1e1d1bcb2b9f27948fc6bca0bacb200457d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478742, "uuid": "001dc99c-0a1a-4528-8a5a-94d990f94511", "comment": "Malware payload (Gafgyt)", "value": "575895ba2fa9301feded1bfe8650bf74884d2439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478742, "uuid": "c89d2a13-bb29-43bb-b4ab-8e2b7ad80654", "comment": "Malware payload (Gafgyt)", "value": "453517b08efc9a9f58d0f4a16ddd9ec9b1808c4d283a3400a91ac35b05a498bc8e03fb268ca777acd423f4bb5ef28858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478742, "uuid": "e1e77d11-200e-46b1-b010-2e178d3aa3fe", "value": "T190B31A02D5508B53C1D2177ABB9F862D37332B68A3DB33155A24BFF81B8279D1E39621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478742, "uuid": "ec9602b1-a397-4a07-9448-a3daa74f0fa4", "value": "3072:gATbczHBzarA1b7539kasGwGcDmTwFbryTmOQYWyXdin:gebclzarA19sGwGqtryTmOQYW0din", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478742, "uuid": "a789e2b2-7014-4003-8099-8fb0e3e2a2c3", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478742, "uuid": "a8503e56-7e77-4e45-b045-8b8468cc24aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478742, "uuid": "5b84e67b-5f38-40f5-8060-0f139a76ce68", "value": "p-p.c-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a0e08d-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494849, "uuid": "f8617d87-26e9-495c-a54f-be142f49ec55", "comment": "Malware payload (Mirai)", "value": "5c093ae73670eabeddbd9a759483e1c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494849, "uuid": "b357ebb7-e058-43f3-a50f-213a1ed63d77", "comment": "Malware payload (Mirai)", "value": "2657fec04e5986dc267b030827c05503084a7cba6aa5b48781f4167fb0d29cd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494849, "uuid": "ab1c3828-738a-4a57-bb0c-21da6c2787e8", "comment": "Malware payload (Mirai)", "value": "95c6089a0991d4c1879aa29c50ce3f01668d108a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494849, "uuid": "9d61e341-708d-4733-90c6-daba24b05897", "comment": "Malware payload (Mirai)", "value": "67e87b55ba9e7f48926c7ffc38ffc3987e422859a26627f340266e286c887f82f6a1c66d001856708ebab2e528c940d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494849, "uuid": "0018f8c0-5ed4-47ac-a204-08a8d78f8892", "value": "T1EF33F19DCD5DF89861504C72E91D82466F562AFC49AC70632905CBC0D3E3CDFA23C76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494849, "uuid": "66741c15-d6e6-482b-baee-25502593270d", "value": "1536:10o2rRyJWqyg+s4hM57WQM2XV6V3kWHZX:10o+ReyLhM9VM+JWHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494849, "uuid": "2bb6104a-ed0e-435a-a7bb-7129303ba447", "value": 50240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494849, "uuid": "05dcbe03-428b-4b54-a876-61af37943639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494849, "uuid": "06b05d99-acac-417a-a8b7-32729551fe8f", "value": "rage.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934c531e-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440647, "uuid": "d5689807-f450-4e2d-9c7e-9fd337555e73", "comment": "Malware payload (Mirai)", "value": "afefe2417ae1dc6d285821398c4f0123", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440647, "uuid": "7ce099e2-3326-40f6-bfe8-fb36562b1ee4", "comment": "Malware payload (Mirai)", "value": "26cdf00b1e52a5f1a58c26c4fb17315018db0b13b77939d51f314d6be6b5fd7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440647, "uuid": "f323f20d-8f13-467b-a969-5299814326eb", "comment": "Malware payload (Mirai)", "value": "127bed141d0f65e923c53a8c4579e04debdf9594", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440647, "uuid": "e19af086-0d33-497c-adbf-95ad4da7279b", "comment": "Malware payload (Mirai)", "value": "641c333b18af0c79c4ec56fe2558a09c01e7e41d7382a17ad04cbe78b58ba41f28709410e53bac67da646cae04c75462", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440647, "uuid": "ba8648aa-85fc-4a6b-a178-47f6382bf8c1", "value": "T11F5302E01BB5178C5276D87639DE305F8134522F32DA2D102DA6918EF81B21399B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440647, "uuid": "8cbf421d-3543-405c-9f38-d5e0c9a0e124", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFt9:8D+CAXFYQChaAUk5ljnQsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440647, "uuid": "2a1cb222-3a67-4c62-86bb-8ebd21d1af30", "value": 66696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440647, "uuid": "f40626a9-b4ae-487d-92e3-76de12e85b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440647, "uuid": "9fb91fb1-54cf-4155-a8d7-fcb72b5aea26", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486aae6e-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494638, "uuid": "f6fb726a-b7cd-499c-9072-3d60832ecc27", "comment": "Malware payload (Mirai)", "value": "f735a3515d07377319c74487363f1acc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494638, "uuid": "3cd8766b-1803-4d56-b142-d9d6ba305929", "comment": "Malware payload (Mirai)", "value": "274b9a84ad0283723ee80ae008bf88526d9f52ed20d423189a16bce5acf02b82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494638, "uuid": "d9b22909-524f-474c-a512-abba04ba5e4c", "comment": "Malware payload (Mirai)", "value": "f812d4704a4b7c21023dcb71d06228164eb90eaa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494638, "uuid": "9d1beee1-9ffd-4661-ad24-e4159c903c8a", "comment": "Malware payload (Mirai)", "value": "d778a919637f60baf58b6b07b0e084e14747407f5993286e429a8abd097848848d62a2bea569a52574624bfc6c02039a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494638, "uuid": "723c300b-a16f-41c5-bbf9-270c799c61ca", "value": "T1EEA30887F902DE7FF80BD6BA049309197520FB660E530B76A367BD93AD311D41926F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494638, "uuid": "a464dd77-a239-4bdd-9acc-ec72bcc01c99", "value": "1536:3yT7fahnRWBuk8ycato5P1068Fx4/9W0aU5f9ZYjrAldWG8lQT+x:3yXyLY8ycatmP10H4DaQ+jG8lY+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494638, "uuid": "59e6d525-d163-43f9-b2c6-30797138dd38", "value": 99676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494638, "uuid": "23761f78-fd2c-4cb6-bd4f-e510bb2b761e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494638, "uuid": "7b3fe927-75bc-4437-ba90-e03ce575c6f2", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb1e349-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494650, "uuid": "52823438-06d3-4d8d-be5b-c52b8db36e9f", "comment": "Malware payload (Mirai)", "value": "a116a00efbbda3c0d706ee192a1b49f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494650, "uuid": "6d4fff9e-8104-47f8-8a2c-79516e6f6c7b", "comment": "Malware payload (Mirai)", "value": "281b94248dbb836a88cc6f21cb39dbfdaf66c88379d4c4f6ed8335f0fe63f817", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494650, "uuid": "7b01bf04-17d8-46d3-b231-4f90a1793dbe", "comment": "Malware payload (Mirai)", "value": "92b24a9ea743d75d384bf74328d3432c1c96cd68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494650, "uuid": "5ce14fcf-7d97-4113-bedf-e75085de7334", "comment": "Malware payload (Mirai)", "value": "8a8b2ec8fcc7359f5fea24c9fb0074eab3f8493ad8509c0d76c1fd98af55b2ebe3fc18cb85899a106a1077ff8c86ae45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494650, "uuid": "a56339ef-e3bc-4554-aa2f-8b1d2927889d", "value": "T1C393E842BD429F13C1C621F7FBAF059D3B166B79D6EB3202D921BF9023868DB0D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494650, "uuid": "291cb966-f4ac-4bf2-b308-ed800d89ca8f", "value": "1536:IV4F+8wMvh/zTjmCon3rqMGbUCiqeivkQGvu8DgYcwdxMUBAPRa:IVSUujmCon3rql4dgk7vu8/MzRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494650, "uuid": "122da985-caf6-4ec3-9ee9-428edafc5570", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494650, "uuid": "f66b4f90-92fa-4949-b018-a0db97ebfb0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494650, "uuid": "5b92994c-3da8-47ed-ba22-910d8690d6fd", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4379b3cf-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455545, "uuid": "294eace9-69ae-42f0-a94b-9e0853e9f09a", "comment": "Malware payload", "value": "bdb2231498f0d3fd22320af7db939615", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455545, "uuid": "3f287dbc-4fe1-4978-b7a7-8bbfc9c6eaab", "comment": "Malware payload", "value": "2898db1060c3912cfd88d019c3824330627383108c363edb3122295cfb86a59d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455545, "uuid": "429ddaf0-b260-4c48-9fc2-cfebd524b4fa", "comment": "Malware payload", "value": "fc97efa707346eda231405dfba43adfb73a8c716", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455545, "uuid": "0ac20333-8116-47b3-a637-5d0c34aee29f", "comment": "Malware payload", "value": "fce54071845cadd3b2c951a704e2f3591504cb756333e24b34a7baca09da659b3eb55c89c95bf089f11e897e73709af5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455545, "uuid": "c8076498-899d-49a2-af16-0f5dca5d1e3a", "value": "T17437230D535ECE35C4F2725C806E2F1E03726B49A5203B696B243F4B9BAEB8B54C51F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455545, "uuid": "b82c9f20-5d58-4ff1-b6c2-4c3d4e9ba6a4", "value": "49152:zXoD2guVyhD4i0red6yOz0rXykjTpIEnqff5+x0ro0r3ahn0rqdWQPaCV5N3J/IJ:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455545, "uuid": "b63600c0-60cd-46eb-9a2c-45e3958bf789", "value": 22903934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455545, "uuid": "2a274fa5-3b3f-4979-8ab7-24a6e39aa08c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455545, "uuid": "a8f70644-bdf8-4c40-9c0e-aee51138caa7", "value": "invoice-1645080830.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c8580f-4395-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777444649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444649, "uuid": "a133af09-a563-4682-91e1-770e3d4bc32d", "comment": "Malware payload", "value": "72cce5f54f04dc9a49d1c977a5c69d01", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444649, "uuid": "949f48af-6a77-466b-83ec-11ddee235224", "comment": "Malware payload", "value": "289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444649, "uuid": "cb8bf59a-0d21-482f-aec1-8504a5fdd12b", "comment": "Malware payload", "value": "aab324c7901cba601be0dc78df21b6d03b052caa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444649, "uuid": "c46a78e2-2b3b-476c-a79c-9f0888d51609", "comment": "Malware payload", "value": "0eca8587cd08c908a7f5aa8a1e72e5ce3627600b8be66643c7336f777989a06a97fd2751e141b79e6ad9d1e6b42d1778", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444649, "uuid": "a7b40b73-b718-4f8c-b71a-11f29f917fe7", "value": "T1677194DC012133B7ED29AB1F7B54CB25298481D22E90CFBD6D49DE244B847A73B4B6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444649, "uuid": "bde15b93-11f8-48e3-bc88-2625a5265879", "value": "96:GudMockujf0RS8BzIMtNoNz1zTSeFMX98ipEw6iTXg:tbAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444649, "uuid": "e8f5be80-0d26-42cf-909a-46e960cbc66d", "value": 3581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444649, "uuid": "b5c8f7be-ca79-4823-b08d-fcd6ffa62654", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444649, "uuid": "21a252f5-33e3-4f07-a69a-d04b2c1979a0", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b016dd7-440d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777496065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777496065, "uuid": "f150abe2-573e-4db4-98c4-7d36faa427df", "comment": "Malware payload", "value": "3168b8d41d10aa271b0450b9845a0b25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777496065, "uuid": "4863c881-a766-48b9-b80d-3dc358e030f2", "comment": "Malware payload", "value": "290d7ad5582d71917179d81a65bbb7314ff555ae68e9d7a37c6feeda066c6942", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777496065, "uuid": "2d8da47c-501c-482e-a93b-7877c52943db", "comment": "Malware payload", "value": "915f5e848b2bbefdbc190363ad4a6f610598638f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777496065, "uuid": "c1ba9391-bd9f-47c0-90fd-a07fe402a1c4", "comment": "Malware payload", "value": "ee1810c032f0745e20e6878334735607d7b419efd565a19c98bf6ed0a0447d427fe3e614f8b2750521a12a0dd370b7a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777496065, "uuid": "f9c5a841-506c-4980-a6ad-ea330bd9b5e6", "value": "T1CA347D85FB866CABC62E52318D9F837833B8F6D117865B271D39B2341E13AD0EE45643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777496065, "uuid": "4a099ec2-7f23-4c91-904e-dbf519d68a45", "value": "25e0515c720df75b2d1a4de62810fd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777496065, "uuid": "9400bd1e-387a-4ad0-9a65-070787d80ac0", "value": "3072:EsN3Zn2OSkwx+3h82mwONrjF2FZGnZJyLx6mwDcFWI3ar8ibSHXJW4J4rt5p6Onl:VK5NVGZ0ZT6UbSH5n+FR6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777496065, "uuid": "5ff7740d-a6e4-4a42-af82-77f15796178f", "value": 235449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777496065, "uuid": "103ee384-048e-4018-bae2-b65f6f5dd989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777496065, "uuid": "afe62b89-0e11-4548-ac64-e6755c947c74", "value": "verification.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7905231-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494851, "uuid": "660c6c3f-0ecb-4c5c-b3af-7ded8e4fdbc1", "comment": "Malware payload (Mirai)", "value": "7d0dd1bf87854d4dd02e7f778bf61f24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494851, "uuid": "37e9f77b-6f30-41ad-bbaf-3cb00e18a140", "comment": "Malware payload (Mirai)", "value": "29b5fec7be1b79cb0cffd1165f56d710e171c6e812f4b7816601a2323922c72d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494851, "uuid": "b0eff96d-8add-4b66-977a-d28f9eeb193d", "comment": "Malware payload (Mirai)", "value": "3c4889e32dc073b0078a63ce6322d790847b7a4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494851, "uuid": "2d1045fd-c834-40c9-ac62-a082cbec5d1a", "comment": "Malware payload (Mirai)", "value": "3ac6e2d8408b71da05ef416a9bb2a5e8474444db276d96a8de8724e5f65767c807294fa11ddd0a10a41771f938fb0034", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494851, "uuid": "b4ae69b0-30e1-48fa-aa7a-ddc29bd0449c", "value": "T1F203F1801B1AD0E0CC617CF5F913838B6B89067880DF72925AEDD2F9F48755339A8D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494851, "uuid": "c264960c-bea3-42ba-a5ee-aa79f17c86a3", "value": "768:4p7KN173cwxfp7GsE16q70r74zTMLkAhsBjJ5Fid8RV3UfN:4pk49wqQX4zJRju0eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494851, "uuid": "7fde17b0-8c2a-47ab-be52-717c48017926", "value": 39180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494851, "uuid": "cb69ef80-6ac3-47bf-9b23-934cf3b4f94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494851, "uuid": "520bbe42-f4e7-4c8a-ad9c-7b478b6df6e8", "value": "rage.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e169bff-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777464153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "5f5662da-dfa8-4788-89b8-a4b2127cba80", "comment": "Malware payload", "value": "9c597e0244cb66b2983393aaa5467441", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "e45374d0-ead3-4dd3-be6f-c953d219e69f", "comment": "Malware payload", "value": "2a5c5f16c1645d3f5777c1da16bccd333cec986a96aa6e2c43bb09635bbb530b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "55eeb2f0-c69e-4504-9260-d519f455ffea", "comment": "Malware payload", "value": "d2e2b138ed83a45fd812980a4e07daef7f5c8e39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "601498fe-c7c0-4197-ba44-43badfad2729", "comment": "Malware payload", "value": "c16a164aa790de7eb13b115bb8897a17fd7a1e593228cb5648365f020b6b17913e698efa550a0614246303f2bfe5b641", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "e29ab352-958d-4939-84db-9d1a66d0284d", "value": "T13EF020DAA91201F13F0C416AA10E3641A138F892D2C47A8E384DB3726F0CC28EA51B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "d4d10c4a-a37c-4301-b970-48b8146c13df", "value": "12:YBXmsWPwjE9NYXDtNY3RNYX8QPaZnFQy/Bg:4mHPwjE9NYTtNYBNYM3Sy/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464153, "uuid": "62c97753-3fc2-44f4-a96a-5dc5b69dcff5", "value": 472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464153, "uuid": "51364c61-2b6d-4ce4-9613-3d777b0744dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "5067fd95-391d-4cf5-8475-bc35ef3bc0c2", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b643da6-43c5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777465007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465007, "uuid": "af305d8b-5194-4100-bc47-079d6fdf3ad3", "comment": "Malware payload (AgentTesla)", "value": "0b2c4ab6ed035a810768ad96c35be03a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465007, "uuid": "b2e451f9-e495-4cb9-b22f-f26625430cbf", "comment": "Malware payload (AgentTesla)", "value": "2b5063957a9c410797bdcb19fdc735e2454a687bcf4b4364497b0c3d8fbcb46c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465007, "uuid": "8fc245d9-900a-435e-bbdf-54c9cd76c744", "comment": "Malware payload (AgentTesla)", "value": "bde4188c985c2070363a0f4e04dea061657849ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465007, "uuid": "b78beaea-3a07-4042-91d1-24491d08c3bb", "comment": "Malware payload (AgentTesla)", "value": "ceda8d454741d4d622877a9d88e72cb2ce62853258645d8155ba403dee8525eaa6ba551d4cde6d5260bd19820b9f4c8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465007, "uuid": "1768c063-6c75-46ca-893e-5daae3015bdf", "value": "T1790346040D2B5279C2F4A9C6F439AA365E33CC14B59778CB695A5CA9FF094CC83279BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465007, "uuid": "a0942270-10b4-4173-85ed-8e9b9ce12165", "value": "384:HIbLTMitd0g/ha4dQ2grbxgKNFlkVeUvnk+X:HITV0g/ha4dQ2gvxgU8eUMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777465007, "uuid": "97cfc604-54a4-493f-a89c-b9b026f7ca1d", "value": 39427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777465007, "uuid": "2662003b-79cb-4e1c-b5db-6b96c3807e3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465007, "uuid": "5715f4df-bedc-4606-8830-14f8edc826e5", "value": "QS48890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ef4df7-43a2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777450092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450092, "uuid": "df33b4c3-4aab-4e34-937d-7ce9b36ee968", "comment": "Malware payload (AgentTesla)", "value": "73af9274eb29b24eefda6f0ad028d4d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450092, "uuid": "a9b76ca9-f003-4d6c-b3e3-f4dce45cbeaf", "comment": "Malware payload (AgentTesla)", "value": "2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450092, "uuid": "5e0e7a4e-d1ea-41a4-b380-f1ae0c288073", "comment": "Malware payload (AgentTesla)", "value": "81da216e41a70e01b20c11e484f17c708d2b254d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777450092, "uuid": "70ce6875-4c21-4ab3-82d0-811910e2338a", "comment": "Malware payload (AgentTesla)", "value": "1778448bfd5f6fc5d3842755d52263b7d2817f1337deb42a32639c4addfaa45316dfb2019ba54da6b5c9b991be45932a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450092, "uuid": "ad24b985-fd02-4c7d-b0ba-e87f98493c08", "value": "T11DE52991675B9432A67DE71CD53AEA704A0E201325CADF1D306E93383A14E1B935FEE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450092, "uuid": "7538217a-76ed-4ff3-8c7b-ce78c745799d", "value": "49152:sm8fbrdXdhW5/2APgtUVhZuYAenAWYjv38YEtPPblzjSnFRWRiGrLAhWNP56IlW/:sm8fbrddhW5/2APgtUVhZulenOjv35E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777450092, "uuid": "3445476c-32b1-4499-80f4-6f1b5512b06e", "value": 3117737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777450092, "uuid": "3161dcba-a6bf-40bb-9fa3-ab3e63305f84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777450092, "uuid": "de1801fb-44f0-425e-a42d-c7815012e743", "value": "BANK_PAYMENT_ADVICE09345.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec2b4c1-43b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777458732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458732, "uuid": "6f5651ea-8c41-41d9-8ca9-0c4adad7ae91", "comment": "Malware payload", "value": "c1bc476409fcd391a809e11113fda140", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458732, "uuid": "8f96c0de-e7fe-49b1-9a55-c548b0a10d48", "comment": "Malware payload", "value": "2bcf9244e88fbc1524df7c3261af70262af58a1bf2a8d1df50a8dce63f0a31be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458732, "uuid": "32eaa106-9097-41ed-bad2-79e72a5e9a73", "comment": "Malware payload", "value": "968dfdfe02e1b20d4f86ef147f597ffaf49ce115", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458732, "uuid": "7989eb06-eb21-43e2-ac25-abc29622833e", "comment": "Malware payload", "value": "8edd257ca9cb63d8a6a7bb8a5fcc1a7d856a3466b37e4774ce1bc6ad3149c225da48c25ed00b7348f4c0b2fe4af5353d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458732, "uuid": "88dccebb-3a30-4334-a265-f07003c222d5", "value": "T1FC62C0BF61062111C90B0E2C60E9EB298CFC74AF77BDD855E24541ED1ABF8AF070584D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458732, "uuid": "0a80b38d-4297-4bb1-966a-abd6b1957068", "value": "384:zG9uWcwITsRxD7USm0oDwnJeN9MUF66zi29h1peG72CSVhQpDmQVp:IITuxPmXEJQ9MUF66x1pLyhpQVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777458732, "uuid": "b5ebd778-31b9-400c-a0f3-c1407557b089", "value": 15748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777458732, "uuid": "2594ea9b-e543-4c08-a309-64765b258565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458732, "uuid": "eec0bfe5-fdae-4982-a89a-12d3409456a6", "value": "photo-126386294.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bcdfba-4410-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777497322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497322, "uuid": "a18ecbf6-5dba-4f07-8951-3307ad0ac397", "comment": "Malware payload", "value": "d8547effaaa0c478d7164f5af480a191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497322, "uuid": "582f4b09-bbae-4d37-b080-2fea100f61e9", "comment": "Malware payload", "value": "2c6cd0c8598b49f1bf8d7133a9ae988a85cd16a01d58bd578fbb92b5d4abd92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497322, "uuid": "2dc0b62f-bf53-4c14-be51-53f234ec9e9b", "comment": "Malware payload", "value": "5fd63c16b9ede4f36f6e8a34bb7f18ab82362421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777497322, "uuid": "3a3f1f2e-0dd3-4c2e-9dda-01290188124e", "comment": "Malware payload", "value": "c3371a6cff8cf3c865fbe7bb08377b1e291fe8baa88c362ee3611ed5e05aa50558fd2f12c297e70d291131e24a36527a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497322, "uuid": "58d24e90-dce6-49c5-84ad-98da15898e63", "value": "T110565A53EC9968E4C1EED5318A629252BB717C881F3173D72F50F6286F76BD0A9B9300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497322, "uuid": "5945e6a5-b01e-4904-89f8-7b36a0a98f99", "value": "49152:Au0SFjfEbe6S7CzEiOCC/M+xwS1O5rj2W/6Y2u/TlUKXvTBeEpqAnRKlK1Kcl4Ny:Au3fO7DL5AkvTZflEE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777497322, "uuid": "bf308485-d474-475d-b679-e908cef3a795", "value": 5906594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777497322, "uuid": "0256640e-9bdf-4324-ac3f-30c07015af00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777497322, "uuid": "3f80d733-abcd-4d0e-b889-11830138bc52", "value": "httpd-kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe603a5-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455539, "uuid": "05665759-f394-4d0e-99ab-ee2aeabc6b2a", "comment": "Malware payload", "value": "ff71a2d408cdf90f5bbf738845533ffb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455539, "uuid": "2136c82e-ed69-4d72-8206-bec2eaf18d1e", "comment": "Malware payload", "value": "2c88183e033f8934ee4655f8f807ea33f84c6a14430158451103ba4d090e94f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455539, "uuid": "4ba03d67-c474-4461-87a8-686445ffb038", "comment": "Malware payload", "value": "001410bc8ca557c21527e2abecc1328e680cef7c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455539, "uuid": "8060b873-dfad-4509-af8c-2bf83c7a33d1", "comment": "Malware payload", "value": "f6624dae7ef7ed5f812632549d240d0ef9bd0b3892b1ae714811595cb6b8cfc10c62f074d39a176df76cd5d75b8cd835", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455539, "uuid": "5a6142c4-b86f-41fe-83d2-2c4c50d6ad39", "value": "T1B83723A64D979FA3C09B66245839395F1CBE6D78C1AAEFEFE082BD5801DD93D004811F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455539, "uuid": "3382bc4d-2268-4d76-8b9b-e02111dd5ffa", "value": "49152:NCjez2CjezcCjezpCjezHCjezECjezWCjezSCjez9CjezDCjezgCjezrCjez+cyb:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455539, "uuid": "dbdfe80c-e134-4b20-8c4d-e9054c97be0f", "value": 22903938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455539, "uuid": "7fc6a4f8-e1a8-4ae5-b97a-89fe798c3411", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455539, "uuid": "0fe4e4bf-9eee-4c94-a3fe-7f6ba969cc2c", "value": "invoice-1645080830.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f369014c-43f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777486764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486764, "uuid": "2ac7caf9-a29b-4461-8551-0b0688cc130e", "comment": "Malware payload", "value": "13d3b21c3de723f9d1ae8f5d8e5612e1", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486764, "uuid": "945d1e8b-a141-4097-a39f-50c7ef5c351b", "comment": "Malware payload", "value": "2ca0f7ac4c2e25f0260ace1d3fbf4e92f9d7b1f969682a94c3887d5e1ab48dd9", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486764, "uuid": "e9dcd5f1-a339-4693-abb1-ee2bd9e57810", "comment": "Malware payload", "value": "e18b68c481963d73a2de67010ad8c526107301b2", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486764, "uuid": "84db4f65-09d2-482f-9213-337c90ae8d96", "comment": "Malware payload", "value": "b8c5fa7d74c043c79371551f69f06f8c1acbac109df46d6fc8f69d6b7c7335f974f302b6e0e04b81cdffa3d1ba2f55fd", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486764, "uuid": "8219a2af-0822-4a37-86e8-488a1daa923d", "value": "T147537C4DA6864D924FF01B4EA889C960C6781D3361E462B2AB4D27D79CC7CD90F7FCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486764, "uuid": "60eb07a3-339f-4cf9-9f2f-e74fb5f99379", "value": "1536:F3QZTmxZeA+639r+cV7uyqrHYXhE9hfjjByc5h:ykxZPgIw4Xhihfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777486764, "uuid": "faf03d06-852f-483d-a7c6-4d85e2552959", "value": 64016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777486764, "uuid": "9beb3588-a1f4-4924-826e-d6729d913550", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486764, "uuid": "cc5881ab-648e-4368-8195-1e59a42a33f6", "value": "enine.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318c5cdb-438a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777439624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439624, "uuid": "a9f70725-4bfb-4ba8-8c34-77b02e525377", "comment": "Malware payload (Mirai)", "value": "9c1fb784e02507119b97db0ee96557c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439624, "uuid": "ba336d7d-ff26-49c4-ac34-6acb5b83c8f8", "comment": "Malware payload (Mirai)", "value": "2d7e31e4df66ed266a1a4ced918435b672068e89e6211a8d7eb3ae8ca4138342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439624, "uuid": "f7c8bf36-a279-4a40-8ae2-3e301e104823", "comment": "Malware payload (Mirai)", "value": "314b0785409c24a0b84952f03dfd1357157cabaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439624, "uuid": "54c3cc08-c511-4d41-90f3-1072a13906ce", "comment": "Malware payload (Mirai)", "value": "b6c86e05e5a48c64da9b94afb788f3218cf87e426927e5632a919ad136f0a559088e50514feaf16bc0976cc0b3d5a4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439624, "uuid": "7d1ff109-19e7-41ef-9d5a-0cf1caea0f0f", "value": "T19733E607B84285FDC156C134577ABA3AE83671EE133CB6A777E4FB222852E224D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439624, "uuid": "c6f8ca0b-054c-4430-973a-250e3d7bfb23", "value": "1536:cPL8beJ1ZYqeFtyHxWog1HiL/zxLdJudZO1F:OL8KLZYZFYRA1HizzxLqdZ0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439624, "uuid": "00c06c84-0f44-4cd2-b5ff-df7c3c5b5899", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439624, "uuid": "aaca4607-de07-4735-98f3-d987e189c02e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439624, "uuid": "9dce97a3-0c3f-4498-ae22-bef504d92055", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a703dc-4361-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777421974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777421974, "uuid": "f8279370-a781-4633-8a62-435141bb551e", "comment": "Malware payload (RustyStealer)", "value": "6028ad6331e831097e19153ff8b45161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777421974, "uuid": "813aad69-9442-405f-8b0d-54d0774c40a3", "comment": "Malware payload (RustyStealer)", "value": "2e3d924383ed4871630ab9a4d709dc08ef0c3652446846eb5563ec1fc4afce38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777421974, "uuid": "fbf6a1e2-b46c-4f11-a3d1-7f32dedf5885", "comment": "Malware payload (RustyStealer)", "value": "cf517ab243a993aa50c4935ad9e1dafbcbe1b1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777421974, "uuid": "d32f1216-b3ec-4378-8078-6c5724317417", "comment": "Malware payload (RustyStealer)", "value": "f1e920efa1f7e28048d1584a9d6a8e4dedac1de7ad63311f0f8c3efe4a158a49ebf93639755acc382d1fbcad8a8ece38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777421974, "uuid": "42937854-5582-4203-9c93-d3634812fbda", "value": "T10EA47C07BA9990BCD559C07983169633B636B88A0330BAFF03E49A303E55FE56B3D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777421974, "uuid": "8ce0eae1-297a-4d67-b956-5560db93d72c", "value": "187d06fcb051f46053b6d25c72db12ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777421974, "uuid": "7599a782-1f9e-426d-9f04-c2957760adbd", "value": "6144:Q1098PEadsn96YfkTYNmnG2AWqHqbsKOhExANd2kQYbzFU8B63yBBW:K6TgsnQYIt96HqbsJC+NY6pV63+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777421974, "uuid": "1e0d845e-46b5-4f8f-844b-7c7bca457216", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777421974, "uuid": "b0048c4e-9bf4-403c-90cf-9d52699f944c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777421974, "uuid": "8b88fe56-4c1d-4c61-a3fe-40442a167f3b", "value": "2026\u5e74_\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da4c996-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455482, "uuid": "e028facd-43b6-4a6f-8560-1f4eda2df3f2", "comment": "Malware payload", "value": "9211f3e51c649f6b43718020abe06cef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455482, "uuid": "663a1692-5cdb-4814-a1cc-181b931e0535", "comment": "Malware payload", "value": "2ead28895a9868d2391db225270c1711c8cc2f02f6651cf4c5289b0e591b9fb1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455482, "uuid": "6d4aec05-8cf3-4553-81e2-ebe8d6aa088f", "comment": "Malware payload", "value": "757ef5b7628d18c4b06b5ab46666931769736874", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455482, "uuid": "85410012-1493-42e6-9273-b7b91313686e", "comment": "Malware payload", "value": "bad4ce5ec5c6fddd50c3ff92b8e7ba4b10619c4cdf4027f37c71f3eaa2d3b6d378e1f77a8529a869ace67c6fc22b9d82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455482, "uuid": "5a956356-68d4-4c6c-a534-790e600dfcf7", "value": "T1BF3723949A3B386F452D73B8153C6FACAD904F2C0544A5AD9BFBBC93477EB46C480638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455482, "uuid": "999a7baf-e615-4f0a-926b-2441c6b16c3c", "value": "49152:VKB9wkjKB9wkfKB9wkBKB9wkmKB9wk/KB9wkmKB9wkeKB9wkZKB9wkYKB9wkkKBN:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455482, "uuid": "12398d4a-3874-4ac5-af2f-965da18e3a0b", "value": 23424198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455482, "uuid": "9adfd852-7cf0-45da-9337-e9d680485fc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455482, "uuid": "7d48137a-be64-4731-8d18-13b3fc3d7897", "value": "invoice-1645080830.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b44f561-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494991, "uuid": "545a7e94-5217-48cb-9e9e-ada0285141b7", "comment": "Malware payload (Mirai)", "value": "ddf416c1b759f9cca04338f6cca1d67d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494991, "uuid": "6ce6d670-d526-46d0-b3c0-4ddaf5758463", "comment": "Malware payload (Mirai)", "value": "2f4287f09b1d5327df52c1d7686137d3c10190f7bc81c65daefbec312aa3dc32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494991, "uuid": "b4ffb7b6-3c60-4e82-9be7-523b45db7a19", "comment": "Malware payload (Mirai)", "value": "f3b828a8d7c2a2f329f7e1eb539fd168934ea9be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494991, "uuid": "acbe2319-c142-41d2-8bca-e3cabb61cdbd", "comment": "Malware payload (Mirai)", "value": "d5fc7bfcb76430ba995c98ea6ff0c86f986dbddb18d699e39ee3b952876035316f7fe6d721111b062d0a8bc02a78f0a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494991, "uuid": "8dc7199a-6b8f-45ac-b9da-8991effa99f0", "value": "T186931C46B9528E12C5C212BEFAAE415D33136F7CD3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494991, "uuid": "83e08e0e-e9e8-4ccd-a631-e8386da0cc45", "value": "1536:gUnBEkjRCMMZ0l3EVepOFnTRfGqtCMu/5hyHvhcY4smvVaZ6fEEarNQ7ibQZfn59:KktCB0qVepOFndfGqtCV5YHJcOmvVaZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494991, "uuid": "13725ad0-444d-4ab3-9a3a-4e05049e7832", "value": 96856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494991, "uuid": "74902fb2-81e1-4b33-9ebf-f553e82fbce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494991, "uuid": "0877858e-c0ed-4aa6-abed-5fd6b92a6d61", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f83e91d-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1777479724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479724, "uuid": "6196356e-e04c-4faf-9a73-d7eecbad2c8c", "comment": "Malware payload (NirCmd)", "value": "c8dfff5b3281405cf6372a579b978ffa", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479724, "uuid": "f41e28d6-81c2-4b90-98cd-af91c9b7d714", "comment": "Malware payload (NirCmd)", "value": "2ff2c511b26796bdfa6befc3e8e155276b552e0c6844cbcd97f81e36ba0fe059", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479724, "uuid": "c18a7ff3-1838-49a5-88bf-f989a9c54543", "comment": "Malware payload (NirCmd)", "value": "5532277705d36ffb96e690db041bfcbb70482856", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479724, "uuid": "c0c2c162-7e18-41ba-9a78-81ae9f3e452e", "comment": "Malware payload (NirCmd)", "value": "a1ecd24b98f34419d175a6ac287e4acc51a6fcc6e4c1e0b05f6591130e13b7eafaea8b55a504caea29375284b7143c3a", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479724, "uuid": "2569b4ce-f308-43ad-a931-3aacfc39979e", "value": "T19AA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479724, "uuid": "f1b316bd-c1c8-437a-9c59-a7967eaaf3e7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479724, "uuid": "61b64c78-4c98-4da5-bf8e-2f189c96d95c", "value": "49152:ABR7Tpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aJTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479724, "uuid": "2959ffdb-bcd7-4a78-a2ee-41ea36e1fe16", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479724, "uuid": "ae209c06-8c15-44e0-8b3c-c0f00408429b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479724, "uuid": "4d6a9f5a-3aad-4175-8644-82b35f74b4b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4251afc6-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441370, "uuid": "6a1b176e-17bd-4389-bca7-c8e9353d1655", "comment": "Malware payload (Gafgyt)", "value": "4d74873f120a7af20baf4d1d79cb0158", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441370, "uuid": "3db7a827-084f-4287-9bc3-e5fd311427e3", "comment": "Malware payload (Gafgyt)", "value": "300ccc342e2df4c9a94e81f4a36136f9725152f596a00ecfd392e60b0fd2dc95", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441370, "uuid": "753fb44f-9d82-4698-8d81-6e7bcdcdc837", "comment": "Malware payload (Gafgyt)", "value": "c766027fad04ff3db7470dd8cbbebff71e8ee1d0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441370, "uuid": "48063ae2-38a2-4e7e-9507-51a9643936b3", "comment": "Malware payload (Gafgyt)", "value": "6de30f09f90991cbbcfea25a4c7403cd14676ea062b6eefba2ab8ca4d03916827b18534fd76f27f840116c62f456e2d1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441370, "uuid": "5a7695ff-9f8a-4c57-92ce-0efcd9fddd8f", "value": "T1FEC33A2B3B231E23C0C9507102D31332BAB5D76538BD57E7B9D06DAC2F1AA983416BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441370, "uuid": "2ce2736b-4925-4d97-a776-2971d4509fc5", "value": "3072:9SRC0+2noxQHh0NPGHWphakTrnorm/nCEP/UnSQf/R:HlgWphakTrorm/nCEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441370, "uuid": "803caa3e-1845-4ffa-ac7f-27d12d271d82", "value": 127477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441370, "uuid": "b5d00566-54d3-473a-bd0a-0b855b3f3e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441370, "uuid": "95bf1044-25c1-4b53-be16-4d0dc021b685", "value": "assailant.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e02cc1-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494635, "uuid": "8a63074b-8bed-4843-b477-2758260d3872", "comment": "Malware payload (Mirai)", "value": "085b7c1702f306e8d857ce5ecdaf928b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494635, "uuid": "907cbd3d-14c6-4e02-b1a9-60759b9c30da", "comment": "Malware payload (Mirai)", "value": "3136c51a502e3149c2f4033bf8fcb619e31255ef047a8c18164fa469d90ac737", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494635, "uuid": "e5f34850-caeb-4f29-a517-38cb4311ecbf", "comment": "Malware payload (Mirai)", "value": "e7f060e2665951f8572f6a7a8ac0082686a4933d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494635, "uuid": "6455e64d-011b-4aa2-9e86-37cbbf10d7b5", "comment": "Malware payload (Mirai)", "value": "cddb2d8bb242ae7066e241f30d4cd2d29d136b36f4e49d9a7b0f65ad9083745eff2f1636cae72bdd2f6bb7b77a640f4f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494635, "uuid": "7e884ff3-66bc-4379-9d46-2ae208cb781e", "value": "T13F73F942BA47CAF3D41708F041F7B63F8E31FD3A493285A9EB65BDA2CA275C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494635, "uuid": "7e5e488d-994c-4aab-abe1-b4fdeda7ffec", "value": "1536:t+ml11IujxuIX9GtkxBP4Hojys9jxeU/riWj8iamQuPbiXaGYjqrU9+1:t+ml16ujxVXPBP4HojyOx/3wiam/DiXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494635, "uuid": "f58f655f-bf58-45eb-9cd3-77d516560f37", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494635, "uuid": "72f34868-97e5-42c1-b54b-22aa3ca30e37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494635, "uuid": "bb11ec6e-6fea-4db6-a3e2-98db8b89de3b", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9c23fe-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441358, "uuid": "16c4d906-8ebb-4800-9b4a-1a5bb309bcb4", "comment": "Malware payload (Gafgyt)", "value": "cca5790d20634fda854cc3a70ba7749b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441358, "uuid": "adf0efda-2584-4352-81e5-426177ad5c64", "comment": "Malware payload (Gafgyt)", "value": "32d3b27383035edee5641b0317aa15461ce467fd768e94b16086638b8a2d7617", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441358, "uuid": "6dec2ca1-7e84-4a37-a5b9-02336e727187", "comment": "Malware payload (Gafgyt)", "value": "447be3755b5827d556c68daf717b84a05fcf847e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441358, "uuid": "6a838e53-2523-4dbd-ba42-4c84cda79577", "comment": "Malware payload (Gafgyt)", "value": "4d0dd5d41731dac8df4619238388760d41f11cea07a8c8d7ae976b70966d72d6ba13b8ccb868a4f117a540ecb281b2e1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441358, "uuid": "26f879da-617e-45c0-bdc9-0967b88885d2", "value": "T149044A09DA409B17C6E227BAF79B438E73239B5477D733058928ABB03FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441358, "uuid": "54e9a80f-deb0-4b2b-ac9d-2cdd099ec56c", "value": "3072:3J/o2ydspceQQ2iDw4EBaUyfPC9f8oecYzvRE245hLLvOraTM/9QKHNPEUmww3B5:Dw7BaUyfPuf8JzvRs5hLLvOrSM/9QKty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441358, "uuid": "a978301f-6d94-48b5-8cfe-127400e1c663", "value": 180824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441358, "uuid": "1f2f58a5-5b1d-40b4-852e-4aa6edd47066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441358, "uuid": "d4346b18-7427-4c38-9508-171f4a4ce908", "value": "assailant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4296cf7a-4425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777506224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506224, "uuid": "aebff134-8c39-4520-b597-56b9799f7fb9", "comment": "Malware payload", "value": "92b87e35868489c8bddd003ce72fe40d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506224, "uuid": "11548843-071c-44e5-a3d3-2102510841a1", "comment": "Malware payload", "value": "32e7524898a7c731156e1beb37fde7e80eb7e5b292269879edc0c4268b39657f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506224, "uuid": "6609425b-2321-43fa-85ec-99522d69d3fe", "comment": "Malware payload", "value": "6ffc986e664d3555ac0e4c68af01a4de58c96088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506224, "uuid": "c8b08186-986b-40f7-8935-e849ed3a4e6c", "comment": "Malware payload", "value": "4a430f257a596103f9c61b947b6c575c78e76c2af9b06b1c1cc8b7a158ef71933c379690a3c42527606c12e5bc98f1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506224, "uuid": "2f0a7ed0-115b-4462-9e2d-aa7114148252", "value": "T1EC16195BB8914682C4E4367ABCBE41C432A31EBD9B9B1357AD05FE383BBE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506224, "uuid": "4fcb2c1e-8e49-455c-9da7-a7661da85633", "value": "24576:T2qJ3XZ8jnhW2mY5qj72x4ytM7V0WL2DIL3QsKPZANisammM4lLJGGx+mZnOxzp2:+8JmqRVWoe4tiOlXqAbCuXnZz11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777506224, "uuid": "9382352f-c631-4d4e-99d9-6e6ea5837c68", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777506224, "uuid": "9136b61d-b2a4-4b5a-9230-72691d815d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506224, "uuid": "f78bc667-c7ae-4cb4-ac4e-3825139192a3", "value": "SecuriteInfo.com.Linux.Siggen.12193.26637.5946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475593cb-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470584, "uuid": "c275236e-e724-4b87-a41a-558df5ff193e", "comment": "Malware payload (Mirai)", "value": "9faf387b35af79ac5d9d603e2d70263f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470584, "uuid": "d698692a-753e-49c5-8f41-8645c413a4fa", "comment": "Malware payload (Mirai)", "value": "33d69454547ef2eed878013bd5ba4c25266285d4ec90cee26248b3da005c8863", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470584, "uuid": "088a21af-94b1-4c23-8669-b57426443489", "comment": "Malware payload (Mirai)", "value": "3e96a7bd4692b819169cfabb89151a12ee6ec2e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470584, "uuid": "8a32328d-934a-43d0-92ff-57f5dae44593", "comment": "Malware payload (Mirai)", "value": "e4ba9a3917adc0476289513f480638bea6f9f8c339345a9f0fc5769ec6b60ed5a10dfd20199b2fb6b0aee49c99e55369", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470584, "uuid": "38d651b5-3902-4789-a121-4f234b7fa183", "value": "T14273F942BA47CAF3D41708F041F7B63F8E31FD3A493285A9EB65BDA2CA275C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470584, "uuid": "7a899177-9df5-42e1-ac03-56da45e4f98f", "value": "1536:t+ml11IujxuIX9GtkxBP4HojIsDjveS/riWj8iamQuPbiXaGYjqrU9+N:t+ml16ujxVXPBP4HojIgN/3wiam/DiXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470584, "uuid": "e87e3d34-fc67-4b2e-9776-c886bcdd974e", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470584, "uuid": "9f5ebdc8-1253-48f6-ae29-e0f0a7623a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470584, "uuid": "b63684a5-a97f-4065-a4e0-902cc123087b", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9fffe5-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440639, "uuid": "3d34b37b-dd36-481a-a32d-bac0df9e7f5f", "comment": "Malware payload (Mirai)", "value": "5e96e74beb468966077e77f929a108d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440639, "uuid": "7457a34d-6543-4aa9-ba36-1b4157404f4c", "comment": "Malware payload (Mirai)", "value": "3438def845504f698a725b6474c60233b9d31cc5f42364f65970301f557390fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440639, "uuid": "4c049a97-d898-4101-9d92-89ff2e26e6d4", "comment": "Malware payload (Mirai)", "value": "755a6b64b7a62b55eec05ba2b669bec746e0d89d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440639, "uuid": "2b944b12-6ddf-476a-83c9-23317dfa27b5", "comment": "Malware payload (Mirai)", "value": "018e9f863ea44b3e8af3b7f62be32cab7d04f98e7ed4061d65658a01e743382ad7f8ba966e0c946721794b15ebb0313a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440639, "uuid": "9e1de0dd-ec34-41ce-9571-a9ab32b93955", "value": "T144356C5AF2F370BCD067C030439BDB62A835F47601226E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440639, "uuid": "0a83dc5c-528a-427e-9fac-0a83d7764674", "value": "12288:mKVDbSLEIGGoQY7RbNchvnvwj3S1bstjfN0Oe+my2i2+j1pPZ5k:vVHSLEIGGoPRbNchvvwb0AtjlRIZ+zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440639, "uuid": "1ea539f0-8145-487c-9dc6-8c3cc5b3096c", "value": 1140104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440639, "uuid": "e453dae8-2476-408d-a2a8-0c7ead30b2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440639, "uuid": "5dccc2fa-7ee8-4d80-add3-852569683a70", "value": "x.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a312977-4401-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490882, "uuid": "99730ee5-1d91-4b68-b60f-8388366f0fce", "comment": "Malware payload", "value": "40518b3e7e29f9de9322a17d77b4e8e9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490882, "uuid": "8bd9aa76-9faa-45e3-8988-b72050287c52", "comment": "Malware payload", "value": "3494736cf73cb8f8d1238dfd3d263fb55b976455638b3dc7eec0c5c258e2495d", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490882, "uuid": "77f65b17-04e2-4f2f-9f37-d6b5b431bac4", "comment": "Malware payload", "value": "60a7a45bbd54151525fe65c013100339f446f653", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490882, "uuid": "c743e362-a4e3-43b2-a8e2-3c1d54d36bab", "comment": "Malware payload", "value": "06c5fff8f5fad6785a6abc3975e1a4c867b0e24b6839aa53a2f7f478cebc728c0c4a3b605bb077c539d241be4a0c5f85", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490882, "uuid": "d71f6ff0-c3dc-43ed-bdcb-ebcfcfa74912", "value": "T1B3A5230AB97534FAC36B5674C8114C06F7B77CB14782A6DF1B900BBA0E21AD46E7DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490882, "uuid": "40e4c5d3-6b46-4237-bf4c-b99ef68970e5", "value": "69ee4db2c183a8be36217e84a1cfebc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490882, "uuid": "68c949f6-7e17-4e80-b05b-06307568587f", "value": "49152:+aEUqAqqRx8anWzff0P5lxt98A+IN4J1istrGp9Hfn:+3WRv8aWrf+5R+1iWrGvHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490882, "uuid": "2a6bff4e-5250-4aae-a30a-79a2978425e2", "value": 2067456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490882, "uuid": "f68b8f18-087c-4172-a5ed-4990baf2f8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490882, "uuid": "68232892-c851-450c-9a4e-eeca51d1cc13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d13ec6b-4413-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777498511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498511, "uuid": "f3e1539a-ff4c-45a3-9ee9-92106beacddb", "comment": "Malware payload", "value": "76c5b1104a0f6794da71504f7d47dad8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498511, "uuid": "99e70759-753b-4d5f-9ef7-2345ca394fba", "comment": "Malware payload", "value": "34b14fc42cd3d81f75a620109cff348a72d8f8b0ded1c48b6599a227558a17be", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498511, "uuid": "8ba24d99-e81e-4b5c-b6e7-0b4df29aefa6", "comment": "Malware payload", "value": "cfec7eb063b4267b54b6a10e85696f02841aa5a8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498511, "uuid": "8ead188b-c3f2-4a23-8be9-012cab00f056", "comment": "Malware payload", "value": "2a6692c770f4abe8fed7a022859ac9af5e9905591dfa713a0054773f343ac67af957d0d12b87434ccd08ce0ba38a460c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498511, "uuid": "121195f3-d27f-4632-bf33-c8d4be5c3fba", "value": "T1BD3533CD5E9A4E47D50240FAC2208D515271B3928C9A2E1B9F660E4F93334FE93AC6DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498511, "uuid": "5441b083-9d6d-4dbd-9dd6-77abeeb8c574", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498511, "uuid": "9120f53b-b3e3-49af-9e42-653f27edbc95", "value": "24576:+IWSF7OBQJb/HXGVD6jdQ+Lqggv3hjcZ1WrYtD:4hkDXGx6jW+WggmZ1Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777498511, "uuid": "d7ba5061-d246-4584-a61c-f2f7ee628748", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777498511, "uuid": "7cd89a0c-959f-4ca1-bc5b-b56e2b6c65c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498511, "uuid": "bca3f00f-f15f-4954-acb8-02991b6be830", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e5a3ce-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441374, "uuid": "e7ccb92b-12ab-4cbb-afb9-0f86ee173bc9", "comment": "Malware payload (Gafgyt)", "value": "14a7a4d7221d246521a3a8a4f417de22", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441374, "uuid": "cda766b0-e259-48c5-a8e2-b372f23b4045", "comment": "Malware payload (Gafgyt)", "value": "34b51edbf612075f515e3d729f1ec6b0799f818406fc14e55e457424681daf92", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441374, "uuid": "2f340a0c-e411-473a-aefb-c8cc70a3f332", "comment": "Malware payload (Gafgyt)", "value": "961064fa4574536913b49105696a265d47b285bb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441374, "uuid": "f0495683-1e56-4938-b685-0a1a2bb9ccf6", "comment": "Malware payload (Gafgyt)", "value": "24d36cd1a52e2dff13e0ebcddd00e05fcdf6d543efebf9b96042db5e6461f7add57f03af499e9e66660e62b45f030b41", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441374, "uuid": "4265ea41-a21f-4581-8f2f-7ed5ef6849f3", "value": "T1C5C32993F801DF66F80AEA3605D34725B630FB620E931A7273573A669E362D47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441374, "uuid": "2b2f8a5e-ee11-43a2-9ab1-4ec98ba9e17f", "value": "3072:9I0TPaF1m32ljxVDRH9yv9JJ36PfPljBn7xmva0PDGnSQNER:9I0TPu1m32l/yvvJ3wfxHmva0PDGnSQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441374, "uuid": "cf959fcf-8e83-45b4-97c7-c230cf07ecd2", "value": 118946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441374, "uuid": "9a06d656-7d07-42ad-ade6-5dd245705930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441374, "uuid": "72fa9b9b-d648-44a3-87ef-5abdc79df269", "value": "assailant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0c6d1b-43f6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777486349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486349, "uuid": "a47dc08a-1299-4034-8dff-194e6ffbcdaf", "comment": "Malware payload (AgentTesla)", "value": "33c0bd49ca500c0391fcb63b75939980", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486349, "uuid": "1455e35a-7eeb-48e4-9163-e759a5d40803", "comment": "Malware payload (AgentTesla)", "value": "3546f7131eec3d3164172da361b5329b5cd42a3751672cf26244494e1d2ed463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486349, "uuid": "9f1e5e29-d8b0-435c-adbb-74452877cb9a", "comment": "Malware payload (AgentTesla)", "value": "cab14f9d9c354c690dce391d194d6057a8b16816", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486349, "uuid": "c4cfd789-5056-45cf-ac22-dcfc8e46ac70", "comment": "Malware payload (AgentTesla)", "value": "1e994af401b3926a56a441d20a43738acfbabc531580baa35e735f1d799abf8b8f0b0fb17aac6075c2d10cc6fa9df351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486349, "uuid": "41eba04c-aa22-4343-b151-31033b394056", "value": "T19325335336359A5A74B72FE2197CB5E5FBBE7FC3211262B903290FF70720856790118A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486349, "uuid": "fe2a65aa-da32-41bf-9210-29ee4c39fb2a", "value": "24576:k0la4gka0LJu37COXz7bBMrKyMHQyhI2wSmQXFdz/wH3zpVlxQm2:k0ly0w3mOXD+MHQyu5SjXPzk/lxD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777486349, "uuid": "a2c19ce1-bf8c-4853-9a50-9ead00fed99b", "value": 1018953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777486349, "uuid": "1e4edd88-9756-476f-beed-aede72d6c703", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486349, "uuid": "00525411-4c71-47af-a31b-67e32f85fa8a", "value": "Transferencia bancaria correspondiente a la factura 204A con fecha 28032026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e261a9-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441356, "uuid": "3953157c-3bf1-4828-9f86-59d646230760", "comment": "Malware payload (Gafgyt)", "value": "c72d3473c1a28aacccfb112c904ced90", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441356, "uuid": "c5541127-ee0f-4c30-a2c0-add03ad1dc6c", "comment": "Malware payload (Gafgyt)", "value": "35c655b8ea660fbb48f7a02508708f2fc10c494c54668637e6150a636620472b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441356, "uuid": "b28b09a2-78f3-4d46-a751-dbd973c48840", "comment": "Malware payload (Gafgyt)", "value": "a6390c9bf304083016a5c03a0d5192f8fee8d94f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441356, "uuid": "1832ad62-2118-4e46-9aca-d1514a236190", "comment": "Malware payload (Gafgyt)", "value": "65b5bd93045510f7ea317e63ca692e10fd1026c46024dd67c96626426e33374df91f54e2bc4f46561c01ebe03e18db59", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441356, "uuid": "083ee7b2-ea26-473c-8700-b52975767a45", "value": "T1CFC30705FC404B27C7D23BBAF79E438D773666586BD733115A296EB02FC1B982939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441356, "uuid": "0975b366-2454-4dc9-98b2-d27d9c4c436a", "value": "3072:nFDcpqlgQSnoHyOKwrRUSyV7nb55hLN/vi8bewsojUQQRh6RYAvZR:RRUSwnb55hLN/veojUQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441356, "uuid": "c998b7e1-102a-4771-867b-ff8e075321b3", "value": 128413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441356, "uuid": "5e9b6a47-03f4-4a1b-9f45-5d4ee8584379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441356, "uuid": "ed70da8c-6628-4bd2-939b-8068ecca98cd", "value": "assailant.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec2702f-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777464154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464154, "uuid": "3ebbfaf2-d49f-4034-a8d0-22643c0fff5b", "comment": "Malware payload", "value": "ae05f0057cbc391e67bfeb44a6245dcb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464154, "uuid": "1e3a761a-9a6a-4c17-b92b-320af58f11be", "comment": "Malware payload", "value": "35cca86aa02fff89cd4c97066e948522bc3a1934ed0ca53b7a7924528fe21a3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464154, "uuid": "09ed2875-279c-4911-beb2-b8581a5c8e48", "comment": "Malware payload", "value": "eebd9002e23f5ba7c3caba5c0c6bd019077426b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464154, "uuid": "1d94badb-9cc7-4c70-a7fd-d3dae9acdff3", "comment": "Malware payload", "value": "6206c4bfe76713233ddb93678a8294273418ecde4c0c5728935c52e53e725e7a4d5d1dfbfb30e297f5b995963c4a2204", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464154, "uuid": "683a1f12-6069-4007-a391-90c41e491da6", "value": "T1804123957C63F1B9FA688039DF49A259521B2C27C529CC1DB80DB914FF6D098B074215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464154, "uuid": "0540aba5-d13c-4ebd-9262-68a09fbbfbf7", "value": "48:I+ThWE+hW5EhWXrXrc/HPtzisRt857l0XtSXfXUQ7KtY:I1EfPbYK50XoXfXUQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464154, "uuid": "e755e4e6-1cf4-4dce-974b-d84ee51e7bec", "value": 1949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464154, "uuid": "7c76ca73-b737-470c-bc6d-2228e4697563", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464154, "uuid": "c51cf311-96fe-46ab-82f4-02a98bb19144", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df442a16-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440345, "uuid": "4ec8dfab-e0b5-4e9f-b38d-91eea4fe5c11", "comment": "Malware payload (Mirai)", "value": "70f3b78469a79f4fc7d116038b59dfe8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440345, "uuid": "ec4d1124-f5bc-49a1-af09-9ef12c09f49d", "comment": "Malware payload (Mirai)", "value": "3649aeee860f779759bbfe1ba6453ae32d82224fed6deb49b9e0b31d9e7f6c00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440345, "uuid": "87b2252a-cd70-4adf-83d0-05c5f698748c", "comment": "Malware payload (Mirai)", "value": "9fcef5b72a6c86aa0986de32c646f451a73ed0a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440345, "uuid": "8f3439c4-3301-43e7-b8d3-fec52b25373a", "comment": "Malware payload (Mirai)", "value": "df493f0410e520e9bbd00096bf7a621b0f604b57be31273d914ebf7f0a0856e39fa50d2b126beb5cd62b7018ff3ffad4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440345, "uuid": "a275b370-e330-4ace-a7a9-aa10f583d73f", "value": "T1DBA32863CC262F18D668D5B5B0B19F796BA39920818B1FBF1677C6744083D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440345, "uuid": "79e3d0e7-cc10-454f-ab06-27aeed40e19c", "value": "1536:rW5ihIo2bCSjKdPaQ7NXAaLAqB8t2bW7s3Liljxf9y:2MX2b1GdbOaLAj4bWo3LO9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440345, "uuid": "858b43f3-15a1-4991-8505-28b2809456c1", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440345, "uuid": "7592fadb-352d-462d-97d8-c7302aa6d735", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440345, "uuid": "13caab33-fb69-4e43-9c60-9c97d287875e", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f1799d-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495276, "uuid": "df07b68c-a4db-4d2f-8008-492a5a8814e2", "comment": "Malware payload (Mirai)", "value": "8afe93477b0c821ee9deffe78ab48fcc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495276, "uuid": "14a84092-a1cc-4a3f-802b-097cc79f557b", "comment": "Malware payload (Mirai)", "value": "36b64e22aa96245f307200dac7d4196e5b68bb54951a158e550dbd23e72af459", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495276, "uuid": "2d999595-985a-43da-84c0-4112960949ae", "comment": "Malware payload (Mirai)", "value": "1d736fb85392c83f21050c03dcbae1cb44e4b223", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495276, "uuid": "c7ff2230-49ff-4263-894d-cd9289f7a6a5", "comment": "Malware payload (Mirai)", "value": "295834de37ac42584f90baf87b967514c0620b7ee267db5d7b132ab3990f28314a9f2276b1ef0e18ed9de0c31f9ef376", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495276, "uuid": "3df4d058-c066-4c88-abb4-cd49d0fcb168", "value": "T178932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495276, "uuid": "077c0d96-563f-4f46-a8ce-64337e87fc8f", "value": "1536:NJaUfdQD/bb2sZcmI3eQYmUi3100x7u/o1rOgLMRsrI:NJNYn22bIL6kp4g42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495276, "uuid": "62f681c0-a2d0-49af-a091-14aa98548373", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495276, "uuid": "e99c5a10-adad-4de3-b803-fe1d21e13338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495276, "uuid": "6401a681-64af-4f5a-81dc-7bab02e4ef04", "value": "night.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5435747f-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455573, "uuid": "b6939dbb-b9e4-4a89-a0ba-6cd0b8c89185", "comment": "Malware payload", "value": "80deb71073c76eef8b1875ff20ad3598", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455573, "uuid": "5414e6be-c693-4e3d-8521-9b630d9a9663", "comment": "Malware payload", "value": "37dce0816a23129140d583261ba7347908f7a06eb293411dbf41fe1bff166ce3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455573, "uuid": "50fdf571-18b7-48bf-8ba4-cae1a27d4ea4", "comment": "Malware payload", "value": "cc4ce32c9fc6435c14d3332e17483a4a412b6bb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455573, "uuid": "3bebe10e-7ec0-4c8d-a970-689a4ce41c80", "comment": "Malware payload", "value": "4ce9b8eebccb461514d0c4d4a5e6eb0a514529f956b7ac57d631b5a41118124f7305f16f52ab8206ac4b45e165712102", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455573, "uuid": "d6b3cadd-f887-4730-b117-bd9ea2f43ccb", "value": "T14137230C9E8DDD9F6FDCB3EF0426791FCE5B8D44804668D742E16E9E8B6E94638D0818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455573, "uuid": "89e6510a-a6a6-4bc2-8070-5e50a03d3e9a", "value": "49152:zZ/ntyZ/ntkZ/ntPZ/nttZ/ntlZ/ntiZ/nt2Z/ntHZ/ntiZ/ntWZ/ntUZ/ntIZ/5:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455573, "uuid": "54f08e5d-ec6b-4ddf-b6af-28c50a2bd1ea", "value": 22643814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455573, "uuid": "d9a1ac08-6dee-4d01-8f20-c375e7aa36c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455573, "uuid": "3f49f405-6cea-41d9-add5-14e6f02fd197", "value": "invoice-1645080830.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0f2115-4422-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777505145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505145, "uuid": "a43a9f69-1e09-444c-a45f-4d4acbc6b9b9", "comment": "Malware payload", "value": "647914f7f4be60a0e32edfc0fe8caf99", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505145, "uuid": "f35b1aba-dfb6-4a60-8a9c-589e47a68e28", "comment": "Malware payload", "value": "383c74fc0e6a51527243f3f12a6feea6cb3cf3bb701d7193b4352ad1d2431dff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505145, "uuid": "35462f43-a3a9-46eb-87d7-342b2fe1b252", "comment": "Malware payload", "value": "e65eff43bc37be9f01c0cb1a43d796a036ae3602", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777505145, "uuid": "bc5e19f9-15ff-493f-afdc-fbb30b441ed2", "comment": "Malware payload", "value": "962a99aa6db8c5765825074ab56c4c0bdce89659c4d6a199aec922a5f003a79a13cc97e13e6232358cf0cd8dc2048d12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505145, "uuid": "6797d27c-2ff8-4671-9a22-d815b4b5908f", "value": "T1087501D796D93FAAC061543A586214E3DA33AC13533639339194E53FC9231A1A62BF3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505145, "uuid": "360946d5-d1d3-4506-8bc6-c8bcfcaa1a67", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505145, "uuid": "fef77116-da71-412c-967a-b4ddfbfce3fe", "value": "49152:vj6HHHHHHKgOxdEjHSTcpZoo2itjjzm9iomJ02NZ6:ZdEPzzmKJ02P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777505145, "uuid": "215c68d4-04b0-40a2-b2c3-0f651eb2307c", "value": 1681600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777505145, "uuid": "183a39c4-4e78-47cc-82c0-3f5d81bf67b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777505145, "uuid": "e9eb8d5e-5a94-4f08-98e2-37ea984ac7e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d829f4-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455445, "uuid": "89fc2d26-2f2d-49af-bcf4-39d58b276fd5", "comment": "Malware payload", "value": "a50e8737dbfdcaa1b9bb713963e8b987", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455445, "uuid": "258d1619-086b-4d22-87c0-517343696f47", "comment": "Malware payload", "value": "3841498482599bb8ae58f3fa09304c3cbee61f981e9ea32abf47618c99585e1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455445, "uuid": "3220549b-403a-4b83-a434-0f32a99839f0", "comment": "Malware payload", "value": "23dae0dc6fa3b91e88c6f8eeaa1408d600aba6ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455445, "uuid": "4c8a9114-e10a-42e8-935e-5944491bcff9", "comment": "Malware payload", "value": "ab66eb159003166eff482890eae684f5e4b911a200e2789f003737569bb526fc6bbace5618b0bb5bc7f837f3dea23be2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455445, "uuid": "8be56526-0544-440b-8002-5f58299d89d9", "value": "T19B3723018FBBAE1D82C875AC447E1F0D5BFE0B4693126BD1E4F59BB80C4CE9271A659C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455445, "uuid": "2d018ea0-a527-4640-829e-560c7c1ac1fd", "value": "49152:JkJa/kJavkJaUkJaZkJa7kJaJkJaNkJaSkJaCkJa/kJaokJarA3kJazkJaUkJaMk:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455445, "uuid": "17bb18b2-19eb-4fbc-8569-940fc3428b6f", "value": 23684324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455445, "uuid": "a8147f71-5ba1-4ff6-b99f-668c73d58831", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455445, "uuid": "2a9e92d8-1974-40a6-bf28-8ff9aa533ef4", "value": "invoice-1645080830.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de55ddb-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470595, "uuid": "20bff93b-2827-4930-88ed-025d8df21151", "comment": "Malware payload (Mirai)", "value": "1a57b21c7eb11d4c9b7278704ec6bf62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470595, "uuid": "08c14017-bb1f-4418-b243-610339955652", "comment": "Malware payload (Mirai)", "value": "3b1bdebfc409d962e90f6c073dedde892f40d73d4dbb7f2723da3ea99b35e889", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470595, "uuid": "502fc72e-928e-46f0-aafb-1f8e3006d31e", "comment": "Malware payload (Mirai)", "value": "1bc0d745ff4192f5640e909dbb43a587c21ce997", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470595, "uuid": "f4fe0f5f-5300-496f-a447-454339bf5bb3", "comment": "Malware payload (Mirai)", "value": "887693b485ebc1bbd5436b4e5b4c1030ca20750c0c77c0add77b4a21cdfba51899ea1265d45ca373318a888266572dad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470595, "uuid": "6b97450a-06c0-449f-8d5c-0c2bf145c250", "value": "T13B730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470595, "uuid": "e168a584-2869-4414-9ff0-431a43266611", "value": "1536:RcK8MffyU5RL+r9RS3TlUgf/wSBO7kVgu3Urpbr5ag1416mEv6+84:RcHCfyU5MuTlUgnw/Ygu3Spbr4q4HD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470595, "uuid": "61e7aee2-4cf2-4b5d-9d76-433ba39544af", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470595, "uuid": "cf6a0744-58ec-4b69-a304-b2e21c2572bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470595, "uuid": "bb61dfc9-2011-417e-93a6-35a1a823d114", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a0c1a1-43b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777459220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459220, "uuid": "8be6a691-b26f-4741-8bf5-84240fefadd2", "comment": "Malware payload", "value": "b1a512ed7eeede9eb4a6b71f39bc82ab", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459220, "uuid": "356f50bd-1a42-474a-b450-f14cb645fb2a", "comment": "Malware payload", "value": "3b9bbec828c3c3bde9f909fd785953629a88de4bbdcf338fa9ed92973ca212df", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459220, "uuid": "2968cb2c-9df0-40bf-9dd4-6cd5c6b6f288", "comment": "Malware payload", "value": "79efa37ba110ab3286c9312bd957438359b062dd", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459220, "uuid": "bb4f2689-f6de-4f67-a766-59a08f115f89", "comment": "Malware payload", "value": "093b24cf3949da92042f75ebc65ebc5a1007b73a3a9a5b95c34259bce5cc5be4c2f949cea6b7eb302c6951b52327031d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459220, "uuid": "32fcee66-8630-4983-a271-6c2c447435b7", "value": "T1DF055B4B72D558BCE156C038931B9673AA72B88A0631BDBF32EC96302F57D521F2C719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459220, "uuid": "0e52317c-309d-4a81-893f-2e03c509039c", "value": "12288:dunfu5RQ4px5/iQdRxIqCHlCLjJHWVxZ4pxXfiQa47IXb2DO:dSfu44pxRxxSQLN2J4pxPZ7vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777459220, "uuid": "e0ca364f-d7a9-4a16-843a-d27e4b5cf906", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777459220, "uuid": "a62b3689-8e35-46b5-96f3-a8369e6be6be", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459220, "uuid": "022a1d76-dead-45ac-9c2b-4d3f36c2568d", "value": "documents.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44664e9a-4425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777506227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506227, "uuid": "01ad627d-8512-4a05-b701-450b51638ef9", "comment": "Malware payload", "value": "0df380f1aca3cb39c15449daded626f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506227, "uuid": "6439cfcf-c5f3-4b02-865e-3700bf653935", "comment": "Malware payload", "value": "3beec65f4f03a91cb14ca5ecf609042152a4c0e0435335c589d8caec2285ab0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506227, "uuid": "c6350e8f-9b4e-4dba-b6e3-3034a97f65db", "comment": "Malware payload", "value": "c9a248efc7c5fb0821b555b7c23fd4d784137a19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506227, "uuid": "86c239fe-96b7-47ea-9ef7-b8410a79cff5", "comment": "Malware payload", "value": "fe45b53cf7db2482aebfc81af88c2f050996fd66c24255d198463a1840670e0fcc95eefe01058d15c42c399e253ac3c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506227, "uuid": "b2f01adf-313b-4901-9219-55a4ec219d9f", "value": "T1DE361A137F28E70EC66C213458B2CE9467395C9A86DAA517B381F70DB4B10AD49AFCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506227, "uuid": "5f65a9c0-028f-496a-a006-a587cc85eba4", "value": "49152:i2citAS1VFDIrKZ9PfFo6ch1r+ZlPHpoeYxUxeFw+FdbKOn/jzwXkkLD/Jwdh/SW:VgDaUXJOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777506227, "uuid": "72ed6b7c-de41-4c44-88db-d2f894a4fa7f", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777506227, "uuid": "522a0dfa-4ed7-4062-97d0-cd94ad51513c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506227, "uuid": "cb0006a3-7d95-4e4c-894a-6115ee0a7ba0", "value": "SecuriteInfo.com.Linux.Siggen.12195.22717.28312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65727a24-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442288, "uuid": "986bbd23-7369-4cfe-b110-e4e916929e2a", "comment": "Malware payload (Mirai)", "value": "9da6ed832d9d4b146e4a652f18e082c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442288, "uuid": "b6046c65-5fe2-4d49-9c7f-d0dc8d0994aa", "comment": "Malware payload (Mirai)", "value": "3c59688a65b1e3f14a446298a486f3a81f3f6bfcb6dc75cc5cc89903e48cde2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442288, "uuid": "0830270b-13a2-4f08-8377-38e05a788c1c", "comment": "Malware payload (Mirai)", "value": "d94624a81dbcd267efb50899643ac987d4e23e70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442288, "uuid": "c9364e0e-c60a-4345-96dd-1c66f4b82800", "comment": "Malware payload (Mirai)", "value": "92ba30f2c6d558e26b480043362b1547b72b8c21006a597529851be81d819d536f731357247040e52f52285342abadcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442288, "uuid": "c97185bb-c3d3-4256-9718-9337e7b72ab0", "value": "T19E630996F8818E25C5D5027EF92D128E371227E9E3DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442288, "uuid": "2c354b9b-7e18-480f-97e9-93212da2c921", "value": "1536:Ctngu4+pOxw0qGKKmI0zC0qbOl9t1jkScDICiL7+X06Tc:6LpewIKZTuG7+X06Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442288, "uuid": "3e5231cc-e86d-4b4b-8936-b0ee9f8cdf0b", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442288, "uuid": "0987ebf8-4157-4475-917b-351c7c521760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442288, "uuid": "54073a80-83b9-4097-8a86-4e232bf227c5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4186a5c5-43fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777489472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489472, "uuid": "a31c748e-3667-4539-826a-b3b4e59b2d4f", "comment": "Malware payload", "value": "a212d32837e43650444a8cd526a2aef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489472, "uuid": "46ef02f0-702f-4935-aca2-3623f195d4a0", "comment": "Malware payload", "value": "3ca9b4e831762d0289ccbf076601e22538e9527c03d9ac3fde4fe3a714e82123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489472, "uuid": "14e30199-3499-4bd3-a350-57d2cb8c7d9c", "comment": "Malware payload", "value": "08c7104bb45341e30c4b000ef6037c39ebe311d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489472, "uuid": "f180aaca-44d2-41b5-b5e4-20450b178e5e", "comment": "Malware payload", "value": "4b3e214ca1b2d17e429e25ce3a576d8e073d329c13b869fe849633a3ad43969692b2843e0598f2f6ed552499ce10cea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489472, "uuid": "5019fd9f-d000-4d9e-933a-180da300a9a1", "value": "T10D076A4278D500EDC09EB63289F276957B34BC580B3627C31E95AA783E73BD11C76B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489472, "uuid": "204c12ab-8eb6-4182-8120-223c7f00ba48", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489472, "uuid": "b8490e33-98e5-4881-b4be-9dc35c9a63ef", "value": "49152:5NH7UQA6K70CLQlEGN3TtQaT5iu4n0WbiOxWjx5shF3zWY:5NbNHyLQlXTtQ87W8j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777489472, "uuid": "743bcab2-3332-451c-996b-3c522f70888c", "value": 17311952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777489472, "uuid": "688ae07d-e827-4c44-8330-1caf08c11c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489472, "uuid": "7c64ecdd-feea-4dc9-8da8-6234b3cc16b5", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4057f3-43f1-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777484145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484145, "uuid": "31ab39af-5ce1-46a6-b4a8-50bfaa0cb22a", "comment": "Malware payload (ConnectWise)", "value": "7e184321ff47f6f0a26e9a0f031b1a80", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484145, "uuid": "660d03f9-be3f-4704-a6f7-0ccf52177e9c", "comment": "Malware payload (ConnectWise)", "value": "3cc948ec407ee63bd7d884497958a5f854d444b6937b6dd4cef3c06498c00ef4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484145, "uuid": "13ca61ac-3ab3-4776-b967-1a386400b43a", "comment": "Malware payload (ConnectWise)", "value": "ec40c69286b925e5ee3f80b91e70771cc9ff4816", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484145, "uuid": "e1e1ee7e-5058-4d4a-bf63-0565bb12fd97", "comment": "Malware payload (ConnectWise)", "value": "0820755d46808d9716e96a7a2c5d83f7f48baf49df2fa782359f2ca633d14d256dc029dbf218d6e5dc01f4c5579690cb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484145, "uuid": "1e815632-1498-4623-93c4-d700e00932ac", "value": "T14856F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC04E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484145, "uuid": "cd909e2f-7151-4eae-83c2-b2afddafd54f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484145, "uuid": "42c354d6-899b-462c-bce3-8b21c96c7b2e", "value": "98304:szIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:shfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484145, "uuid": "74f9e088-5103-4835-b19f-3ef1a1fad495", "value": 5966488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484145, "uuid": "50384716-18c7-44c2-be7b-f24766608f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484145, "uuid": "ab074768-b4c7-443f-9574-a41a7346a7a7", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d06639-43d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777471581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471581, "uuid": "58e99fc3-a3ec-49e9-a4ee-ecab8d73f771", "comment": "Malware payload", "value": "4f22e9cc2402aa897c9cc1e163f901ce", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471581, "uuid": "dba4d086-68bb-4bd5-bead-4a1b3d28b73a", "comment": "Malware payload", "value": "3cfa3349985ae9e2eb23ecbd406a3d5613aa428905c950a64e1b44981526d8a0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471581, "uuid": "087fd1c4-ce65-471c-8653-93fa32748c77", "comment": "Malware payload", "value": "ad0fde6d890541d8a9471fa88973fb5de6b50a71", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471581, "uuid": "ed23c059-7298-4ab1-9f46-8af1d0787f96", "comment": "Malware payload", "value": "4c2337e264d0bc0a52a9463e9e0ed2ffe73a0ba709d97bd17e5e746675f4ceafa786d8b6d1e20a5baa43011970da08d6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471581, "uuid": "1f03eb5f-dce4-455b-81c7-8e2f405e9a19", "value": "T123F02B523FC80154F5B39D75C87A5B055E16F98599B6C10946913ECC9C70704FE32B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471581, "uuid": "bf66ebae-f080-48e2-a7c4-ca2702dfb397", "value": "12:8eMU8W5Y3djElZoabpMiUseiGYlW9dEP4U8+UcqJ:8edHqZMW2ptpZ3An+/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471581, "uuid": "c5f24681-0dd5-4bbe-ad96-d1a03225c40f", "value": 535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471581, "uuid": "d1e0905a-4db1-4f8d-98b4-3969fed74d68", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471581, "uuid": "155aedf1-3bdb-4c37-8cdf-41cde4d59c0c", "value": "Rakhunok_RF-2847.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5e5c1a-4361-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777422011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422011, "uuid": "7026dfd2-bfe5-4603-9ab3-7ebf8bc5acd2", "comment": "Malware payload (RustyStealer)", "value": "137eebd45a9ba6d0fb5c3032e5bf8c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422011, "uuid": "c52dbffd-8941-4e38-ab1f-7a14f83bf663", "comment": "Malware payload (RustyStealer)", "value": "3d363a20a952114c7bd36c07df650331da1afcc01a41c86baed1b06dcca04f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422011, "uuid": "1c4b7861-a922-498e-b477-356b02b2ab7b", "comment": "Malware payload (RustyStealer)", "value": "0b5c3cd0dbb552bf741c56b0bff3454d3aad8d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422011, "uuid": "b6fd6f8c-bdb1-44e9-8ff3-a5274e581076", "comment": "Malware payload (RustyStealer)", "value": "1587a464afa415c2d30bea3d7dcd820455d54e0373457fabc385d6c5b0eebd47b9dea3b68ddcf29ba95f264adf55bd4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422011, "uuid": "b83b832f-7c44-4ffe-95b7-debffa3db34a", "value": "T181A47C07BA9990BCD559C07883569633B636B88A0330BAFF03E49A303E55FE56B3D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422011, "uuid": "8749d0b9-a951-4080-80b5-45bd0a29b0b8", "value": "187d06fcb051f46053b6d25c72db12ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422011, "uuid": "d2d65dcf-fe39-4a22-9b2c-f587b2ea0f64", "value": "6144:Q1098PEadsn96YfkTYNmnG2AWqHqbsKOhExANd2kQYbzFU8B6myBBW:K6TgsnQYIt96HqbsJC+NY6pV6m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777422011, "uuid": "e1384c1f-1f49-4758-9d48-4c1ebb9d0748", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777422011, "uuid": "8bc397ed-c1d2-424c-b0a8-3a5939ec1483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422011, "uuid": "cfc1ab97-b66f-4ed3-8939-b500d7ce50e3", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u6cd5\u4e71\u7eaa\u4eba\u5458\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eace01-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777479658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479658, "uuid": "a3cd4216-b50d-459c-9a2e-930811f6d729", "comment": "Malware payload (Amadey)", "value": "b10b43ed33a8f3f8a623aba443263638", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479658, "uuid": "b8f95609-15a3-4524-ab48-35d1f8a2403c", "comment": "Malware payload (Amadey)", "value": "3d966faf6abea9dc401515b863887466f6f5913b0c27e1d79d7bebc994efb16e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479658, "uuid": "84174118-ddaa-4bf2-af68-8fdc4e607bb8", "comment": "Malware payload (Amadey)", "value": "99464f092e1f1ea3337391212b5468dd77390a42", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479658, "uuid": "22ae7a88-049c-403f-b07c-d6e7ac5068dc", "comment": "Malware payload (Amadey)", "value": "ffd64fb506ed757a7ee6ce0eaea45d176885856d238893bc27ecfe05e7fdada3637e0a8a1d41cff9fd941f75e1e88ceb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479658, "uuid": "18730338-4ebf-4085-b10f-16984b753baa", "value": "T143557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479658, "uuid": "9f5aa599-1bff-466f-a4b4-0ea06e809fac", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479658, "uuid": "2fe4331d-0b55-4c7b-a022-d02a7edbfa69", "value": "24576:FrR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRSlOnW:FkHmiyCkhh2Bamituw+UAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479658, "uuid": "57a3d18c-c258-4747-b826-940b5f79c255", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479658, "uuid": "a294c8d1-1123-4738-b833-2263d9ee72a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479658, "uuid": "eb763c00-032c-4a55-8c30-47bb094a6274", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02ef11e-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495268, "uuid": "91f36aec-804e-4e9f-a0fd-7524277a24e8", "comment": "Malware payload (Mirai)", "value": "45d1cbb35c62d74ac3fdf311f358ae10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495268, "uuid": "02bf0b8f-af2b-4410-b99a-9940d24bb5ef", "comment": "Malware payload (Mirai)", "value": "3dc9229689a77cb1e1970a3f83682c43528188b5ffe76c875dc029efcc33fb99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495268, "uuid": "4ce47457-6b99-4899-96a2-ab8a3b5f5f46", "comment": "Malware payload (Mirai)", "value": "d1fd6c08b74a0779ee4ccbc07de9cebb76e01a59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495268, "uuid": "001ed6a6-daa9-479e-8cb8-fd6f67415079", "comment": "Malware payload (Mirai)", "value": "6e36f6f47aa3f3589d75484cc4aead8fd03a4253e2e945b0ac7c4c43f20dac908b4d3adc3294b1a04a9b235d22ced997", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495268, "uuid": "2159c2a8-3d87-4f69-8bc0-bc5a3eaa92b1", "value": "T1B7B30946A9829F11D5C631FAFBAF414933136FB8E3FA7111D9205F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495268, "uuid": "13ec8584-2851-4a8c-976a-4fcc6dd44064", "value": "3072:pqiy9qVvpOFnQfG/7/0NZYjYhOn1NaVF7h1ubWczgflZI04MbvPsf:pqiJKdQe/7/0NZYjWK1NaVF7h1Hczgkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495268, "uuid": "ed2a18c9-077e-4eb2-ad5a-17fd1560ecba", "value": 112656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495268, "uuid": "31bdf3ec-2c8f-43e5-8b78-d45bbbff0fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495268, "uuid": "12bd18ee-8ea0-4b97-9a54-82fe2c7b4c63", "value": "night.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676876df-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777448733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448733, "uuid": "29af2568-594c-4412-888e-dce406ecd107", "comment": "Malware payload (DCRat)", "value": "18a992fd2837f440c277d9c8830e9b9f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448733, "uuid": "632b1a00-a55b-440e-aeb5-3c2d93e692e3", "comment": "Malware payload (DCRat)", "value": "3e4552c5cf58e0f6b66d1504465a9895f42bf54a1b82cbe91a479971469ec2dc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448733, "uuid": "57b0a857-b865-4969-b5db-04bb934eabe3", "comment": "Malware payload (DCRat)", "value": "80fc312afd7e3998e08f7b2f39d3d01d1faee93f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448733, "uuid": "5e382cb7-f238-455b-ba54-b68cbf4a36f4", "comment": "Malware payload (DCRat)", "value": "bde131b458993907a4704b977b5fecbc0a796b9cb85a33240430a346b311658b488ed7884c2c39b25f34d9c764a3a320", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448733, "uuid": "f82471e1-69f9-4997-9b56-8024bac3df6a", "value": "T1A8654A017A49CD62C058033BE5FF58A453B8AC427A62DB9D7D9F376EE4093B21D096CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448733, "uuid": "7a9fab23-6548-49da-9711-4f6102a9ac0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448733, "uuid": "a8493899-3291-4130-b67b-9814d3969bf3", "value": "24576:EnhmbDXSzgF9YUdGG7SHOktAsyZBqAMP+4f:J9fpSFer6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448733, "uuid": "6d947d1e-c3ef-42ea-a49a-518efb3489fc", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448733, "uuid": "bb8db42d-9300-4c28-b4a9-a1f99b0ca30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448733, "uuid": "823ff067-7656-4324-98f2-3a6e49cb8b03", "value": "18a992fd2837f440c277d9c8830e9b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44606ae3-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470579, "uuid": "f7949d15-e832-4c7d-8032-5e8ed4480669", "comment": "Malware payload (Mirai)", "value": "96c717b57203e717ddc5cbaa0152f73a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470579, "uuid": "2406cddb-be57-4bd1-80b0-4ec8c2d60ccb", "comment": "Malware payload (Mirai)", "value": "3f96ccc753199361e57f0036fb1a19a868bad7f4bd41c5a2b148be73a69e049f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470579, "uuid": "2350eacb-fd48-4a27-b13d-073da0b043a0", "comment": "Malware payload (Mirai)", "value": "3e827f4feb63f1c4bcf6e2cd7bdb937a3f770c85", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470579, "uuid": "106f16a2-20e2-4412-b502-fe8014646641", "comment": "Malware payload (Mirai)", "value": "fd93dae4dba0a2c1f3fa05e4d24c208212e964107401e778e3b4f5282f36e972c7e9f1a88b972648b874735fb5ba56dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470579, "uuid": "905d817e-26ef-4859-af1e-74e746e3f070", "value": "T11393E842BD429F13C1C621F7FBAF059D3B166B79D6EB3202D921BF9023868DB0D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470579, "uuid": "ff0facd9-df39-44d4-8668-b498d30d1e63", "value": "1536:IV4F+8wMvh/zTjmCon3rqMGbUCiqeivkQGvu8DgYcwdxMUBADRa:IVSUujmCon3rql4dgk7vu8/MfRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470579, "uuid": "2f4d084e-d4e5-4bc4-a226-899d2bee0f2b", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470579, "uuid": "94a36ae3-f378-4457-acf1-61e1829004fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470579, "uuid": "ad7c0689-30a8-4aa4-b283-fdcea3814c90", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949f7c17-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440649, "uuid": "c5ce4c4a-1856-45a6-84c5-b68447b47067", "comment": "Malware payload (Mirai)", "value": "9a67e82fdf79c08d1115b81112ee3a0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440649, "uuid": "ba2f900e-a67c-47a0-91d5-add42474c0b3", "comment": "Malware payload (Mirai)", "value": "4071f983a73707c1d898cae21f6f93b90aa3af6f69e1b24316028375228ccabf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440649, "uuid": "7bbad156-c37e-4351-9203-f6ce4b70c711", "comment": "Malware payload (Mirai)", "value": "0a1b41abaa50a5c18bd712e04e0ecb7831eed4c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440649, "uuid": "dc1f922f-355f-4249-bdc8-f06a50e7fff9", "comment": "Malware payload (Mirai)", "value": "59cec7f5aaea6ba918828aed74840317b0a681781e0069155a22fadf7e16412e55052cc85c698ebddfa2864a5ab990c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440649, "uuid": "167e89b1-ce86-4ed2-9dbe-d6f335e0861c", "value": "T14603F1D11361178C8362EB79387E701EC538122B32D61E002E97E64EE64A725987BEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440649, "uuid": "42cc618f-97f3-41c6-b408-0c6dd9136695", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTO:87vbq1lGAXSEYQjbChaAU2yU23MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440649, "uuid": "2df73c49-1798-4373-ba02-25dcc120343e", "value": 40138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440649, "uuid": "3cb0b859-3390-4540-8f65-9b2db8ff6088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440649, "uuid": "2efb595a-bd69-4ef9-8dc8-de30dd491e7a", "value": "mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c23d1a-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455353, "uuid": "7963b41a-081a-4f78-8d11-a117ee000fbd", "comment": "Malware payload", "value": "5048ff0e88c06097811f0782fce17c78", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455353, "uuid": "1159e521-7b00-4700-a405-97650394268c", "comment": "Malware payload", "value": "40a04cb96cf4b9abfa070f12b16597056afdf760a219e75dc6d9a4a2dc6e877d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455353, "uuid": "27f74120-684e-4774-8c56-43239d491ccd", "comment": "Malware payload", "value": "659b3d5dc341abe87a1f572e0227fd6c65149de6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455353, "uuid": "fcd1a0a5-8639-4a9d-9b3a-408cf6565172", "comment": "Malware payload", "value": "403ee6ad1f3544dc459fd76c3ad6a63ac159367b6ec4c3a68be2a5c35414dc5f2afa14f7ba5d87b60ceba70a760494a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455353, "uuid": "5f27ed57-7b6a-46ca-bdb4-954562af090e", "value": "T19B3723178DBC983F066C3A6C20B7074A9D9A5F5414A0DC367BF2D85BD49EF0090DB9BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455353, "uuid": "4b5b8d65-ff41-44a1-9966-d689c2226178", "value": "49152:WuZkuZxuZzuZtuZ0uZSuZjuZ0uZxuZZuZOuZWmeuZKuZAuZxuZpuZfmXuZfuZqu6:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455353, "uuid": "3e38079b-f0a5-4b9f-93d6-b6e957450245", "value": 23944481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455353, "uuid": "d008962d-50fb-426b-9447-1aa623e09c5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455353, "uuid": "621b0553-b0ad-47f7-b796-5742dcb29e8b", "value": "invoice-1645080830.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c8befc-4395-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777444650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444650, "uuid": "1012a222-2702-4609-a314-94e9f4b70af9", "comment": "Malware payload (Mirai)", "value": "ab3c4d0599dfc41c772736ce8532c2e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444650, "uuid": "85d40521-d5b5-439b-b36b-435e4f44df45", "comment": "Malware payload (Mirai)", "value": "40faf6bcec2708d4943bd199843fa36beb4f6f89cf6a81016a5c0ec504637919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444650, "uuid": "b8b1f289-7fb7-489e-a3c3-de985c1d1ff3", "comment": "Malware payload (Mirai)", "value": "15237214cfb096ab4e1e6695d7f7c3b25caccd22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444650, "uuid": "a51d60d0-4fda-4848-bc7a-de59975a759e", "comment": "Malware payload (Mirai)", "value": "04bcec3ac41b87c0dd653d243b1a5da1b74e2fec220af148f4503ad3e097d8f22e6f59fe038d31d2ffa8aafedfb07391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444650, "uuid": "505e5d89-7aaa-4381-8e68-92a712d0abe3", "value": "T14D23F12DB9666463FBF0017EFD04CA469A4D2679E0A920D074275625598BACBECF4CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444650, "uuid": "5f019d43-bb08-4de6-8d38-79bdb69ba216", "value": "768:flLKFYNFsFBaZyGOLJqgFaXQYVXDr1BM4sll3WD+9q3UEL+cK+3fQy6IIrqemh5F:flLoYNFocZy5yQiDM9WXL+cKIfshhmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444650, "uuid": "acede256-6812-418a-ae54-4cf79d317ad5", "value": 46656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444650, "uuid": "c1d8c71a-056e-4d23-8f27-368e556ca3ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444650, "uuid": "b831e1d9-1258-4fdd-84f1-7c0d1a5c9185", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ea9bae-43c2-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777463741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463741, "uuid": "78204a12-b6ae-4193-bf3e-7d8b90a7d0c9", "comment": "Malware payload (MassLogger)", "value": "6601fb8c753fc181dd7802b6d09d4a64", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463741, "uuid": "4bcc4294-c039-49c3-b40e-8ed327cab4a4", "comment": "Malware payload (MassLogger)", "value": "41603a8a3a5b620ce0c103d68e277b611a4651dc83cf0e34e3a949db71a4a5de", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463741, "uuid": "744bc915-4257-416c-826e-158bc7f96035", "comment": "Malware payload (MassLogger)", "value": "9cdb837ee5d88db23359830d22ce3cd4180eb5ff", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463741, "uuid": "8c1b9933-2147-4522-a2a7-0615bf2ea993", "comment": "Malware payload (MassLogger)", "value": "e698650a08219e23b5efa80a50105e83b85702bf924f8e8106f1b02e3ef2bf6ebe95d6d2d2e4a6ad4786c0e3b492a91e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463741, "uuid": "433eafd7-80cf-4db3-b8b4-c2bdf3acc12e", "value": "T14A4533543E643AF26B68F21EF6F67B3197071EEA980AB9A7955153C34737B04832312C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463741, "uuid": "e0c8546a-6a78-4854-bab4-374376927d20", "value": "24576:yRs9GO9Y8YF7MTfxqYjp3iqMKG5YQRErg93K97bpV41ADArZW2Unj:yR6ocTW6541vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777463741, "uuid": "85631f4b-81ea-449e-b6d4-88a2a2b07fa9", "value": 1216471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777463741, "uuid": "87609ecd-dff6-4ff2-81eb-53d894fcebb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463741, "uuid": "9ab76c9e-a380-446b-9e23-e2e4b10ae82f", "value": "5E2NWZZZ.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0585b3eb-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451576, "uuid": "41146b16-1e4a-47ad-9874-ba80e5d4130e", "comment": "Malware payload (Mirai)", "value": "2145e09b0613165fb092d137827f1ebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451576, "uuid": "f1eabb52-2230-44d5-b647-3a2075e35bbc", "comment": "Malware payload (Mirai)", "value": "41be96a2bb7306deaa3d3068322019dd5d37bc8569f0bfb80b94789131158eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451576, "uuid": "55b0b264-8adc-4eac-afd4-0029368c5449", "comment": "Malware payload (Mirai)", "value": "2c88e38850b8f2abe51b00375fbacc0507d857bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451576, "uuid": "764a42b3-32ef-4ced-a7de-a6b2eb243b2b", "comment": "Malware payload (Mirai)", "value": "b78d6517650ae193428d82ff39c347487c2e35c3c627cc2c227ef8cbb24506d12c2b501864fb0f2a392876736ce690b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451576, "uuid": "ef4d3005-8251-45fa-a5f6-e2b10213c908", "value": "T193F2E1515E226871CFB50C3DFE588B826BD847AC7CDBB272910E8A547967C017F78385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451576, "uuid": "580c8181-b6a6-4510-a06c-e204c9f9cc95", "value": "768:ZLs3WGtESbJ2mFjuDeVm7AKY9exfbU1vjPdcWzd1d1kq9q3UELfK:St7bJXjyOgQ4hb6jPrzdv+fLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451576, "uuid": "a84d2f76-0c5a-4aef-bba5-5e87fe8efd50", "value": 35820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451576, "uuid": "21903bd1-178d-4c6b-8110-3c89fe43f525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451576, "uuid": "4bdc121a-d370-4d6b-b66d-92e1f74ccc38", "value": "asuna.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8852c9f5-43c1-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777463392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463392, "uuid": "18b85db7-f111-4bd2-ba89-390b5ab3a0d3", "comment": "Malware payload (VIPKeylogger)", "value": "8b838c3d22234889a7698a701935f230", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463392, "uuid": "14a8cbf4-08d1-4066-9cc6-2eba81dc7787", "comment": "Malware payload (VIPKeylogger)", "value": "41f2eb06bbc035bfe092eca2556c62bd081380e3fb7b084abc2174db4084e949", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463392, "uuid": "9fecf0b3-e448-47c7-93e8-a1f8c260f35b", "comment": "Malware payload (VIPKeylogger)", "value": "3f8e340e2d1b32aa309ec105c6aa5f3182ae07b9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463392, "uuid": "6aeece7f-4986-4d7e-8601-1ad16837673a", "comment": "Malware payload (VIPKeylogger)", "value": "98425274230f1e704f5d804b23f1c04cf43e71917bdf5a0d973d2f3a3b5f542e809a81170493c6ef0917a80c94d578b1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463392, "uuid": "327fc868-a4b6-4bdb-8c6b-c8298c20861f", "value": "T1559423C16D5F496E4C78F5A710BB0BE4BD50CAD3243DC5BBC7901C2AF249A80A95F6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463392, "uuid": "9d523c6e-3457-44d9-bf7c-be53b1a6c6bd", "value": "12288:535P+m61kCYbjIvtZpyFRw0hsMwEF3voH+rMi:V5GmAkCjVUrWMwivtMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777463392, "uuid": "f06f0976-3def-4960-b1c5-5a9ce9a38932", "value": 414415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777463392, "uuid": "820bee4a-7334-43ff-9bb3-7b5e3606c6ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463392, "uuid": "d7a34c78-c5dc-4f17-9c44-a329c00bf0a8", "value": "SHARP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b64de7c-43eb-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777481436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481436, "uuid": "7216be7e-edac-4edf-8811-d4e12781b02f", "comment": "Malware payload (CountLoader)", "value": "0c521271abb39e07fff998af280fa8fb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7043", "colour": "#46F2CB", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481436, "uuid": "fd38cfc5-ae55-4bed-b181-52a2c7483fd8", "comment": "Malware payload (CountLoader)", "value": "42b429f4be7b62dfc318c0bd3d6b11e03633cba9e9affcb83357d2721b9063fb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7043", "colour": "#46F2CB", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481436, "uuid": "0ddd5d97-4255-4232-b83f-a6de8f737233", "comment": "Malware payload (CountLoader)", "value": "86feaf982bbec2b783726143b5b8ed54eebddadb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7043", "colour": "#46F2CB", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481436, "uuid": "3d2aae75-dacd-4109-8797-449203ee7d05", "comment": "Malware payload (CountLoader)", "value": "01a90a49d269e1968803039e9ae520ea7a7bd361cfaefcaf74cb31a335d35f05a3d0867fd0d26516f71b7fff96d00b84", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7043", "colour": "#46F2CB", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481436, "uuid": "8c65c740-46b5-4d8c-bbc9-de59e2d1f493", "value": "T14F0633244D74B2B28930D294773BB96F93C4EF6BE73207A8B4072D8F213509D66968DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481436, "uuid": "603e2d1c-e2df-4dc7-84a4-f32328dd6e2c", "value": "98304:tAkEe52Hjdfq3fs9tGhY3dNAubU6ybzAlez2coM:t442Hj52fsrGq3XAuQ6y32cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481436, "uuid": "f439901c-8874-495e-b67c-79e7a7e6c947", "value": 3995219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481436, "uuid": "5e8b6014-4b6e-40cb-8e2b-176732ca2aea", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481436, "uuid": "8280b14f-8c27-4f01-9190-d40a6b2ec026", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a41b48f-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490050, "uuid": "490a6c73-04c9-47ba-a3ba-132d1f7600fd", "comment": "Malware payload", "value": "00a89a296922788c81a45e995c1eec32", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490050, "uuid": "a3554eb3-44fb-4461-899b-8fe81cd7ef06", "comment": "Malware payload", "value": "435e20633a6a70f97ba1771dd55abc8041355c5fc2dc29660840098b31fea9a6", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490050, "uuid": "4def5ba1-7898-4212-b344-212758be1cc1", "comment": "Malware payload", "value": "98680d6568d2e3b4501b8c32778f7a62e8cd777f", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490050, "uuid": "b5e6cef7-04c8-4535-a768-5fef2017e0f4", "comment": "Malware payload", "value": "31c774f322e890136436cc52092753c59cb1667e7994feb7aa7f34c227023f19f7a88ea292abf035ed07b0fd9920d09b", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490050, "uuid": "6e1f7953-e282-4e28-8af9-9865b19e2639", "value": "T1AE13B006C304C5D62FDA56C6A436C0C876B9FDBA51C4A5FFE68879802E0AC6DB95E0F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490050, "uuid": "bcfd451c-c08a-4167-8d01-d8dc0d0b304c", "value": "768:uIshbzPgdHmLBJxdWlZ+mdhPL7L0phyMjEOme2ZTF1g2NUylWM1c5hET:ykGLBJxo4hy2EDhZTF1OByc5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490050, "uuid": "256fda7b-36a0-491b-9d06-efa9deeba363", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490050, "uuid": "08baffbb-ed2d-46f1-8364-995e5e34c7a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490050, "uuid": "391f19fa-a633-4758-9466-af0fd08898cf", "value": "uxaza.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ddec0a-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455581, "uuid": "d1ed53d4-aead-4be2-9667-77d24467086c", "comment": "Malware payload", "value": "1f7942e15a66a605155c96c1eafe1071", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455581, "uuid": "180f28b6-5ba5-4a53-b873-60d84a2c7fbd", "comment": "Malware payload", "value": "437f57e25db1ac67cc1234f0d57ed7f1e2c7062aec0eb78c466319bcd07c8ae1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455581, "uuid": "92edb8d3-67a9-4e96-814c-f7c96b6fd016", "comment": "Malware payload", "value": "48f970fb971e710db179b4aac4430bb3ae59dcc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455581, "uuid": "d0ca70a5-ee0c-4495-a407-4fc74659f646", "comment": "Malware payload", "value": "366ccc1cad7f458b229b1a95dc143ab075ef9be5b124e8714600de51c968709cae8ae249f15198a7c85af2b430446747", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455581, "uuid": "27cde623-2cce-4215-93c6-16bfa710cee5", "value": "T10637230A0E9CAD5F027C729D795F2F6D2FF1C6904C18D7A6537128E93019F92A29F4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455581, "uuid": "0bb959b7-84b8-4d34-b954-8efc09355cc5", "value": "49152:EUKvKUKvDUKvSUKvhUKvjUKvZUKvQUKvjUKvUUKv6UKvtUKvVcM8UKvaUKvRUKvX:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455581, "uuid": "787ba43a-e465-4fa9-a7bc-9e46a5cef20d", "value": 22643811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455581, "uuid": "52a65ca9-1269-418b-b3fb-deb2bb4795af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455581, "uuid": "3645a11d-8f22-422c-b78e-c1fa40724a8b", "value": "invoice-1645080830.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b70e4ce-436d-11f1-a769-42010a9c0008", "comment": "Malware payload (WSHRAT)", "timestamp": 1777427238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427238, "uuid": "7424c4cd-ad13-4083-aa41-0c1975dcac45", "comment": "Malware payload (WSHRAT)", "value": "22c894421db6bf3d7d8c3c162f592fc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427238, "uuid": "8830ba1a-2a17-4f37-913c-a47496ddc693", "comment": "Malware payload (WSHRAT)", "value": "43f880867c4e1013297375a022e6238a3fa0773510f777c26db1fee7e139665c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427238, "uuid": "743469df-022f-41e8-9a10-cd8b0c9ea161", "comment": "Malware payload (WSHRAT)", "value": "2cd924d033ccf3bb8c32d02f69135faee9b9096f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427238, "uuid": "12bd2689-5fc4-490a-8aab-b5d44e2c3348", "comment": "Malware payload (WSHRAT)", "value": "f1e516bcd1a6c261e79b8a40c2fb3a1836d85bef8b35dcc1dd65c57694562b75d75557257c61cbe9eaa5205896f9b36a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427238, "uuid": "a3f878b6-66e1-41e1-a453-fdd9c13689ed", "value": "T1B7F43387D536052D3DE872DFD6B86E0E2430AA81D504D37ABC7C73DBE2BC155A240BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427238, "uuid": "36105b16-cf72-4968-bece-89234c6abd5e", "value": "12288:GOmMdaDXBuOdAAxcbaDpAdIkLaDhlLBO0Xzaj1B+UquKbLZaQlx+2CRQlD+EhajN:GOmMdaDXBuOdAAxcbaDpAdIkLaDhlLBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777427238, "uuid": "6d833c31-a48a-4a7f-b30c-2f99f9e99486", "value": 728998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777427238, "uuid": "f6a883f0-1025-4af3-99e0-8deed836e069", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427238, "uuid": "6abb1dec-a328-4596-91db-eaa35aad21d2", "value": "Mullvad.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a81c8e4-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494990, "uuid": "98c4f1ee-998b-4a7d-8d76-9e43255a1c27", "comment": "Malware payload (Mirai)", "value": "301c3b3188e2e770df4c2b306bc0acce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494990, "uuid": "992af334-50e7-41ab-8ca0-8cd8295719c3", "comment": "Malware payload (Mirai)", "value": "446e804b1047faf225ad68a8800a3b5d4458d510d1128a9490593aacfdf7806f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494990, "uuid": "4647f340-92e5-493f-97f8-7ba7d00e4268", "comment": "Malware payload (Mirai)", "value": "c1f288e8a0bae8fb56a32c39e9bd7b4e8f56ec9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494990, "uuid": "f691f514-ca9b-4003-b53a-d8624d25fcc8", "comment": "Malware payload (Mirai)", "value": "67abea4a0f00dea884f7ef2624e14bc90a4bf724c1d09fcb35e97d03d10078177edf1e85c1e5254f4fa0a2998efd7951", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494990, "uuid": "8f786259-c684-417f-8cd6-db26919cebe9", "value": "T116730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494990, "uuid": "014acbea-6f69-477e-b025-883044db8036", "value": "1536:RcK8MffyU5RL+r9RS3TlUQf/wXBOSkVgu3Urpbr5ag1416mEv6+8R:RcHCfyU5MuTlUQnwpYgu3Spbr4q4HDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494990, "uuid": "f511d37a-1870-418c-9921-02a6a3c48a67", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494990, "uuid": "fa969809-5786-4cee-b4f0-a69bf742befb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494990, "uuid": "7a591044-54dd-43ac-b096-0bdabe78eae9", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c120e94-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777479611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479611, "uuid": "bc9c6faa-a052-47c2-aa94-f71953bc56de", "comment": "Malware payload (ConnectWise)", "value": "6cb595721b11c9546dc8e01826c0db73", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479611, "uuid": "8a7c9f4f-e616-4911-867c-c128a15d9936", "comment": "Malware payload (ConnectWise)", "value": "45ad8ffd5441edf4e312e3a7deaa0861b20228e9b632ca9c50758fa50eed115f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479611, "uuid": "0d9a79a4-b760-44d9-b9e0-ce8de6f0060f", "comment": "Malware payload (ConnectWise)", "value": "eb64a3dae9ab04f6877745a2344c8e856efd1a4a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479611, "uuid": "95fe717c-5206-45ce-aa95-833640a7aad8", "comment": "Malware payload (ConnectWise)", "value": "6e96261ea23b3fedc24767b4600addcf86f3512146d1584fe29553ef7445c712900f2fe68048f579c67024a24d920d6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479611, "uuid": "fbf6baa1-8376-407f-8e8a-572f25e239f1", "value": "T150647D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479611, "uuid": "442e565e-b023-4802-ba4f-02c39faf8fa6", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479611, "uuid": "c72459c3-7155-47c3-b043-eb6b5aba6ce9", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9l:B1iw7gryNkSV1hy1Z1u2JLu9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479611, "uuid": "a212d0ad-684e-49e0-9747-8612ae54b34c", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479611, "uuid": "ae20b825-822c-4a7c-9e3d-32dcf799abca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479611, "uuid": "7993eae9-fd32-4fe3-a4a5-a4d52fdeab1c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20772e10-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455486, "uuid": "3523bf5a-b138-42ce-807f-472a8734c744", "comment": "Malware payload", "value": "b8fa1fb7990718546bb8bcb5f7c9671f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455486, "uuid": "414bee7a-dc28-4a78-aaaf-c042b6d09a1d", "comment": "Malware payload", "value": "461f184b50e7167390289fbf97ab2408cb1fa6665adad05d98fe0aea0de10a8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455486, "uuid": "538a960e-35e2-4975-997d-61a4345558e0", "comment": "Malware payload", "value": "18602e5e3b7559aae735562364f98048e4c9b682", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455486, "uuid": "eea6b7df-b695-434a-aefc-5312b4083fd5", "comment": "Malware payload", "value": "6f368d1e7660837897ba06d6f5264af7c4a0246c9f2418b9cb5befe31b04253e623737d50afa400547745babf9d60ca6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455486, "uuid": "639d546c-0985-4e19-87e4-6cb9368a2780", "value": "T1043723321FDC7A5FCEED42B2045A014E13EB8A145CC393A42B796DDEAEA4F1450A74F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455486, "uuid": "9c7a56c7-f549-4795-9d8f-69bd8e1b4962", "value": "49152:G9V9z9N9k9i9Y9Y9o9n9u9u9wzu939C9U9g9+z/97959x9W9M9f969u9P9K9K95D:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455486, "uuid": "24df8bfe-16cd-4837-9743-cbf8da6b0aa5", "value": 23424194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455486, "uuid": "ee936315-4298-43ae-bbb3-47251c68e542", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455486, "uuid": "23df0c14-36da-4527-964f-bc29994fbd33", "value": "invoice-1645080830.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33eaf398-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777480000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "3c4026c7-9068-4af5-b17b-9994c622453b", "comment": "Malware payload", "value": "f1819769bf1642d5cff02491eca094c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "d16b4882-10d3-4ecd-8655-80ffcd789f54", "comment": "Malware payload", "value": "46f59eb0dc68d4e5511446bd2ae7fb723a04dce72322f0786b43463c53bd1f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "b65e3bda-ef3e-4bc4-b002-f9a7924b999d", "comment": "Malware payload", "value": "6cab2e419fef5d4c1e33ae78b9194668e2a0a46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "03d82311-35f7-4c3f-9731-0a557d1fa98d", "comment": "Malware payload", "value": "bb749539b3317f55b297e13450c234345ca3d7d1f026f2e61707c37fff45af71adfc65db3bc1cccb06495244a6b589fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "215f45d1-119e-4515-83c8-50ca591b5503", "value": "T10C183353E8F9AE63D5EB6F7197F000E3519F90CB458808AA904627F9FA8C5CE156C732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "5758feef-e073-4713-bc62-f7f62fbc7b13", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "f7b5d5f9-cde6-42da-8c30-662e5bd03628", "value": "1572864:6K2YV/HOCo6FALauLYbTWhEngG0PXJIfK1lT/bkRk:6K2YV/uCHWX6TWDIfK1lrYRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480000, "uuid": "c7cf6cb6-d258-466f-9f22-2129fd0394fc", "value": 89197216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480000, "uuid": "954ebd07-e7c6-4089-8b86-7847d121f464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "79e800ee-dbe8-45c1-b487-ca9f9fb4e767", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fbbd7e-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777494665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494665, "uuid": "98869408-b757-40bd-905a-27480faddcea", "comment": "Malware payload (Gafgyt)", "value": "7bffcb167109b8904acc2a7fbcb40d09", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494665, "uuid": "38b83bb8-ba6c-405a-bf8e-266a6176895d", "comment": "Malware payload (Gafgyt)", "value": "472594cd2c99d010b489538f0e1c564731d4422d75ca46147c45710e2634a7a3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494665, "uuid": "4d3af34e-79b8-40f9-84fc-f1527319d629", "comment": "Malware payload (Gafgyt)", "value": "70eb8efd74d201412c0d4043fd95c64300cb481e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494665, "uuid": "4601d92b-4631-4259-8496-c27c258320c8", "comment": "Malware payload (Gafgyt)", "value": "5a350d3c7f0c64023fef7d29f8169624352c652e7df6217078af5afab226d3d6dd30582c00999eb254372b281762d503", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494665, "uuid": "0df05a5a-01a5-40d5-8861-bca0eb531ee1", "value": "T1E8C3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494665, "uuid": "dee61f53-aad2-41ee-b412-026c461dbcdc", "value": "1536:j4w4zW/h4SZsqEznAfgiDSAPzfO4jaXbzjZjCfPNXm/iRK0UgSSWP:0xW/rZsq8A3fHjarzjD+XWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494665, "uuid": "090f6371-798d-4dd0-bc41-ee3e0c5fa600", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494665, "uuid": "0f339519-44bb-4f66-8ce7-c5dbe5f53951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494665, "uuid": "8f5165a0-a60e-4fa7-9ec1-c87ff8566c2b", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b8040f-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464107, "uuid": "7f417484-0399-45bd-b687-06119b752ee5", "comment": "Malware payload (Mirai)", "value": "14028c3ec512660ccc7cb20f7afa9900", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464107, "uuid": "a1ff0bb2-cc07-4351-855c-660981969167", "comment": "Malware payload (Mirai)", "value": "4799d69c53e2585de23a9430c643dcfdc7849a5450d1422d87ad8f9ce774560c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464107, "uuid": "b22863bf-b531-4d3d-8bfb-10d09726fc01", "comment": "Malware payload (Mirai)", "value": "667aa262e9ebbcce6cec33e239b7bce4ab7986d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464107, "uuid": "35460118-fe9e-4c10-b71a-acddc0609621", "comment": "Malware payload (Mirai)", "value": "3a1edf00a8bd307151fb4eb9b7799236168c02f4360294a8c75c9ddfa3d7208527f033677c5842a57144ac0516aa43b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464107, "uuid": "c57d15c5-5a70-4fa2-9e5e-b1f055d79b6c", "value": "T1E4F47D59FE4E3C02E2DBF23CDB49C3A1632B75E1D32391627982035D95D6AE8CBE1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464107, "uuid": "de97bc5e-93ec-4da6-ad40-bc93c0e7a808", "value": "12288:bCiiG/tVEVrOzuBaenDgs7H4h63DUNbB/b3OZWDkyWcX1Ejcs5PAjF93I6:b7NEVSf7UMt/bj4yWcDjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464107, "uuid": "3f1bc7a4-ee93-4e73-a2d1-4f812abb7baf", "value": 764376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464107, "uuid": "a8413929-3130-4f0b-a144-b486ff5af80a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464107, "uuid": "9525c575-29d3-453b-b3c6-cf4c7c7841f6", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440b8b6d-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441373, "uuid": "65ddf614-8e81-4519-b76e-1f806365655e", "comment": "Malware payload (Gafgyt)", "value": "41dd08c8f5e4f92070cf062410c8763f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441373, "uuid": "8649cdd8-151e-4454-b09c-682e52235dd5", "comment": "Malware payload (Gafgyt)", "value": "4842018ec5552e0397f2b0be47f55a9612ec4c8f9d0965308724ad7fbdc1e518", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441373, "uuid": "62b169e5-8d46-41ee-b88b-99c755d6c193", "comment": "Malware payload (Gafgyt)", "value": "fdd143f88fd0316fbacef9819852f97fcf35b40c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441373, "uuid": "71d3d077-6cb4-48a4-b30c-86b6007c3a24", "comment": "Malware payload (Gafgyt)", "value": "964ee1015b1fbffcd4402440f04b3f32d1e5da938c27766e3808a9d99f398898f93830cbea98fffa41e00943de4e318e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441373, "uuid": "3cd84906-f210-4262-adf3-67ab21c98fc7", "value": "T13941618A61A109F0AE61B8EF72644CC476C0D0D6BCCA5FF56CF8B4D506ACE947821BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441373, "uuid": "224c175b-5ae9-424d-aea5-a2dfda6891a5", "value": "48:1ob0hkooJdeHnE0VS3UJXU+foUNuXN83o0BS5H0oX:1UonEQwEXUooNyo0BS5H06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441373, "uuid": "4c84c54a-8c08-406c-862f-d9c7bd122ea3", "value": 2333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441373, "uuid": "ad1f7fb1-5ede-48a2-94f0-2930394f9c2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441373, "uuid": "a7850814-e7b0-46fc-a6ea-32094c303e9b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5f8a33-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441361, "uuid": "61e74822-894f-4cd0-9658-93ed9b5517b6", "comment": "Malware payload (Gafgyt)", "value": "62cc4fa30935bc81038a465d38bff183", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441361, "uuid": "8ad560b5-07ee-4f5a-9624-5cba2f4f1d8b", "comment": "Malware payload (Gafgyt)", "value": "487f82810104051c62f0fb1ef9fe58065dca400d230487c54b9623a936827ed9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441361, "uuid": "f708b124-9f81-4895-884d-ccc3133123f0", "comment": "Malware payload (Gafgyt)", "value": "98e106a5ffba924f39c1ba79d796ed75b13209ea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441361, "uuid": "b020eaa0-435a-4079-b80f-c4c3f30cac6e", "comment": "Malware payload (Gafgyt)", "value": "6ecda3e95b4e0b6b546bb109444c869863e3c44012046ce62b119c60a1337f3dd0f988abe826c85815d4b25b59cd70f0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441361, "uuid": "a36d9c3b-fc93-4b01-87e9-5c7072ef1286", "value": "T17EA339829640D5B3D09306B612ABCB150133FB3F4A6BDEA6F35D3DF88B509817225B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441361, "uuid": "71e8ec79-fb30-4dec-9bef-b72cf0f3115f", "value": "3072:LeFymRRUcUQ9UjjZaLPPpQlwj24/3C05htTzZ0inF0OzTyoQQub:LqfX9UjjZaLP+FWC05hdWinF0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441361, "uuid": "bcf19214-2df7-4edd-a6e4-e24fdf21ac19", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441361, "uuid": "73362deb-2c15-4ff9-9c7a-917a69f9cd51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441361, "uuid": "0bce9c7e-ceb2-4239-b3b5-95c05d5dcef5", "value": "assailant.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46089035-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494634, "uuid": "ecc66191-0127-4d19-af38-ebc4f8760d41", "comment": "Malware payload (Mirai)", "value": "6767aad285db3cf147d41b96ee5a3c60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494634, "uuid": "15ea1511-f5bc-4aed-920a-1e0cb713ce25", "comment": "Malware payload (Mirai)", "value": "4933e6e43d6bc150a13d438d8104618c383150115461d7deddf65dc5379e0d80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494634, "uuid": "b532d326-7fc1-4216-b3b2-b188002dd370", "comment": "Malware payload (Mirai)", "value": "06a22fc74c7a930457de65ba96746c511daae4eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494634, "uuid": "53748846-6c56-4c23-a1fb-7f20b19b2e1c", "comment": "Malware payload (Mirai)", "value": "cfa18b8cc249ceda85349f2daba74345b6d778583a6b0c3488eb1ea69c28bf7410c74f2138f6f46119fe5e0a6835f678", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494634, "uuid": "5b4e07ac-f6d8-4249-9bad-331f677b7d48", "value": "T117932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494634, "uuid": "45c94ce7-e6c1-41e5-b577-f2dd6e81f9ca", "value": "1536:NJaUfdQD/bb2spBI3eQYmUC3100x7u/oVLuAasxzrI:NJNYn2uBIr6kpYApp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494634, "uuid": "3dcf17d4-7b5d-4e05-a2c4-2722ce639cdb", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494634, "uuid": "0b6652fc-e78b-414f-a757-4f728a996ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494634, "uuid": "9ef8990e-5102-4513-b3cb-477f3d7fbf9f", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f8928a-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777480000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "5343334a-a417-4a2a-8cd0-0663fc65e5f9", "comment": "Malware payload", "value": "c5f9fc468537ae2f50a9a90bca155082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "e3d34157-e045-45f4-bac5-ad210082602a", "comment": "Malware payload", "value": "49345d593cbce3d26fc4f400754c7da5d6f509a8470c3e5f0ad8429f9cb704f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "3d5906df-e0c4-4651-b626-59e8b6181ff1", "comment": "Malware payload", "value": "e70cb24141859b895d7d1514ef158a7e3dd16200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "9e192cc3-0138-440e-b0d2-4cf9007f5e67", "comment": "Malware payload", "value": "3e03fadc7b0b9561745e6524ebe0f862f98571908ca42f994ac28d1684ffc9bc8b39445555932589301d715b78f72678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "c7a88523-1f2b-4cbd-9b0a-b3c195fa8ae0", "value": "T160E733739E4CAC88D9CA1E7903BAEF5266996D124C32550BDD4CF6C376AF8C50A0B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "ac666118-448e-4088-a902-1575e8af0c97", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "4338d991-a2d6-4abd-ad75-7f5d1e48017c", "value": "1572864:6R5kJoO13rQcTe/FEd67As/ph6QSoXUwNSyaGtsfYHldq0:6rO17QcTeOd60shNVXUwNbaK6YHe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480000, "uuid": "16664e12-b107-4da6-9aa5-cc7ba20aa029", "value": 69959344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480000, "uuid": "28b0cad3-7d17-4fef-92c5-8782a7752703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "2864365a-1250-4e49-b09b-ed8dd6fd0d45", "value": "Install_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db21402-436d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777427269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427269, "uuid": "7eadc346-9f52-4d69-a185-9eec80e43562", "comment": "Malware payload (CoinMiner)", "value": "fab44c31e0dc2d6535bcf7ddfc052e62", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427269, "uuid": "6a76b7c2-3813-4532-a687-7d5f8dde3c54", "comment": "Malware payload (CoinMiner)", "value": "49390a5c9b86344c02128ef11923a4c524dfef0206e3f0b34182b982fbc5f14a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427269, "uuid": "24e52f94-3915-4214-adf5-d6221f4b50b4", "comment": "Malware payload (CoinMiner)", "value": "cf62a136cb13b456f09f6005fada39ee81115dc8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427269, "uuid": "82c9eb72-2753-4bd3-bdf7-11a56f0eb677", "comment": "Malware payload (CoinMiner)", "value": "dc19662966f145fd3f4e60daf1717239fb1463e318acc9c9fcdc4e9c5f5b95a4ef61ff5019f7bd753f808663beff79b8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427269, "uuid": "e009d779-be6f-412f-a773-85fdc09c2ee2", "value": "T19547023621C67CBD371E5CD9904C3D648C15C6A3B94CA18DF7E424EB939EA241DBAEB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427269, "uuid": "2e30950c-2cc4-4776-aedb-6f7c18f6d822", "value": "49152:wGaTe3AFwHZBL4WjpkYzQi3v6da9S2nH6nnWmiJflFZ8pFPg1lXI4LIb1GR4tR3S:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777427269, "uuid": "8d0f8dcc-0c3a-4887-9fa4-019cf77515b9", "value": 25491798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777427269, "uuid": "78eb831e-13dd-4b25-9aa7-ad35b90ba721", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427269, "uuid": "c5d2eec8-08c0-4c27-a5a0-75cc436f00aa", "value": "STARTCOPIAS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b2a834-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464139, "uuid": "9e68cd5d-c892-415d-95c9-93afb8886f03", "comment": "Malware payload (Mirai)", "value": "e12ae8e0abd1ccde7e5c73c463042a83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464139, "uuid": "3fd8b1e4-021f-4ef5-a564-19607a6d9578", "comment": "Malware payload (Mirai)", "value": "497fbae6270b492f1d37a85744dc13c0fa6f01e393a7cb98803e59dd6e171cc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464139, "uuid": "ad7e6368-7914-41bd-bbd8-38e9ec91aba9", "comment": "Malware payload (Mirai)", "value": "9873ded58e0692d31bed2b54532eff6ecbd1741a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464139, "uuid": "b94c90f6-56bd-4786-b227-4afa265887d0", "comment": "Malware payload (Mirai)", "value": "ea134c5e7871353e371c927c0ffe8c7edc37e72df965a8ad8946e8511736fca8e6f0bf1546978c80b504bc87f9990441", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464139, "uuid": "23991937-405c-43f0-83d8-26f73b7bc1c8", "value": "T1DAB4D059F21B3F42C8D7D4391846C1459A59E96733F3830A7F43AAFA38392B58F28785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464139, "uuid": "c9b9fd09-8352-42ef-9993-2354bef6744f", "value": "12288:mHgfd1TSDJyGHUPKxiy5OfxfYP1rAawPTU8pW9Sj8Q:rbOD0S35OsGoSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464139, "uuid": "f1663e90-4b5b-4b9f-a627-f7d847c9cebc", "value": 502468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464139, "uuid": "f6db0271-6f9f-4878-b545-9e0161d6e365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464139, "uuid": "0af1ad8f-1dbe-4bb5-a9e3-1d986121085f", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318b7e67-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "8910833d-c01d-496f-b884-b2d0c82bee6a", "comment": "Malware payload", "value": "23549669c80e7072ff2a476d66524a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "98874e69-d491-420a-8247-d62a5d1889fb", "comment": "Malware payload", "value": "4990878b7ee547b3bb4678aaf83f9b2036d7661fa19b5cfa5f1765f3d4fec097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "49896fd6-036c-4ad9-9f79-6a65d7ada7b2", "comment": "Malware payload", "value": "b08b7f1d22e37efbc7e0d8fcc839054f02878d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "5c27eebf-b24d-4d72-9adb-2b4d2904f67e", "comment": "Malware payload", "value": "e0c1ed21aa7fa4cbbc5f5b74ddce3b07b94205e3108f32d678c84e61cebc8c0a69100fb48bfb67a79d1d5bc3d8c81121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "cfc73c8c-49b4-4b77-a925-1b6ef9bcc16d", "value": "T135E733739E4C9C88D5CB1D7903AAEF62AA995D524C331507CD8CF6C376AF8D90A0B349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "3d8bcf74-e29c-48a9-9c74-ee61cab13e11", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "caff4351-7eb6-4893-8b67-e35b9eef6777", "value": "1572864:hU5kJokM13rQcTe/FEd67As/ph6QSoXUwNSyaGbsfYHldqP:hskM17QcTeOd60shNVXUwNba46YHeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479996, "uuid": "5882d0a4-2f47-48d7-b093-9bbc34698274", "value": 69961200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479996, "uuid": "673b1324-f579-4749-a30e-c8a33f261737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "5eea6877-a894-4c41-8c02-0a60978c9b8c", "value": "Verify_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a81e79-4425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777506223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506223, "uuid": "b4af56f5-f5b8-4d47-aa10-5333b0796c27", "comment": "Malware payload", "value": "44563f9773d121b5c53e40da11756784", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506223, "uuid": "e0b36082-bc77-4729-af49-4e294b8a78d1", "comment": "Malware payload", "value": "4aa403a66ca59cc226c8644ec9f69dcbbb17af2aca44368e04d2739a4905f9d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506223, "uuid": "1103dd93-f0c4-4d74-a7d5-a98910a4c35a", "comment": "Malware payload", "value": "66527da44f1ecae655b1dae95aee8c8b8648a98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506223, "uuid": "15007ea6-8645-485e-8159-1ed48b95c2fa", "comment": "Malware payload", "value": "a7d6271f83c2c2843257668f0b6485a97cca78ec7211d3eaec4b6a23188689950a3ce81596de27618566ea319882296e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506223, "uuid": "993140ee-fa49-407d-9ebb-f8d59b9a81f7", "value": "T1F116085BB8D14682C4E4367ABC7E41C432A70EBD9B9B126B6D05FE3C3ABE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506223, "uuid": "eb54656a-6a46-470c-af09-a0417bc7fc88", "value": "24576:mU6j57heK7dU+tDkVoPv43g+Unz0t0dkbceFujNmSmj8f1kSRmyVj+GBR0xQ+seu:Qy+xLhrNj4A4ZQIli6TQANP7Zj11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777506223, "uuid": "2ab78d49-8013-4235-ab0b-bbb389617afa", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777506223, "uuid": "df4f075a-0d30-487d-b047-f2d3558d3ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506223, "uuid": "7f56e86b-e9e9-4715-b7b6-055faf56c165", "value": "SecuriteInfo.com.ELF.Agent-EHC.94977888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd99901-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442461, "uuid": "160e47b0-7335-4ae3-bfb9-9a9f928caf5b", "comment": "Malware payload (Mirai)", "value": "32294c851f27aa1c799e46956d5e26d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442461, "uuid": "4779bcfa-4797-4f3f-a2e8-b6a0d9a39123", "comment": "Malware payload (Mirai)", "value": "4b1893799780aa64670b0efe9eb60b444e8c36535787178079ea0dd1f9d0025c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442461, "uuid": "096230f2-0197-472b-8228-c6ef822b5a3f", "comment": "Malware payload (Mirai)", "value": "db001b7b4daf5c87845fe654ddca935e17f900ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442461, "uuid": "cb9ca7a6-9ea0-446c-b6ed-f8f1cd7e0640", "comment": "Malware payload (Mirai)", "value": "2a1c6432ce48d09097e36c55dda454281b911e99414a274370a02e122c3061e253b2a747286a4f490fa41f27100686a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442461, "uuid": "fc9409f5-be30-4f13-b7b5-a6720e14d49b", "value": "T128330A8AB8029D3DF90FE6BE54164E09BA2167C152830B3757BBFDD36C721A45E02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442461, "uuid": "4751d485-eb4b-41ea-afef-2e6c59680135", "value": "768:MXPWupfv6/8l/LeAU7DJKT7846M9K8zg78XOV4e+SYGaP:+Oal/Lo7DJu7846MBg78XE4eDaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442461, "uuid": "54188c61-7c60-4d41-9afc-fddc83784b40", "value": 54848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442461, "uuid": "40eb9c67-d049-42b7-940c-3977ebf5afb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442461, "uuid": "b48a82bd-7837-4422-acef-d71852db5ea8", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6b5496-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490004, "uuid": "c3378c3f-ec32-464f-b6e0-aede28e6de85", "comment": "Malware payload", "value": "6e2c587363cb9af545a404c2d8432c4c", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490004, "uuid": "232c350d-3b7a-43b7-9275-e37f3423c456", "comment": "Malware payload", "value": "4b362312b910b97ca15aeacd39f0e1bad6fe74728609898675d19b05161abd1e", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490004, "uuid": "1c8f12a8-8de8-40b0-82ec-7f8eec52551b", "comment": "Malware payload", "value": "b6bc201201e9bd0050fa996e7c8c6d19e4f81ac2", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490004, "uuid": "12666779-271f-4046-802d-d9601f7b427a", "comment": "Malware payload", "value": "3ffa4918913f677028962c79be5211798837bfe0350d888b4402a9c82b037b050a383b0175a11698f165b18f14804304", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490004, "uuid": "6e4eacca-84e9-4445-8dd2-8fc78e7535e1", "value": "T1ABA27C8EE303D2F843B31F9A5A370AE8FE2C5A8439D3648AA35177A13F5955DD9142B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490004, "uuid": "a1d8b0d9-495d-41a1-9cc4-90aaaf504e46", "value": "384:uIsaIQNZs5wAVY1SPHE1yFxIiWX10iRQhbFlMOF5aCRDmH38yfmcCXHIRuJ6gArs:uIsaIQN9oaSPkMFxIJ10EQhbNKCUtfmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490004, "uuid": "470d3b38-dca3-4114-9b08-2fc1dac4e526", "value": 23192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490004, "uuid": "71d48cae-4f66-4a50-a128-6d9d6e17bfa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490004, "uuid": "e3582795-e15e-4ead-8da8-010679fc4e16", "value": "aqizo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d971e8b-43ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482996, "uuid": "d9046693-4f68-40d8-b65f-961aafa613fe", "comment": "Malware payload", "value": "51a185cf0325103fb7ef7e23cce0f33e", "object_relation": "md5", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482996, "uuid": "e8f44ced-175d-4354-87ba-7bd826df230d", "comment": "Malware payload", "value": "4bead2dfd37e98f60c258f78f443c7cbcec441f012c503ae62eb3746012a3415", "object_relation": "sha256", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482996, "uuid": "8204cd10-acbd-45eb-a5fc-1b12831407c8", "comment": "Malware payload", "value": "58743a515ec3f411ae4fbe359030d57dbdf8286a", "object_relation": "sha1", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482996, "uuid": "ba2998f9-ec09-463e-9027-e0f5c11b4b4b", "comment": "Malware payload", "value": "eae3975f0013631079236eefc577fd52d413d21c5bfe89249609aa748c950e6209009d6348cccf7c670398f7dc79af81", "object_relation": "sha3-384", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482996, "uuid": "346a29dc-94f9-446f-88f4-65bc3cac6e27", "value": "T161F470E317EC46EE6B9448DA814D3A0754FBC67B2C5E424DF4E21943F13E921BA26B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482996, "uuid": "043cc00d-a466-4c43-b5ba-f1a3077ec5ec", "value": "1536:x194Z2MlQ/4dni1n5kLpFPl9CcxHBh8m3NOf57aNWhAYEntetwlLbQBL1rs0IL8L:x7kkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482996, "uuid": "cfd4d182-f40d-47fb-99a4-b0f2f1f6f645", "value": 781616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482996, "uuid": "cb987890-2484-435c-bd59-e19901973ce7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482996, "uuid": "8d96d443-81d0-4d18-9725-9d3e6659e1be", "value": "seo-finalize.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453d648b-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478741, "uuid": "273e897d-bffe-4017-83f3-c04e5ddfcc35", "comment": "Malware payload (Gafgyt)", "value": "2c9eb6976ba3a5e5ed775e0f605b8cf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478741, "uuid": "40c96f1e-4b78-47ae-a7fa-ffaf8a0c460c", "comment": "Malware payload (Gafgyt)", "value": "4cb8c9d5973885f0a60e8cf2ce5b7ec2e6caa118388d26ddf78db5db5fbadb3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478741, "uuid": "42efc5e1-9651-4b07-8935-bfd15e2a6a2c", "comment": "Malware payload (Gafgyt)", "value": "32af8b9118bc91b327e2d5d71582d7cee02c9ae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478741, "uuid": "76a27af7-7840-4ed1-a657-a84ce3ea1d76", "comment": "Malware payload (Gafgyt)", "value": "f3111207d530e5813d0c04d7a9a0bac08ec2eed4d66994958ea80a1c0f342c327076c6bc1a4bd7e38abe56af0b317e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478741, "uuid": "c530339a-687c-41fe-b231-c57603dd9ee6", "value": "T1BC731943B70D4B53C16BAAF01AF72BF18769F96126A77244B50DBFC44372AB01412FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478741, "uuid": "c4843cfc-1af9-4ebc-9601-1fb8f0e6e023", "value": "1536:n7sUFAAFYGqILNm+h1FYGZgcV4SRFU1hHz0KmQEVMXjfbfLXe:ngQYDD+h1F/VVPSHYKmQEVMXbbfLXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478741, "uuid": "418b9214-8d96-46d8-b14d-0ba8be2aa6eb", "value": 80635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478741, "uuid": "1adc8c93-9f30-49a2-a7ef-6c2a778b0747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478741, "uuid": "02ebc9c1-a5a1-47d7-838d-010a2712ae3b", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd6e650-4397-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445359, "uuid": "603d6dbd-196c-4c9c-ae3d-7f76bb2921ff", "comment": "Malware payload (Mirai)", "value": "780570b3dfdde3603740ed19c17e11d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445359, "uuid": "5e6049f4-1d12-45cf-be29-27e1f6aad25d", "comment": "Malware payload (Mirai)", "value": "4d5c4f63753481fa580d38eff8ada32cb0ff32f0ded97313bb15a163f25fabd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445359, "uuid": "37019280-85c0-40e0-a3c4-707a9a4f7894", "comment": "Malware payload (Mirai)", "value": "f0e78b1c01165e142e9f964daa8e1db7e7d9741a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445359, "uuid": "c7735dbf-dba4-4b51-9921-450bae0e3173", "comment": "Malware payload (Mirai)", "value": "114af6b6279c0af1f0cfc833a364bce2a74135caafd78730f1c79040120d46ac6d82b3afd77cb8a885c5bf02b5680414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445359, "uuid": "2b1832ca-1717-421b-868a-039be9e3f04a", "value": "T1B6630222934630A3C980547BBA95E580F356B4B4AB9FB71B4F304DEC897BCB26B5C04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445359, "uuid": "e55a4465-5d61-4aa9-9b8b-ba8f34241941", "value": "1536:ILpBNYK1lugxZn3ujxIfIDlPN+1L4tpRU74eaeDyW:SBNv7vfiaL4tMkg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445359, "uuid": "379e7fc2-1b86-4c01-b0b7-289fa3d49ec3", "value": 66824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445359, "uuid": "15defafc-49f9-4dd3-8e59-385a6a6fe57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445359, "uuid": "43ac83e6-c60b-4f8d-bb35-41b028ec0466", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dacfe77-43d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777473655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473655, "uuid": "050de8a8-daed-47b7-a36a-6db7118fdbde", "comment": "Malware payload", "value": "7db1ba3d23d47bf931be911e0c826431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473655, "uuid": "992d559f-a204-4a66-9a16-ee37bc1663a0", "comment": "Malware payload", "value": "4d69afe32d396ef8edfb757361c6b7230c36fa76abd0b4ed44b63d16e5e3efc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473655, "uuid": "e4aafdf7-77f3-40b5-a898-f5a088a1a706", "comment": "Malware payload", "value": "730f89aa62f6321be3bbb4df7fb78aa1942bb591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473655, "uuid": "8e16d116-581e-4a05-ae3a-7aa09528e914", "comment": "Malware payload", "value": "7377a29a32776c267b9d79c8d61e13167c78a2df6323881da9206fa6106d3b60ff457e6d9ed7c7d7e33d775f71c2708a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473655, "uuid": "560dbb51-fb58-45c7-9d67-8a98a3049faf", "value": "T176160933E59445E4C2EED574C6256213BEE0389B273423DB7BD0A6E10B76FD46AB8360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473655, "uuid": "54c8e232-683f-4976-b4f8-c4f9afc1297c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQB:cqYUQuVDt0TZES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777473655, "uuid": "678ae647-bf2c-4db4-a379-c50f7cc32225", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777473655, "uuid": "44240a45-6e7e-43da-92a2-fcc2f62b198b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473655, "uuid": "8e305a6c-f87c-4e27-912c-79bbf498a41e", "value": "4d69afe32d396ef8edfb757361c6b7230c36fa76abd0b4ed44b63d16e5e3efc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c0c550-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777480000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "92190369-9a05-4b8f-92d6-fc78832d5405", "comment": "Malware payload", "value": "bdc22f7bfaba1a6ce2e1a4c0ec186cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "9dec164b-fda9-4dcd-a3f4-4912e5a85ac8", "comment": "Malware payload", "value": "4d7f1aa56d46ba6b94ab0fc6007cba67561d7be96687bfb18264cbc4d3d3fa6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "9f7e0108-ecfe-4c7d-877b-356fd6c6fc8f", "comment": "Malware payload", "value": "0f6f9cba90ef7d29e3439416c8f5b6bd1b645aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480000, "uuid": "4b3eeb79-06dd-42a1-bf20-788450a3d428", "comment": "Malware payload", "value": "a6c5f3ec21ddacc15450259bfc659962f253a720a988d715e7ad5912a663f152256bdb768f047652e10f2623d5aa7d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "2b1489ca-1158-45dd-bd19-0e16d309b491", "value": "T1FFE733739F8CDC84D9C61E7903A9EF5266EA6D12483356078D4CF6C376AF8D60A0B24D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "797e35a4-d0b3-4768-96f5-792b9f0bfbdb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "1c9a5e35-895a-4547-9bfa-8001d1e8dbfd", "value": "1572864:ag5kJojAI13j2OQcTe/FEd67As/ph6QSoXUwNSyaGVsfYHldqo:aIjH1TDQcTeOd60shNVXUwNba66YHeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480000, "uuid": "32d321c3-b0f8-4721-b02d-260f5db4f050", "value": 70046632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480000, "uuid": "0d1c2d3b-309b-42bf-9403-f8fbad4bdcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480000, "uuid": "4e28d4e2-00dd-486a-8a96-ea167ff77b88", "value": "Verify_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2734fc-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455343, "uuid": "3f32a3ca-7a52-498a-a9d9-f27fc0163bc2", "comment": "Malware payload", "value": "0f1fe839bec17ffb99cff42dd4ff5355", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455343, "uuid": "4ba96caa-386d-47cb-8b06-d376bf4691a0", "comment": "Malware payload", "value": "50518a6fcfa02f524155a7102d0cabf737e4da5bce0fbddf1fa81ba8d3404e0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455343, "uuid": "ed46835c-a14b-4930-8b93-3ac4990f9ce5", "comment": "Malware payload", "value": "bee5eff17c17f7546cb5b526eb676ff8378dc1b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455343, "uuid": "cb60cc5b-45ed-4125-87d7-679723df528c", "comment": "Malware payload", "value": "7469b6a301623a4c5af7c29a4763e3ebbb513c01e2a0a32ff9e0dea7d8826a28f5b97c62b6419688301a7fb33acd043e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455343, "uuid": "566576ff-7aa5-4f59-ab7c-14873616e146", "value": "T11237232B466B656F8F9CD62490FD29B60CD0CB048581D3AF838362E79F9FF59C597088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455343, "uuid": "1edcc3bd-580f-4b41-b99a-294201edd956", "value": "49152:BZ/NgxZ/NgSZ/NgEZ/NgeZ/NgHZ/Ng1Z/NgVZ/NgcZ/NgSZ/NgvZ/NgWZ/NgFK6U:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455343, "uuid": "0a8e4baa-826e-40d3-b3e8-4e409d0fe6aa", "value": 24204592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455343, "uuid": "090bcab6-2c6f-4ccf-aeb0-d2b16260f192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455343, "uuid": "db3dbda3-f183-4a81-a98e-c5e7a85cdd47", "value": "invoice-1645080830.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc13f500-4391-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442862, "uuid": "8041fae5-546f-411f-acce-f5da9a4c30b4", "comment": "Malware payload (Mirai)", "value": "f7832de91af4c98e86930139266b023d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442862, "uuid": "b6f2ffcb-15aa-4b39-a8a5-c5b009ce60fb", "comment": "Malware payload (Mirai)", "value": "50863c2881f5714febf74f93306f0d5b492a9e97660ab18ae2cdffcda2c5de97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442862, "uuid": "114876b8-5b2f-46f9-ae75-845b422bed8b", "comment": "Malware payload (Mirai)", "value": "6e1f5761db28f341ac15f14ab4868a3798ed0931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442862, "uuid": "f9e383f6-70d2-4b00-951a-4d9e526ab725", "comment": "Malware payload (Mirai)", "value": "c964886392b3c4aeec0c5fdcda2505d2c1ea28842ae3aa5e65bea017cafdd58f0a0cb8f3643209ae2b44caef85afc76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442862, "uuid": "1b2e40e4-e739-4db3-ba59-51a0526ce9b4", "value": "T1252319C8F483DAF9DC4A09742036FB279EB2F5BB2228DE43D7B495226C51742A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442862, "uuid": "f3f90a11-3d39-45e7-8534-797ae3e03295", "value": "1536:AdPL/pqf6ZUPs+6YW9venAGHnSPoAw3UH2z:AV/pqf4UPs+6t0zHSAAwkWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442862, "uuid": "e600c6b8-5de7-400b-ad57-eccf59ed215d", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442862, "uuid": "7cb52c1e-95f5-44cd-bae7-559ca1798c8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442862, "uuid": "6853991b-b96f-4c68-a1d4-45a2e6142c86", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09505de4-438a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777439556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439556, "uuid": "5ba501c5-f6f1-44b2-afad-0133d2405e85", "comment": "Malware payload (Mirai)", "value": "25eee253247600056347e9faa7ae58a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439556, "uuid": "f198b5da-b07a-464f-8d93-8e6835341e5e", "comment": "Malware payload (Mirai)", "value": "519dfc20fd53aa8a5a81e1f86323b266f1b35ca05de6a05ef71cd15c06c7cadf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439556, "uuid": "561ed5e2-8df1-40a8-a3e2-5f0845800f34", "comment": "Malware payload (Mirai)", "value": "1cfb7ada7b75c24612d9be2c598531706c761a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439556, "uuid": "3a5d3ddd-6f18-4175-a307-03bbd65165b7", "comment": "Malware payload (Mirai)", "value": "4ae50dcd5580ef0bda1c2c80f37fb6b9f885b449d034db63be4b8c68c07cf3cde9dca0c6569e54cb3de0358f36f780e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439556, "uuid": "94302b91-538f-4404-9561-1809b50637c6", "value": "T197A2E06AD165C39ED2C6423D74C70173382F5C446B88AB07BD00A9D3219807AA8FFF34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439556, "uuid": "3c5c255b-46ec-407f-837a-47694bedad34", "value": "384:oWR+ruZc1EBD0BEnaGr9iYnznQ2sIOKqQ7+D7N+B1/BFvDzcuiFqcJP:oWRQuZvXnZr9zzQ2AKq38B1jvHnst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439556, "uuid": "f209d3dc-5e0f-4094-ab3e-1b188f418f88", "value": 23284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439556, "uuid": "6a01c2c0-98be-46f3-9893-44155caf8c11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439556, "uuid": "252bb7c8-c0c5-43ca-8d34-5340da268d1c", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269daf5c-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "e0b05c83-5d34-443e-88ab-b84c5f8bf5de", "comment": "Malware payload", "value": "335c2105f589715881d8f593f056400a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "241df212-a7ef-4e03-9178-8f05d642a1ea", "comment": "Malware payload", "value": "5202a88b6257d8532fce5cfac36957434839040e2257570025bdc99cad9a4532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "1b862ab3-ab0d-4acd-bbb3-2f0e90cc4db2", "comment": "Malware payload", "value": "05456c53b4838d0ea80a19c8e0360030f26f6442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "b3563704-43af-4d80-9291-320204ef3e55", "comment": "Malware payload", "value": "e1a47b9047df8839eb6d34e0c32973529013df08a81eccc830a39a09db718cd71bcb25d48245fad256505c020b6cf2bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "18195867-26e4-4d1c-83b1-528f740e5c01", "value": "T1C8183343E8F8EE63D2EB6F7197B010E3915B95C658C8085686462BFAFACC6DE015C731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "2f473d62-e7aa-44e4-80b1-cf8f4ddb0605", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "e43988ac-a0c9-4ac5-871c-dce60a5ac4c1", "value": "1572864:vf2YVvHzPCo6FALauLYbTWhEngG0PXJIfKBbT/bkRT:vf2YVvbCHWX6TWDIfKBbrYRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479978, "uuid": "38aa7b55-a1aa-4903-887b-4a5dd2c12e23", "value": 89230272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479978, "uuid": "c8650a88-60bc-49ce-b33f-7d5e56080b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "d4855b46-d3dd-4b1a-ab9b-6a3114f4118e", "value": "Lume_setup__1_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6697a4-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442217, "uuid": "f99db481-8b3c-415a-977d-d2b33c84c9c7", "comment": "Malware payload (Mirai)", "value": "543e77bd6bde13a45b744cb8b852203c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442217, "uuid": "447c468e-1ddf-4321-918a-1a102c2f1b7f", "comment": "Malware payload (Mirai)", "value": "5287a228468640a8e5506b94e22d5b760e965ece4cbac7bd932fae42e55a9e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442217, "uuid": "20ba885b-dbc9-4dcb-91dd-01be53b65197", "comment": "Malware payload (Mirai)", "value": "bd394de153fdbd8cb8c52caa9e3019773a3c706b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442217, "uuid": "374995ca-8d18-4f80-9c99-4888f3242aab", "comment": "Malware payload (Mirai)", "value": "84d7e32a7027deb98248786d6a199e2540b856cb4da9f4c21473a16397711cbe3af29d1c03ae3806eeef08fb15b0fb0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442217, "uuid": "81dc1f5c-0963-43a9-a248-742aa409ce8d", "value": "T19AC2E158E516E617F27018399CA4C8D4DE498B39A27D3A2323C2A799D3D8019AF7D5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442217, "uuid": "ee7513c2-d1da-45fd-9fa8-5f40b8bf327a", "value": "768:oaAnFRVnbEXaj+H2RUcS4U++QYT7lTci9q3UELWB:TArl+WRUgUW2BTCLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442217, "uuid": "489b17c7-6c09-4e0e-92a8-47eca9e5ddbf", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442217, "uuid": "a89b21dc-0a95-44ec-968f-5392ec1438b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442217, "uuid": "6eba3519-07f8-48ea-971c-483f5a1c5aff", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abb7a7c-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441357, "uuid": "0f492319-d1e9-41ba-936b-23684967aef0", "comment": "Malware payload (Gafgyt)", "value": "ae4b642f813701acc8832fc066a0db17", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441357, "uuid": "1662f584-b1a6-45b0-9e1f-5a6caeb784b6", "comment": "Malware payload (Gafgyt)", "value": "535a48b622911cbe9e6087111f21880ebe46dec5a407c7a79dc5df28d698fc0b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441357, "uuid": "cc3495b0-4755-4c25-bae0-179e12a569bd", "comment": "Malware payload (Gafgyt)", "value": "08ecdc9c47a9ae3644d721485f55017ce082b3dd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441357, "uuid": "5eef4599-f6b0-4bee-9660-447ef89814c2", "comment": "Malware payload (Gafgyt)", "value": "41440cb0761063c140212f665832960f8f90034a9089ed222127f627e197884501a715a56304b94decad38d12dabb084", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441357, "uuid": "143ecaff-b344-4fec-b7df-454a8f4d13ad", "value": "T11AC3F805FC404B27C7D23BBAF79E438D773566586BD73311AA296EF02BC5B882939160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441357, "uuid": "5a77e499-1ece-4d8a-b642-f08d506e9b1e", "value": "3072:vFDcpqlgQSnoHy+Ks/uUlKQ1Vx5hLy+vPQbrlySMv3oCxDQlD6ObAF5R:5uUlL7x5hLy+voLmoCxDQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441357, "uuid": "495c0ad6-17a4-41db-8a9c-7b5fb455537d", "value": 120867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441357, "uuid": "53314778-f842-454e-b7da-25aa3d945b3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441357, "uuid": "d9684dac-880f-4a80-92c6-f4f48e2909c8", "value": "assailant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d32c317-4392-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777443106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443106, "uuid": "d98684dc-8599-4f12-bc35-d13734bd7f47", "comment": "Malware payload", "value": "dc346ba9a2e2d7f7b6fe2a2e841381c2", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443106, "uuid": "8fb58485-8752-4e1c-ba6c-7374d19a116f", "comment": "Malware payload", "value": "53a239dfb8a7f17b5e4b009d497e7d5e47ecd569a02778f7550f73550bf720be", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443106, "uuid": "d866ae0d-f2da-4c55-8812-a056186fa161", "comment": "Malware payload", "value": "ff3d9e96551110bbbaaf1bc03ed205a5a929837d", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443106, "uuid": "a000517e-4ccc-413a-8873-10301a7a9a91", "comment": "Malware payload", "value": "ea7000701558ba9ebba3b162c846306f37929ab3bf5e8936af69e086ed011029db3b57fc50844fe4d766a77641132906", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443106, "uuid": "6b7a7105-0a35-4205-872b-9e85a248146f", "value": "T118C32FDF5AAA84FC976F6058052B6D0BDC6F5233155EC6A076EEAE463F12D3030B99C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443106, "uuid": "d9cc0ee5-caa7-4187-b2b8-cc3aff0821dc", "value": "768:mTXcrQmwWTCwCKauBIOhoRu7p2eYt7TyoKOK1JU72iWa9O0OuOvOBaBWG/cH09na:C34yftCN+jVkJ6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777443106, "uuid": "c685124b-c23a-490b-9219-70bd5050db73", "value": 129962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777443106, "uuid": "0fdcefe9-5202-4f47-99a4-54c35e7d69f8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443106, "uuid": "f5cfcb75-2643-48ce-8390-db8cda07c6ad", "value": "Marketing_Gamma_Images_170.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befcb627-43ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482811, "uuid": "93eab720-5d84-4140-8865-ff0dee4f606a", "comment": "Malware payload", "value": "8ffea7c2cf963f92e2be75ea5e345c48", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482811, "uuid": "650daf48-4e10-4f1b-af59-28557fd3736d", "comment": "Malware payload", "value": "53eb19640b0ddf958d3deb3d5a0e1dd231a6bb7524c864f09149c71f0c0969cf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482811, "uuid": "17f79f6f-bbd5-42eb-9d48-21a0f55ed0e5", "comment": "Malware payload", "value": "0a3b90b95298a745a50b7154fe856b0be7e57e7a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482811, "uuid": "2d372ffd-c3fc-442f-a19a-703279ecee6d", "comment": "Malware payload", "value": "1b19f3c5b1d6a02fb38cfd4fc7be41bfd5fdbeaccbafeebac2a3488391be6ac6eaa1eeff4181b2e07dcdb1c31dd479de", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482811, "uuid": "598a78ef-588e-4b76-ba97-10bf760a85b9", "value": "T1C0A633E0F5846FC2E131C93053F890B5E6DE18A560A3EC62B8131F9E65939F3B69F449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482811, "uuid": "7f3bb560-10ca-4044-a064-a7681a637344", "value": "196608:5Us5+uWL63x+mb2ZYYLsIPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc9yPZ8E+tV:2L63Mmb21IhOnn7FUNyhGprLz0Qh8VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482811, "uuid": "c9e40a43-e4d7-471b-bbfb-44566a9608f5", "value": 9550624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482811, "uuid": "32d86abf-6731-4f41-b364-6997ec4ac1eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482811, "uuid": "1a2de83f-fa06-4da0-b622-fb33d0037655", "value": "1f86ed90-6b0e-41e4-b4b8-dee23cfba442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692daf50-43fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487821, "uuid": "a5d1fd49-5a76-42f0-bfd8-9bc95c8fb248", "comment": "Malware payload", "value": "691f8aa48edb389a94000361f6fe58d6", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "security-checkers-com", "colour": "#8AB16A", "exportable": true, "hide_tag": false }, { "name": "subdomain-security-checkers-com", "colour": "#11F05D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487821, "uuid": "da107166-3aa5-47f4-bb3b-61f870243e0d", "comment": "Malware payload", "value": "54ac4ba45ac5a7bda0a311b97aa4263b94657f612ce73cd4e1407376a6f05d98", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "security-checkers-com", "colour": "#8AB16A", "exportable": true, "hide_tag": false }, { "name": "subdomain-security-checkers-com", "colour": "#11F05D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487821, "uuid": "db79dfe5-5a2c-400c-8606-89660d4371b6", "comment": "Malware payload", "value": "84d04f56b8c20e4cd629a6f396d924b600eef468", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "security-checkers-com", "colour": "#8AB16A", "exportable": true, "hide_tag": false }, { "name": "subdomain-security-checkers-com", "colour": "#11F05D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487821, "uuid": "f0296d2f-50c8-4f18-8f1d-48e385ff8005", "comment": "Malware payload", "value": "1dcc471f3c4329982f3a459b7de54a67553d8898d655151fb298a9326932070912de90747170fc569dad6f015a710ae6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "security-checkers-com", "colour": "#8AB16A", "exportable": true, "hide_tag": false }, { "name": "subdomain-security-checkers-com", "colour": "#11F05D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487821, "uuid": "377e25ed-7e32-49f0-b556-ab9f53281e2b", "value": "T1A1864A43ECA515E8C1AED1358AA39663BB717C491B3123D32B50FB283F76BD069B9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487821, "uuid": "2c06bba0-2415-47a9-b421-eba5d615ec97", "value": "49152:iCDQDqO5w+82x9q8ldjVJwYie/NbsY6+xUEDw3icJJ1tiA5nNJcxapEW/VJdDgAs:iqXOmUQ/BlgazQP2EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487821, "uuid": "52732263-a6f3-4c7d-a3f4-af6f85a23f51", "value": 8487074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487821, "uuid": "885cc02a-b082-4ef7-8fe5-3f85c6d80f93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487821, "uuid": "a61b690c-76a4-4b1e-bfdb-743b9b003d0f", "value": "ll-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93aa15ea-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494764, "uuid": "81e499ef-a9a6-43bd-9088-3e2ad2768e4d", "comment": "Malware payload (Mirai)", "value": "7cff240c51b5da2231187c1fcf0a3185", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494764, "uuid": "de1593b0-aeca-4e93-b80e-857c9e1250ce", "comment": "Malware payload (Mirai)", "value": "550c647474303b5213685cabd95183899c4955d89ce9f1173dda024c8bd3675f", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494764, "uuid": "b25c721c-3b80-4328-801b-005f7b210bb9", "comment": "Malware payload (Mirai)", "value": "f22882a92275c5e4a855f136dd22763d80988f07", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494764, "uuid": "00ec85af-64f1-4014-8632-9f44ea4b797b", "comment": "Malware payload (Mirai)", "value": "b5b6a0ecd3fc31ae7d3b08c232848b3ca9439b857b3d2f5af54c8e1c5fa40feb50db961c223eff259438b97ad215b14a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494764, "uuid": "0c5ccffd-b2f1-4166-99d1-21e65dd57abc", "value": "T15D23E0CF98F12985CB3FEEFA00101B968445A1A7630E8F5D42784DA9D7B6D067CBC289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494764, "uuid": "1526293c-5865-47fc-8761-0440adb8cf2f", "value": "768:gvQqBHtjfUMLbSChY5UREzHDpsrJHN4A9nTctro4rCfI4FAoWLDBv1I2nzU5cuWU:/qDfUTmrJWmT+ouCfI4TWLDVa2SgEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494764, "uuid": "9672ed44-0273-4833-8880-7ade56a6e6d7", "value": 49524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494764, "uuid": "e27725a9-7dec-4f04-941b-c4fd5199a32f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494764, "uuid": "6a6e1398-4b8a-4d7b-9a7d-8f1a51001519", "value": "rage.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72431ca-43b1-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456652, "uuid": "b5b6c721-6e84-4dc6-9d3e-60c1371536e6", "comment": "Malware payload (ConnectWise)", "value": "af605a6081da19702e254b0fdc1adfb0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456652, "uuid": "530eb6cf-0903-4673-9e46-a7f92ef550f0", "comment": "Malware payload (ConnectWise)", "value": "559c836240af07baa2108518e015dbfaeed8f62c8c9cc760bed947fab2d15858", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456652, "uuid": "13a4a1f2-07d5-4126-8a9a-964b63818393", "comment": "Malware payload (ConnectWise)", "value": "f1bd53fd04113274001992b53e8a977dee30a8cc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456652, "uuid": "3ecd318b-9101-4561-8331-26b8b2c897b8", "comment": "Malware payload (ConnectWise)", "value": "db199ac85423e86f9206bf7bc91488906d8a5f955cecf44eae97d47da7755040e2f827681bc977309b43f00b2e84eb32", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456652, "uuid": "952b4004-3bb6-405b-9c92-8648b7c533c3", "value": "T10B56F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC08E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456652, "uuid": "62c7d4ea-3b72-4314-96a2-1c6c7354ed03", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456652, "uuid": "4bda8b69-59d7-4785-b286-72ac21f26ed1", "value": "98304:czIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:chfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456652, "uuid": "5d4439cd-0ea7-446b-a897-2b72ddaddf41", "value": 5966344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456652, "uuid": "533d2743-715c-4062-ad84-48b6acfd55f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456652, "uuid": "897432fd-abcf-4db3-9d4d-7678cc5c51d2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ec4b97-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777470607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470607, "uuid": "b17ca686-5b86-4a4b-ba2a-23523a0a6a9c", "comment": "Malware payload (ConnectWise)", "value": "ddd0cea220d5df45fd4c8e2693bc3564", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470607, "uuid": "4be41eab-7e7e-4ab5-b90d-979e1b65dc88", "comment": "Malware payload (ConnectWise)", "value": "55d1bc580625488994120a86bb3796cd8cf3d07351664ccbd2e1dd456caec1f4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470607, "uuid": "04ef1cb0-5fbe-4bc1-b11e-0d6866ea4c9c", "comment": "Malware payload (ConnectWise)", "value": "b49225282055746e5d095b3d6df15ff6fe34f859", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470607, "uuid": "e210fd7b-6716-485a-bb03-be96e7030f96", "comment": "Malware payload (ConnectWise)", "value": "7739f07348c640b231b07ba7c18664fd26688c22fa136b44cfaae303e0db9ed8f094c0942a3b616b61f61f4f99ff681d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470607, "uuid": "2c27aae6-2065-4306-973f-7f86f84f7d82", "value": "T1C7646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470607, "uuid": "82b802ac-d393-4bfe-b193-1f18d8995dc3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470607, "uuid": "dff39242-45ae-497f-a542-b443decf4d94", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9A:R1iw7gryNkSV1hy1Z1u2JLu9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470607, "uuid": "9d571546-7247-47ee-8c50-42236c46e8f1", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470607, "uuid": "9b6a1208-19aa-4eea-876c-d46cc834ae5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470607, "uuid": "715e7931-7c06-44be-a068-733c5bb3f368", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd31b67-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494994, "uuid": "0bfae232-8b07-44b0-87fe-4a363a4f8b2b", "comment": "Malware payload (Mirai)", "value": "e3f10500a2fa1c80c7e4cdfeb9189f3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494994, "uuid": "84e0b3cd-7920-4177-855e-a012882c10af", "comment": "Malware payload (Mirai)", "value": "560adc704a3d38f321b0b0e8e1f2e40c6ac96fbe01eb0d2c4a0908939a1f1c82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494994, "uuid": "3fea0ef8-720a-4f80-96d0-e0fa5157d9b9", "comment": "Malware payload (Mirai)", "value": "aec4812e0050cac01f653b24a836eed1c87770c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494994, "uuid": "cfbdbd36-3653-441b-bf7c-3b88014b04f9", "comment": "Malware payload (Mirai)", "value": "533ffe5312cf56ee6412cbfabe3e0c07f4fc3810a0340f8b57e299edd35813013c1bd3e99395a8580bf8931a3fe2895b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494994, "uuid": "a9e0a6c6-58fa-4636-8caa-106d7409ebe3", "value": "T1AF9329227E761F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494994, "uuid": "31eae973-5fa5-4537-a16a-3a70299e6a85", "value": "1536:5y8MSzlPyzhCJuWsZIJH11SYIZDptbwgENWq5+/sAlhEt/r:5y0A2j/SpVBJENlzHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494994, "uuid": "04b1e8c4-b8ba-4148-a51c-d680f418fce5", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494994, "uuid": "182ee5e4-be78-4088-9d69-3373c4f3c667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494994, "uuid": "43a5c65c-5686-48a0-bfdc-2bb9fab087d4", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbb1ea0-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455512, "uuid": "99d08f1d-c616-4cf5-b2e5-508ff8d70231", "comment": "Malware payload", "value": "26c0b9ab2224e96c4a1a9eb37f2e6d7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455512, "uuid": "63e8ad27-d219-4654-aaea-df97d51920d5", "comment": "Malware payload", "value": "5650d07aad9ef833d78045451a844b4fa12219ff3ffa9dcaf3139991c9018cb6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455512, "uuid": "cd7bfb0f-da95-4cb5-9ee7-a6a3e60896ff", "comment": "Malware payload", "value": "b21a21cf41804d93c10dbad80e03bef5bb3e1f59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455512, "uuid": "25bd5a32-c93b-42d4-a4ad-2dc2c0366740", "comment": "Malware payload", "value": "180acae8c1e42dec4800337bca8944ea2c4b9a97174554df8aa54a544ca7e8095d2b30281949624e7ccce0015d8ad39e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455512, "uuid": "454d26a0-de51-44c0-b36b-ba4f29106d4a", "value": "T1473722931C606E0F1A253BAA257F296F56B98E0488735E96E0D3F92A17CFC50530F27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455512, "uuid": "0032a8ce-6f15-4082-9c3c-fafc722f2de0", "value": "49152:5nFOAnFO2nFOXnFOSnFOMnFOanFOhnFOCnFORnFOrnFOAnFOTABdiOomDanFOnn1:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455512, "uuid": "43b86b13-833f-4c33-a5ec-15c676dd37cb", "value": 23164072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455512, "uuid": "9ec52e3d-c7c2-4e34-adf8-5e41dabdc84e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455512, "uuid": "bc15ca73-b0fb-4c5a-b452-5bcabe099048", "value": "invoice-1645080830.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89d6cf9-43bc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777461379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461379, "uuid": "86a904af-edb1-47f1-b6bf-ff9bd2ab679c", "comment": "Malware payload (ConnectWise)", "value": "0c508a2bcc1b6d8bbed6c9e51f6acae1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461379, "uuid": "99e9891e-ab50-45c2-87c7-a5620730a0ce", "comment": "Malware payload (ConnectWise)", "value": "565ebdbc3a1d3c26c7a81f89e560dbfc96b2e8cb8ad258184a4bf8ba2a903c00", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461379, "uuid": "efb02a28-efbe-4939-bf3c-aea228a05df1", "comment": "Malware payload (ConnectWise)", "value": "6ffe0b8a28a941a5fb1b89bb4112ceafda0532f6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461379, "uuid": "514c1992-fa0c-44f7-8f17-03a944d27d30", "comment": "Malware payload (ConnectWise)", "value": "cca697b12ebf82a4e99d94393d618042179eb5a37b62c3c95eee14abb3ab3b8aec8fba74f2302a7308849ef4ecf70e48", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461379, "uuid": "09569866-3337-478a-9e87-22500be39506", "value": "T18E46F141B3D695B6C0BF0678D87A52AA6734BC048312C7EB57E4BD297D327C04E327A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461379, "uuid": "32fec9b0-006e-484b-a4c8-acb1526b1c8a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461379, "uuid": "1fb944cf-f1fb-4100-abaa-1470e3e85f4c", "value": "98304:7ds6efPc66x9G6GYjTG7WSvhrG9N9vlcUR:hfefPQHGYjMi9N9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461379, "uuid": "5ef0e633-bd32-444b-9e86-34c927667c13", "value": 5531728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461379, "uuid": "0329bf51-a53f-4f87-af76-52a9eff015ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461379, "uuid": "51eee648-21da-497d-b6c6-795ac3cc07f4", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bfda83-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1777489075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489075, "uuid": "e57f7f67-81b3-4038-91ed-ca6342f35233", "comment": "Malware payload (BlankGrabber)", "value": "87fd60e66c26e68cdd8b10880890630c", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489075, "uuid": "5d6a31eb-b262-480e-9a60-3ec57073e82f", "comment": "Malware payload (BlankGrabber)", "value": "56f577fe3559aa6f8caf26fb59047b363c4aba2ccab45eb31afc0d99c3a10804", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489075, "uuid": "09561743-29f8-4b22-8433-934fc2ff8bb2", "comment": "Malware payload (BlankGrabber)", "value": "b909e357f418c864f9a25ef682d6076dbac62c88", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489075, "uuid": "c0dfffbc-af57-44d2-bef2-b3c15da02cb0", "comment": "Malware payload (BlankGrabber)", "value": "44c3dc7e88396513784ae2c5cf76b05dbe890e9d65bd2fe6a88ff684d439bb791d0c65386aa94bda9db539bbca3de31d", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489075, "uuid": "f461ff82-0003-4f90-a01f-c71c967708ac", "value": "T1A876339253650AB8F47B413D8676D403EBB3B85613A4C6EF07E443972F036E58E39B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489075, "uuid": "0f0f8a54-6677-42bd-82a6-9d966d78e37d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489075, "uuid": "7091d925-63ee-487b-a8cd-c537ccfd4318", "value": "98304:uiSiJI9AVurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EUKhudJ1XmYB:AZ9UurErvI9pWjgfPvzm6gsFEZELJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777489075, "uuid": "ef7d0ace-b709-4200-93c2-7351b627e9d3", "value": 7765328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777489075, "uuid": "879e7eda-b69e-4c32-8f26-fa7ac28bac56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489075, "uuid": "8f917b5f-a90c-473b-89c0-d96a3a5e03ec", "value": "valorant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184bde39-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488973, "uuid": "d7bb4728-c188-4446-85e0-9e8000ba8418", "comment": "Malware payload", "value": "2b9028b2f4e9455208c9333179369916", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488973, "uuid": "d0ae1b38-e948-4ad7-8643-6e16ab668566", "comment": "Malware payload", "value": "57d0d6898b8923d87d8e4265cda075af50a2cbfd2fc71034f4912660a5e3a9dd", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488973, "uuid": "2e118035-ea55-40f7-a5b9-9a5439b58ac1", "comment": "Malware payload", "value": "f5034e6f12ad33de7c63f65bdfe3f56d5732377b", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488973, "uuid": "50745a03-f0d7-49be-af29-d74f553b732a", "comment": "Malware payload", "value": "909987e75927a6a8ed4c87cec39c789d2031f2996b2d3bbda18c60e5622f98a34da2dc85dcd6dbf3dc00fa06dac825f0", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488973, "uuid": "8918a64f-2c7e-4894-b84e-fe3a6c9b4f57", "value": "T179A27C8BB35048B812B7AF13E3B4A1DCEA183C6708DFB95BC74872B53C89456F956471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488973, "uuid": "48f8cd4b-b9e3-49df-b419-780ed3787e68", "value": "384:uIssH5oPAoyjV787vXsJdihMFdKI7/F/1sfCZeE4vjt74QBr12N9FclWM1c5hst0:uIs65KLyVO2BFNrHsKgvvjqq2N9ylWME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488973, "uuid": "760b5f27-96f8-4ee0-b088-cfae69a2a552", "value": 23208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488973, "uuid": "d3e203e1-1004-4876-9cc7-8fd549250ca9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488973, "uuid": "efd173c4-5bb8-46a6-a998-4698df407986", "value": "izepe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ae9f6-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455403, "uuid": "9010b7d2-4889-494c-a1b2-ff81bfcf43e1", "comment": "Malware payload", "value": "2e7140f9309c82ad794e77023689651c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455403, "uuid": "319e2771-3b80-401f-9709-c21f726008b0", "comment": "Malware payload", "value": "58675f5771515e360d7cb592fd616e14a2159669df28d9f1c9e682beedaa0446", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455403, "uuid": "252dedd1-9bd6-4128-b2a0-419fd426bb56", "comment": "Malware payload", "value": "fd300a005a36c1fd2bdaed9055e18b96bb23de91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455403, "uuid": "70d2f3c7-cf78-4048-8802-8aeecdc6fd3a", "comment": "Malware payload", "value": "aa15691dd172230a76aa766a985b026c5ca9983b771b3922eddd4b815a338cf28b84cddf10858bcb7d888b09130d69a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455403, "uuid": "9f04e37b-4e0a-427b-8326-00287462b1dd", "value": "T15E372384995A8F9F036C15486CFF124B17844F8F8218BE9E23C77896B5FCE5632DE684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455403, "uuid": "bea5c20d-0f2b-47cd-93b0-be93be8c4a10", "value": "49152:SU3pU3JU3GU3LU33U3NU3nU3RU3MU3BU3fU3BCD6U3bU3WU3aU3KU3pCDZU3XU3L:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455403, "uuid": "18e6612c-729b-4de1-ad6e-10e19bbf1972", "value": 23684352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455403, "uuid": "41d6d0b8-cf75-4ab0-919d-9fc6c586eae7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455403, "uuid": "7eedef6a-b5c1-4166-bdb3-b6125c1f025a", "value": "invoice-1645080830.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84281902-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490013, "uuid": "e64ad9ec-a34a-47f1-869e-49ef674b215b", "comment": "Malware payload", "value": "4191cb7a7fe1c1e7e7010b74b54a7e8e", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490013, "uuid": "b0df8945-7ddf-4779-9848-0ceca02b4f0d", "comment": "Malware payload", "value": "588bacb36af9c61fc1bc09ef6bf4cd22dba81668e49c95295a9d88c7cf356c3b", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490013, "uuid": "4527fd58-5e06-4547-b078-90c654bf0231", "comment": "Malware payload", "value": "16b08ea4531198810edd4043aa4fbcdebdfda5d5", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490013, "uuid": "9d9526e6-d0cf-4e2b-a195-c5b866fcda4f", "comment": "Malware payload", "value": "2517311d4e1f72dfafd69b8ddad5baf49ae86370598b4ab482e81ba88e271ecfb603e73a986769cf26e1119deac0c79b", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490013, "uuid": "3d1a778f-6e6c-421c-ab84-ca9392ccd1c2", "value": "T18013AF24E79036B665ECC3F424750E84ABBC4E7A24ACFDBBC258585C2F9FD5AC121435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490013, "uuid": "2aabe7c6-f32b-4b0b-908f-1d488b3cc637", "value": "768:uIs9p6ud/+1oXOZXkPcCNEJS6N23XuIjxvtRgkd8hQQOr27xI2NbylWM1c5h6y:qp6uN+1lZXCcCNEJS6GXuk1Dd8h7OqtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490013, "uuid": "5ec0b0e5-6356-455b-9252-be8cf4d34f7d", "value": 42624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490013, "uuid": "ec995349-8757-4a91-892a-04a1ec80fd8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490013, "uuid": "3e72eff0-2d86-46a6-b4d3-822e5e67bc30", "value": "awuri.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d045e1af-43c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777463512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463512, "uuid": "16689ef1-1fab-48ec-adb8-bb1b6d211927", "comment": "Malware payload (Mirai)", "value": "66492fc5fbe724ab3aba09a8c7976ebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463512, "uuid": "d7f2435f-6d7c-4d7f-ae02-2d118a1dad9f", "comment": "Malware payload (Mirai)", "value": "592bacb2b6101b01f11a7fcb7b6bd464bcead1ce6b934670562a826986186157", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463512, "uuid": "6566855e-6249-445c-91f9-7605c2dcbaab", "comment": "Malware payload (Mirai)", "value": "58175f6569bd3bf20343bffdbd2ebf1e29ed4164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463512, "uuid": "b39ebf36-60bf-4dda-99c1-503cad350831", "comment": "Malware payload (Mirai)", "value": "5ac3a918c2e819dea8c1f1356036cffd093be4376d442002599ceba22ea2840d6131caa8acdc24616aa77c2be0c7626e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463512, "uuid": "47a1d401-2b17-48fc-ae50-8eac56405f2c", "value": "T17C13F15B9E539C22DE202CB2C40AC803753819B8F11B3AD65B74599DBAE734E28ED543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463512, "uuid": "a1818a61-2c41-4d05-b8b4-cbae4c0de837", "value": "768:KdeAy+CAOgrSIpi/Qj6bSGyeJ2VMzarn6/YGOr+w7oth9yCak9q3UEL0:un/CyxpiIj6AVM0Wu6h9UL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777463512, "uuid": "9b3246aa-d30f-4d57-8bf1-3b18b74352ec", "value": 43156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777463512, "uuid": "5f48d6ab-1c7b-40a0-9ab2-61881a7c59aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463512, "uuid": "58c019cc-6b46-4b61-9658-d07adb0a2dd3", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa51e54f-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441544, "uuid": "d1f8a3fb-6b6c-40fd-9de4-7ad22dcafe9b", "comment": "Malware payload (Mirai)", "value": "d95c35f24d8e52fce3071573d8d8cf1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441544, "uuid": "df2398c2-7db0-4359-aa12-9870a6087448", "comment": "Malware payload (Mirai)", "value": "59ca24a1278beba54b0f81f63d5272d41fadd8b8ef4c0f961a2a745f75d3cf3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441544, "uuid": "9e311805-27e3-4392-9821-9e058648a89b", "comment": "Malware payload (Mirai)", "value": "17c1054100d73318c6c83b4b69cb7a7a91f48edf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441544, "uuid": "77068b4a-a10b-4afd-b83d-fd52c58dbad0", "comment": "Malware payload (Mirai)", "value": "ef98c0102214b0f1a1a553652bf9a87ff2e5d6686f20273e4b9987beba05904a9ad7a628f01c468a43d5db3cfb02a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441544, "uuid": "2c560b3b-1e82-4428-a39c-12762561051c", "value": "T171E46D5CFE5E3D41E3CBE3789B4A43E1F22BB190D32351A33942524C94C69E9CBB165A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441544, "uuid": "64d1bd6f-282f-429f-8148-ecf79d1f5dea", "value": "12288:7hc4NzwvZn08yKhaVkwkUK95S1b7x6/9aw5C6iTB:1rtVKhrww958G9J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441544, "uuid": "f5c64963-f318-4ddd-8821-a28fb16f1013", "value": 663560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441544, "uuid": "fdfd397d-5915-443e-a6df-194a1088e211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441544, "uuid": "c1d0e5d9-0775-4496-ad3a-303c30e797e3", "value": "agent_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1721f46b-43c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777464920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464920, "uuid": "709554ac-085a-4055-8d24-4ab3d6806b71", "comment": "Malware payload (DarkTortilla)", "value": "f4e5bb35326cc0efac803b500384e78e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464920, "uuid": "021fcf38-7cfa-4d96-a0d9-09c253c4307a", "comment": "Malware payload (DarkTortilla)", "value": "5aae35e2a68a8fff33f324c70f14780fc49cbf962a8aee46a29e258f2a1fa70c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464920, "uuid": "a76bd07f-3a38-4b67-9e2e-f6f10f4e8128", "comment": "Malware payload (DarkTortilla)", "value": "8f85fcd7da4aa0086ed1ba7153291afabb44463f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464920, "uuid": "d8c38fa8-a03b-4032-9d1b-402df82c11a5", "comment": "Malware payload (DarkTortilla)", "value": "f60cb6b0954b5ed3926a52d0052eb74fff6857555cb7240076a8d844c4714d4f271611fd1c66871c3e93f52ace841e27", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464920, "uuid": "d489b63e-f7af-4ef3-b594-04b4cee5960d", "value": "T1DAE4AE207E466B55E6BE2F7C8092449AB7F4CC069347F71B6FDC32B51AB3782CA06911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464920, "uuid": "74fe0b10-9174-4c4a-ae9d-e895ad70b60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464920, "uuid": "3ab999d9-6dd8-4dc3-9749-9dc1303cafd9", "value": "12288:VfbelrvFwSW/9bTL75zh0n+ouh81FUwNd:tiFwSWRTL5oP1FUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464920, "uuid": "ca2450f7-5ff7-499f-a9f9-9ce607acac70", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464920, "uuid": "8ec0ac18-3d90-42d2-825c-65788fe56d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464920, "uuid": "2d5be5f1-aadf-4698-ad5f-f76cf1d888cd", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36726330-440a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777494607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494607, "uuid": "17c39ca9-8f3a-4cb9-b613-7d95cde73d2e", "comment": "Malware payload", "value": "b2c81fd55914f70478bf3d75b647dda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494607, "uuid": "2e717a64-1572-49bd-9e41-26063cc0e0d1", "comment": "Malware payload", "value": "5b1bd3011b219c36b686b2623016baaf36a078ad413201a5ccb18227d1a75815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494607, "uuid": "ec977b29-15bf-4391-a620-4007b9405319", "comment": "Malware payload", "value": "272c00722f8df36afb2a9f1e7cb4348b757fc5ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494607, "uuid": "b1bf9fd9-3f65-4f90-9cde-55c9a53dad4a", "comment": "Malware payload", "value": "1a428a066155074dd44cc6390897818b198cd9d8d93ee2a6107bf4b48d64901cdd885e6112d3df45c9408bb508302df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494607, "uuid": "1f5914d2-bd41-4f7a-9743-56b6c86ef686", "value": "T14FD4121077A5EC67D7201FB0CCA74BA90BD2FC7165B057273360B6EA3C76A95E61C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494607, "uuid": "d2ccd0ae-e103-4870-8175-ee0d760731a6", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494607, "uuid": "22cfd68b-0829-4e44-8418-5295e6a487f3", "value": "12288:dbkkZ76ovakiLgKBpUmbUR5k5BrF5gnEX3C3fZyi4aAwlJNB0:dbj56o4vUmUk55Feny3Cfxlf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494607, "uuid": "3d4d4e07-12cb-4862-a829-504ea6a547cf", "value": 631487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494607, "uuid": "c76bbaa4-e5d5-4757-a4e5-38c3fd155b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494607, "uuid": "43d663db-d892-4af2-b627-45a95b7117eb", "value": "rPaymentConfirmation_INV-2026-0147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c0885-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777495272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495272, "uuid": "2b019d56-cf59-42c3-beff-f4a82cae2a99", "comment": "Malware payload (Gafgyt)", "value": "e1168ebf024e9613cddb76ef64d90463", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495272, "uuid": "7e9a0c80-34bb-40bd-ab32-92fabc939ec5", "comment": "Malware payload (Gafgyt)", "value": "5b5b591b4597809e29adc43ff97473b51a672dd7f6d307048cd139907f2abde9", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495272, "uuid": "6fb7542d-e692-4692-b25d-83c711965e74", "comment": "Malware payload (Gafgyt)", "value": "58f9a53a0e8b53634de5cee9948c4aa49478f35c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495272, "uuid": "61b024db-5269-4e31-bd8f-af0290577a85", "comment": "Malware payload (Gafgyt)", "value": "15f8adc2ac07b5f69f48f5c3bf4544166fbd36efecda46610d48ff2bc6b566eccf59182831b0e90a32fabe73563706e8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495272, "uuid": "011329c3-e41b-47ab-be49-cb0992e04b76", "value": "T151631B07BA428BAFC14FC1F407F76A399922BD7E0A36F1E5E3A4FD861901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495272, "uuid": "c07d818a-965c-4fdf-b436-d1565f5bf650", "value": "1536:GnHkHRxHBFPSWGzIGWlGy5TGpWE7wH9OXEL9q8:mHkHvBFVGzIKytJE7wwXEc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495272, "uuid": "3a52ddc3-08a9-4aa1-ba70-cc5d9f2ec5ad", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495272, "uuid": "34aa38d6-d632-4774-8aa1-a57c0928578e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495272, "uuid": "ba2957a0-671d-48fd-a11f-4e49d53139ff", "value": "night.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aec9788-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455638, "uuid": "0dddd42f-22ff-4ffc-b0a3-3cc89b5fe3ce", "comment": "Malware payload", "value": "54b5cd3d69d5a10c455437e2ee18e26a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455638, "uuid": "2fde77e8-5748-4c53-94e9-3f51cbf8114a", "comment": "Malware payload", "value": "5b5b6ad7a76064789afe0bec980115a9e3620529be0b2e754d557b577371a352", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455638, "uuid": "dd1a9170-4b7a-4d78-9477-699eda046318", "comment": "Malware payload", "value": "bfc802475bc0c7957151146668ad2d34171aa167", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455638, "uuid": "42543942-8ed0-4a17-a0f2-0e2d1971b058", "comment": "Malware payload", "value": "fb9019007d1ca00b683fc98d2ab3e7f913f3705fece0bc4d52dd21a2e9a3a1e61cd81a826dc4dfede3fef80bb7038370", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455638, "uuid": "3a5805fc-5f9d-4981-aa2f-c7763ac9fd5d", "value": "T19C27235286688D7FDE147DB8103F4E8E2CA44FD1199DD7A6233B700A6C8BF29512AD7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455638, "uuid": "e10d4ba3-ea7d-4098-8c95-9b45717f8bd3", "value": "49152:z3zz3zi3z53zK3zq3zE3zH3zK3z33zd3zg3z6kxBet3zg3z03zX3z/3zAkxBe83i:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455638, "uuid": "0c9cff35-998a-482a-9fc1-5609f2ecbd83", "value": 22123547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455638, "uuid": "b934c0db-d7ab-499d-8986-eeb02dd7fe72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455638, "uuid": "94a7561e-5cb8-469f-8033-02fd2ca0d570", "value": "invoice-1645080830.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76606553-4412-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777498151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498151, "uuid": "f41071fc-5e69-4570-be27-08d57dcbed23", "comment": "Malware payload", "value": "af8e47ee4485e8efab4fc1b5cee65728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498151, "uuid": "b15ef072-191f-48d9-9d83-c4e208c9665a", "comment": "Malware payload", "value": "5cb7c24c69b0cfebd65d4587f7f4d62a2a4c57a362c2ab7dd18ecf8fb628037a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498151, "uuid": "a189f6a9-0b0a-47e8-97d2-768cf01a122d", "comment": "Malware payload", "value": "ebb6d97fc750c904243963dff26b544b2ab76d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498151, "uuid": "dcfcbb39-0557-47e2-adb8-656686f405f6", "comment": "Malware payload", "value": "884b1210ef30f305043fb6afeebe251ec0e5a2bb8df502cb86d1a702f2c94c8acfcbfb74af5915c926b8b6305b43a878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498151, "uuid": "2d72fa3c-6f6b-4e6a-b2ae-6154fae20b2c", "value": "T1FE064C31324AC52FD96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498151, "uuid": "a947fa33-e6d7-4c2d-805b-02a3c0f4e374", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498151, "uuid": "df06993e-96aa-4501-b7ef-9b8c6d061b69", "value": "49152:xWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5w0UPAELcpB2MpF8h:xr99u4kc8Hao8eRjYBU4UAir2Y59UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777498151, "uuid": "b12ea3d5-2d57-443e-9900-90aec44cef4a", "value": 3690980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777498151, "uuid": "69b3f305-44de-4575-b9d7-884585f46d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498151, "uuid": "0eb504a6-fbd3-461d-8de4-743f5091b731", "value": "mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe94d2e8-43a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451564, "uuid": "230bb549-55dd-4815-af7f-3e3672f37e50", "comment": "Malware payload (Mirai)", "value": "25e95e60a5619b5a249602091d689518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451564, "uuid": "cbe3c3e6-d21b-4df5-b6ae-8db6128c7fbb", "comment": "Malware payload (Mirai)", "value": "5ce683e9e56ea1c83d8c5b7aea13cee47baf95b8181437e077b1bb187391811c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451564, "uuid": "2485c570-ff51-4c7a-a8e2-99c970ae914b", "comment": "Malware payload (Mirai)", "value": "68c66880fcb20e152ac8a4d1add89fb901687eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451564, "uuid": "84c136a3-df5f-4c56-ab59-1b2914b416ad", "comment": "Malware payload (Mirai)", "value": "6e7b628bdf51d73d01a1488159192fa787d8c8b7e1b49aa29c02f01b556cebbabedbb5f4033bf4334c00ed6992d7dbd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451564, "uuid": "fc256e05-4660-46b3-8985-bd1a44d3fee9", "value": "T1E3E2F102E485ACB4B2708A3DD574474567BA9A7CA7633453B378C2E0BEC159908F8BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451564, "uuid": "cce3cba5-4c14-4889-b1e7-7a2d1d41953d", "value": "768:Yd0+UIg9olTHL+UTfHDWDEBziyx1SOFZfo/Ne4ZJk7JJs3Uoz7:YdII1THL+UziIzrnZuNJJgUz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451564, "uuid": "cc6491c8-8ef9-4472-8558-b913858c8c0f", "value": 31224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451564, "uuid": "a13a0971-ca9d-4341-bb95-1774592f8c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451564, "uuid": "26173a2c-fbef-45e3-8c00-fcfb0c981f96", "value": "asuna.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cbec33-4398-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445560, "uuid": "0bec4556-99ce-4d9d-9769-805914e9ed56", "comment": "Malware payload (Mirai)", "value": "63e9342a115523bf91ce4eddc0660a1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445560, "uuid": "e2fc62d7-3297-4106-b7f1-3d173ca83ff5", "comment": "Malware payload (Mirai)", "value": "5d1ffdc806fb297f520e8e52e20ac3e318831c39b58e9244667d4b8529684c83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445560, "uuid": "5051d8dc-3ae3-46a2-b5b1-faf0b82280e3", "comment": "Malware payload (Mirai)", "value": "71de3875ae87160d89e438e09e22909592a545c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445560, "uuid": "4b94ccd2-691b-4071-a4f3-bbfe8210d7ed", "comment": "Malware payload (Mirai)", "value": "40956ca4a5ec7e229fe0f5be76b18649e8dd850f9148ed478ccee1a3039023ad305ff97af3a2294a29c15349f56c59c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445560, "uuid": "aeb5284a-c9bf-4523-a3c1-383126a8bb46", "value": "T16F73EA92BD028F03C6C321B7FBAE425C77176769E6FA3143EA25BF6027875C60D2A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445560, "uuid": "e8a1af4a-7919-4c10-ba49-e418743baf87", "value": "1536:sXTprD2qcwpLwx5wOIw0sgGI2EniD4UjvcWQf7sL:CTxncwyxPP32yssL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445560, "uuid": "a78bb709-e9e0-4241-9576-7e39cc49ecd1", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445560, "uuid": "6354b885-aa99-487a-92dc-e0c02071e9e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445560, "uuid": "1d026497-6fdd-42ee-854b-97e167ea9dc0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baeb1ae-4396-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777444714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444714, "uuid": "a9fe078b-e7ce-44ce-8d89-a051c0d791c3", "comment": "Malware payload (Mirai)", "value": "891a7b4acbb2566a64d6f1ec3a6ca769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444714, "uuid": "fe779192-9a33-4841-b19e-a53ba5e6fd14", "comment": "Malware payload (Mirai)", "value": "5d753b3c70460e167c61fca8253e0c4c676818c012d6d53ccebb926cf7cf4f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444714, "uuid": "78387e6d-3ffd-46df-bf42-57b0d1b68196", "comment": "Malware payload (Mirai)", "value": "b8d02c71643cf6350ac708fdb58e56c4acc62f71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444714, "uuid": "e6c9c8f3-bc65-40e7-a376-9eb6c35b5d81", "comment": "Malware payload (Mirai)", "value": "5361c3446e45c71596b869d95d15fb08cc7c27a2859ba8d4213c8d39eaee6351723f1ba9a218a08075b75888d12d9e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444714, "uuid": "83b1f776-e5e0-4cd8-b365-e812181d02b2", "value": "T106C35C46FA418F13C0D61779B6EF424A3322A791A3DB73069A245FB43F8679F0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444714, "uuid": "25182cbe-41c6-464b-b11e-53732aa86882", "value": "3072:OgkqVl9r5NbyKg1styKUulTJz2olrRC5M/9g+U0ik:OgkqVl9r5NHg1styKNlTh/lrR4M/93UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444714, "uuid": "3682d48d-8695-4ff2-a0d3-ff00e7445630", "value": 129860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444714, "uuid": "932e3157-14d9-4773-a159-b642b13b0792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444714, "uuid": "cfdf23ed-7353-4c5f-bdf7-0cdc9c7031cc", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c09a7dd-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451640, "uuid": "17a0a779-8b4b-426e-930a-d2c65ded950e", "comment": "Malware payload (Mirai)", "value": "4bbb6825caade8f713f798c4dcc377a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451640, "uuid": "4f89e359-fd72-4a4f-98c8-7563a4684fc3", "comment": "Malware payload (Mirai)", "value": "5e44e14fc012b3b54c16d4af77b92d235b415e7de5704fa648c099c5d7172f2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451640, "uuid": "8c6ce41a-e003-4406-8109-47d1db830cbb", "comment": "Malware payload (Mirai)", "value": "4587920fe4be6fcd0ea1f0eb75498778666343f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451640, "uuid": "bec2cec2-6ea5-4751-8f39-0f2147a77b9c", "comment": "Malware payload (Mirai)", "value": "17210447a553af670dd843470c107c6432d1f8ce5c2cb07ea7bdfb9821267cc2dceb3c0d1fccc812094b8dc5d046438f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451640, "uuid": "9ef32bcd-026b-428d-aff4-78c0b2b6a966", "value": "T1F483931A7E324FBDFAED423447B78E11964923DA27E1D585E1ACDA002E7024E241FFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451640, "uuid": "631f48c4-8cc0-477e-8b83-c180c14da558", "value": "1536:+oCZed4WgGgoPMXck6DN7ikwDieaVwsEe:p661PDN7ikwDpsEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451640, "uuid": "1b8deba6-4d3f-48d8-b274-61f567c0912f", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451640, "uuid": "534a6075-8a5f-4e7e-a81b-b6959630181c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451640, "uuid": "7804fd53-eb08-4910-b237-b190783592f0", "value": "asuna.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de23469-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494647, "uuid": "9345881c-24c3-4985-a554-069aa972e3e4", "comment": "Malware payload (Mirai)", "value": "26c32c2ed8d68861caf5baeae6771d1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494647, "uuid": "c76cf1f5-a8f8-433f-9b72-47deede5f9cf", "comment": "Malware payload (Mirai)", "value": "5e9811143be67eb035a3363bca5584600e75f10a4cc591f0ef6fe73308ece8f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494647, "uuid": "d66e7e65-8c24-442e-a682-2d8b54e65ea7", "comment": "Malware payload (Mirai)", "value": "4a02acad7b4109c2db78508f9724371973a8b06e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494647, "uuid": "c1df2f66-6d43-44a8-a750-53cd1a4b85d1", "comment": "Malware payload (Mirai)", "value": "1f82ac9c15d619ec48e884b23602e9497ecf08020175c83adadaee0326854129b290af493b7d5225077a74fdf87dab31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494647, "uuid": "17c656c1-5fe3-4be7-afce-c62cde3f1254", "value": "T1BE733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494647, "uuid": "f6c3f4b2-724d-4773-86e1-4afc69619d48", "value": "1536:+pwtq/0FORx0SFXyRwBjniiQv1MjDPKM2nu7c+GYgKCqWU3cgij:+pv0QRxJcScv6fSMrjGYgKMEnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494647, "uuid": "058f1e12-8cd5-4fda-843e-56b6059c8d02", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494647, "uuid": "163d86c3-6d32-42ee-806c-eba13cc0c653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494647, "uuid": "924968e2-9ec7-46b0-b409-bd23133e8117", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1d0bc7-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464149, "uuid": "1b90c53a-4536-443d-a347-c81d91aff11e", "comment": "Malware payload (Mirai)", "value": "09fa1b752cca7bbe1b92e3be6b8da973", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464149, "uuid": "44122d0d-87e3-403c-8440-69365ef836fd", "comment": "Malware payload (Mirai)", "value": "5f2af8fe6641ab11ee66d7842739e5dfe5d749c0cc43a9e8cc1fa7e315acdd8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464149, "uuid": "168f557a-134a-41cd-af04-656bae3952a4", "comment": "Malware payload (Mirai)", "value": "9a26669d327876d06dac2ebf32a9c6817f6fee72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464149, "uuid": "97c3f369-3d2f-4dac-b4d4-88062026983b", "comment": "Malware payload (Mirai)", "value": "798d48f46548518d1c61d1c8a1d79ac9295ef1572ff2d2a01660a75853cf1425759c8ce148a973f07a28b557a32a0704", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464149, "uuid": "0bc960ad-48c4-4af7-b7e2-7534639607c4", "value": "T11E255B46FF1C4523D9531DF01A7F43D9F3207A4340F5922A670E6B572622E3AAAD738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464149, "uuid": "b8cc27c0-6ec4-4ba2-bebd-abb86b8a9459", "value": "24576:vCVTlJsVPW3kZU86R06r00WJCPPSfXaTSsUB81JHD:vCVpJsVPW3kZ7I0W03CifXaTk81VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464149, "uuid": "72e1c8d4-36ad-4e2f-8825-e481e276f6ca", "value": 989508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464149, "uuid": "1fb166d1-8dfa-48e6-bed2-94db358bc986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464149, "uuid": "bc54e7d0-3a39-4a37-89c0-456dd528a81b", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4acfa8-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451619, "uuid": "b07bd323-688e-42fe-8440-14d103968d26", "comment": "Malware payload (Mirai)", "value": "e0528e1dedff014166a1d28b5baa2f99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451619, "uuid": "84899735-bcf9-4f36-a2ed-247f321656aa", "comment": "Malware payload (Mirai)", "value": "5f6b8752c7d16bd6beb5a434b3b9b5e1f261e89a19875b863c5f7668dcdd7aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451619, "uuid": "32572592-7b54-488c-80db-9aa17d9a191c", "comment": "Malware payload (Mirai)", "value": "0d0305c50ac2ddc28ee088eac9288c78504b799a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451619, "uuid": "feccdf17-4b6a-4f7b-8950-e188e21d3fc0", "comment": "Malware payload (Mirai)", "value": "375f87185b9f496de4dbe0fa85f71a0fe3c6e24b524977a65b3731aee63c40649413d1f516f99bd4aae7dd5c918cc38f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451619, "uuid": "885467af-58f0-425a-bb7b-f27053e60316", "value": "T1A7631A56FD819A12C5C502B6FB5E168D3B2213F8E2DA3303EE259F6137C692E0D3AD54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451619, "uuid": "efe298ee-b8fd-40c8-b052-4682a57ebd4f", "value": "768:ITwotm54NOuZ9nCXnFlFu77y/OIHCks9d7JHRzTx3MA5J2lPZHVjCDvl9UeBAd2a:yDtZ3ZJ8FyZZzS2CXClohbrcBmlAvhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451619, "uuid": "c145175e-ea58-4ee7-bd69-017af404f4b6", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451619, "uuid": "a60f4dac-530d-46b5-b5ce-df8ced3e75ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451619, "uuid": "75b1da87-63d9-4a56-bb65-6ce9d558a511", "value": "asuna.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5f18a3-4416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777499723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499723, "uuid": "c392c8ee-485c-46d9-995e-e7823bf5d1be", "comment": "Malware payload (Mirai)", "value": "91b9ef36703d674c56d28dc53b06b8a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499723, "uuid": "28d9f14f-8063-4953-874c-686bf5af89f2", "comment": "Malware payload (Mirai)", "value": "5fa602bdd9f6156629e7b8ef4ac87b7c3f903a812ec63e7988fb343cfa36bc89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499723, "uuid": "65fb8334-7b61-417d-80cf-1f46f8cf2b32", "comment": "Malware payload (Mirai)", "value": "146a489133f8d55167dd789142b3b257c697d6c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499723, "uuid": "a4043635-8cca-40f1-9207-d6eed0fd7125", "comment": "Malware payload (Mirai)", "value": "e56721731842b9946d7feb78e5efe3db708fca9a9bf99479a5246dd4c8cde744693a403557545b92ee8cbdbc5b771eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499723, "uuid": "faa2e036-713c-4033-a4ca-022a4b84d2c5", "value": "T134B30946A9429B12D5C631FAFBAF414933136FB8E3FA7111D9205F6023C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499723, "uuid": "605a55c2-5bcb-44f7-890c-ed3874dad62b", "value": "3072:+s+2xqV2gOxnvfGK6EjS9LxZ2gaOl7xVjhCX699fJ0Q0g6mzkRf:+s+pSRveK6EjSlxQgaOl7xVIX6fH0iQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499723, "uuid": "5042b1f3-aa61-4c14-8011-b1065648d5a0", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499723, "uuid": "3ce14b0f-d6af-4335-949c-f36d6ebebf94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499723, "uuid": "88accab6-b9e3-41a4-aed7-3f3af1ebbdc7", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e8301e-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479819, "uuid": "2a1ab247-e57f-449f-af16-e4f0610aa5fc", "comment": "Malware payload", "value": "c74eed35fb6a38576559dc9f63fedf48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479819, "uuid": "b23c8fbe-ce21-43db-8ab7-a0c7e84dd38d", "comment": "Malware payload", "value": "60947257556b6e3e1e67b77627e77209f500332021531622e88fc754f9cbecde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479819, "uuid": "4dd628c6-927b-42bb-8d05-b3471446fd9b", "comment": "Malware payload", "value": "02ac0c9234836dc303fad5aab9f1fad345bc48c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479819, "uuid": "aafd238b-394e-4f6f-a1ec-e7de7a999533", "comment": "Malware payload", "value": "63e810e8eb27262499bc82941f804aa6ba7a32265c4c87ef5947f900c07d56fa3d64228a87750dc595edc47091553a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479819, "uuid": "15b49bd7-6da8-4788-841e-b76a10595dc7", "value": "T1F3E42ABE9C60B326F60CD0BAE146D7538F2138411236B9A319BE93241245972DF677FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479819, "uuid": "cd4c1469-4457-4276-a923-04925c4c05c4", "value": "9a87247ef695d21e144056c4f4703061", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479819, "uuid": "ab5d155c-1bfb-4f69-9559-ef4b081b6edb", "value": "12288:jQYyhKHH6MCmgWeh94xDx31qZ7gzt6KdtFT+MRmYo:sY0oH3gWca2Z0zvdtN+Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479819, "uuid": "0013637f-087a-43ba-9656-6b2e0b12b1f1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479819, "uuid": "a8c60640-e638-4a29-99e7-ac247346742f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479819, "uuid": "48cc3150-3a39-44b3-ad17-33125870d1ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0ff9e3-43eb-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777481307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481307, "uuid": "066cfd73-52de-4035-936e-afb4a86dfde1", "comment": "Malware payload (RustyStealer)", "value": "8fa5ca244f9c7f58250eab769a838fcf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481307, "uuid": "517ebd10-62e4-4841-a4f5-bbd0d9e8e061", "comment": "Malware payload (RustyStealer)", "value": "60d66fae1db934e7611163342c01806949710f1a708739caa028ad6de03bbfc5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481307, "uuid": "1ae48985-0a51-492e-92ca-6dba200e85fc", "comment": "Malware payload (RustyStealer)", "value": "0fc9d5a9839ed086395b382a6432f7ef46cbcf7b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481307, "uuid": "55af751b-b9ea-47ee-a62c-84e61d4ed273", "comment": "Malware payload (RustyStealer)", "value": "75e281fd6d49a47e0a1eca6958119d1bb13713262427bebf8abec84f8fe474fcbe0bbba71d263842e3d9ad3b4fdf7b8d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false }, { "name": "not-RustyStealer", "colour": "#B1E8C0", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481307, "uuid": "22be5c4f-0e44-4eda-acf5-7a4fc6433bb0", "value": "T1BCE67B43BB02A0FBC5875270F10DA77D9A36960867258ED782E0AD7C5DA5BD12D33B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481307, "uuid": "95a0fcf3-b0f1-4f7f-a1e7-a056d1ff608c", "value": "297d6e0900a665aae36d2a7d17b33c4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481307, "uuid": "fe85b9e0-fe8e-4a76-ac91-4d0d2324f74a", "value": "393216:6bTgEnZNXZkH3HDUGDorvbiVrUCvSNDa+gQ03j+n/0U0gObkCc8vPYRY4Y4d9d9I:mhFK+Z/8aqxNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481307, "uuid": "7aa644ab-dc4d-4d8d-8c2a-479c87b9eda0", "value": 14937960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481307, "uuid": "eaa2dc8c-ca6e-4077-a993-e6f62fd4bb02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481307, "uuid": "6196c9ee-7229-4842-b496-5572460acb9a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469a30b3-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470583, "uuid": "fd367f9e-e17e-413f-8bb2-6fdee512bca2", "comment": "Malware payload (Mirai)", "value": "eb16258b8706c3e6cdd099828cd17eb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470583, "uuid": "07638ada-1074-4786-b140-09b94cdec4ed", "comment": "Malware payload (Mirai)", "value": "613738beb0b33e135ea3f690627a09681d94ba50aeaeff69bcca5f6e0d680be5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470583, "uuid": "8978057c-a944-4237-a10a-528ac2ab5f1f", "comment": "Malware payload (Mirai)", "value": "56b45ba408c47905f23551b41d58b334ce3a7a52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470583, "uuid": "36afc955-379f-4424-b295-b266b870f7e6", "comment": "Malware payload (Mirai)", "value": "a3e2a5f3bf9fc17c09e23b81e66f737fc009da35888145f1d2bd9a8876787a1a1c1d160ad30d6f3298e8ed25dc636ce6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470583, "uuid": "4346b9cc-f00d-467a-a41b-f6c0fc73a9ae", "value": "T104932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470583, "uuid": "1a46a3ae-dd91-42a3-a268-87cacd8fa26d", "value": "1536:NJaUfdQD/bb2sJhI3eQYmUC3100x7u/oVLuAasx7rI:NJNYn26hIr6kpYApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470583, "uuid": "4fa90c8a-43a3-4db4-8304-8ee7ccfe562e", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470583, "uuid": "cf699a33-5389-4dca-992c-47016294eb06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470583, "uuid": "d48218fb-19af-456a-b373-283d4495864f", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a020e0-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494792, "uuid": "e85d38b1-0200-4017-b389-7536507b6c1f", "comment": "Malware payload (Mirai)", "value": "10559a72e86eff8094518d7240af0afd", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494792, "uuid": "e1df56d9-f3d3-4e33-9a26-115315e838f4", "comment": "Malware payload (Mirai)", "value": "615dddd265eb5e1f453e4e7e0a1682ff9df92774437e10996951448daccdba4b", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494792, "uuid": "7902fa0b-97c6-43e8-8989-1f0e2efed3b3", "comment": "Malware payload (Mirai)", "value": "8464bfcf074bd649761a4c0c21eeb5452a981abf", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494792, "uuid": "1b52094b-1fcc-4a75-8836-767c6543a8c1", "comment": "Malware payload (Mirai)", "value": "4d2e43e5118b900702fe439eab033e250d0d5c155242cedab08287b59baf85dae32b7ba2e6d251695680e86459ee0616", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494792, "uuid": "73bd0029-735d-4fc9-b6c8-95fcecb05a45", "value": "T11AF2F2A7B0F19F6BD85913381ADFBA033A20D16DF2498BF5A615303D46C6F446D4C385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494792, "uuid": "6bb5f259-9e8d-4d1c-97cb-bc7bce8f1e8c", "value": "768:XpMicb24UiZQb2Cb/fH410Dj5DAaAv3z6iJBa4uFo24HVnbcuyD7U9Ucl:ZK24UkQb2CbY1kj5caAfzbV2+Vnouy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494792, "uuid": "3c4fe7d5-5b83-4be7-b6c3-1a6178ea9474", "value": 35540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494792, "uuid": "ab7a9287-dcb2-4d63-b137-e4be244be5c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494792, "uuid": "00def30d-1377-41cb-8433-42fd40be9c0a", "value": "rage.x86_686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9abcde4-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494854, "uuid": "074bf822-657d-4cc5-a4e5-f0c575514304", "comment": "Malware payload (Mirai)", "value": "2b0f73c90efb0d86d6f0edd655268174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494854, "uuid": "1b6cb663-772a-4107-a816-2804e327660f", "comment": "Malware payload (Mirai)", "value": "6204f9294973e31b73c2cfa64f2f0c0ca70ecc317f619fa016f42d81001db3c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494854, "uuid": "015bfd78-884a-4f8f-a9ae-fad972f29afa", "comment": "Malware payload (Mirai)", "value": "3fd7b8cd6261f02991ec65751d53b0728c63ae90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494854, "uuid": "3e725fab-07ac-4d39-9bcf-fe08cfeb01e3", "comment": "Malware payload (Mirai)", "value": "853cb85605d00ca28a1cecde9fb514754d9ba84fda0100f86c2f63a85a4cc8779dc990c51f2f8362b365a0b6f7f185ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494854, "uuid": "d1e3c444-aedd-4918-a00a-bf786b18dafc", "value": "T118C34C17F1D090FEC8DAC2B48FEAE127D973B4295234B21A27C8AA671E4DF215F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494854, "uuid": "431e3c68-2ee7-415f-81ed-837e506eb9d4", "value": "3072:GEGvS11+Os601ImreihZ/SgbAreOyrC/h:GEsBImhhS1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494854, "uuid": "a38d7d23-5472-410a-aef1-2668eab2512a", "value": 122888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494854, "uuid": "9b3d7bda-27de-480d-a014-243bf566cd32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494854, "uuid": "f933c419-7a99-49ee-9c77-375d2cb1cf19", "value": "rage.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a0b8d2-43fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777489420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489420, "uuid": "48af9e40-d4a5-47a6-94c5-9ddd2af5bf29", "comment": "Malware payload", "value": "b6c4fa2a81d5cc5ee640e9aa414574d9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489420, "uuid": "f2e9f85d-6508-44a1-ae22-cd3e1a1a7a8b", "comment": "Malware payload", "value": "6216f37739c4b38b05ef6785ed4cccc516fa3f594b41687b50c2d1712ddc4d30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489420, "uuid": "ed183c05-c592-4ea6-b121-faf6c3ea80fb", "comment": "Malware payload", "value": "e826fb70643a8bc9a3fd9a48433027089c473434", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489420, "uuid": "1ec12cc4-901a-41e2-af5d-d8f003bd3b0d", "comment": "Malware payload", "value": "3a0dfa3e083bf1a4274b2c6eb2c824da341e1df76ae4066c36abcbad25435427594b48e4ed60b1fa1bd04bc946cf5c04", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489420, "uuid": "82b13e2c-a297-40b8-acd8-0e9d0aa7ae73", "value": "T1FA9733A3C4322E47FD3FC537D97695AD826290BA9D97C02D692033B716EB3F99964003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489420, "uuid": "addc53ed-3341-4c14-b6a7-4909214fc1ac", "value": "786432:C1z9CDkL07I6LmZgrIlMftsOetuwqDasGC4p+iPFjd+gWjoOkoAvPGwicl47JMJP:C1z9ckLFzZ8IlMftugKC4N9j8gWjYMs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777489420, "uuid": "1862f84b-112b-40c1-8cad-b4a777911e0a", "value": 41681701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777489420, "uuid": "4c52874b-4343-4f06-bb84-7690ba503eb0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489420, "uuid": "5bb31f6e-ee22-49ef-8d27-853900026580", "value": "Spectra_Menu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaa2520-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440342, "uuid": "e6ce86a9-22c3-48bc-b486-464a7a599f4c", "comment": "Malware payload (Mirai)", "value": "ffacf0e8e63fcb49d1220b1b2278d452", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440342, "uuid": "8fd85793-fbbb-44b1-bb00-1dd24526f8ef", "comment": "Malware payload (Mirai)", "value": "622dbb5b8afb70ca2d7737cc3a78591030225088b88d13fbb77fd3d02f7d30ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440342, "uuid": "a90069be-c064-461e-9e39-b08003d9afbf", "comment": "Malware payload (Mirai)", "value": "113142c56bc2e2129c04f20a9e8b8cb21bbda474", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440342, "uuid": "51ab80f8-0351-49b5-a792-992d6843198e", "comment": "Malware payload (Mirai)", "value": "12d539a536b9a7f0925ab7352a1ec7bc60acaf25652665a19ecda437b07712506787c2d34773bd41ef72e88e8c01b0e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440342, "uuid": "fc11a9c8-f9af-4f6e-8e79-452e5e70be50", "value": "T1F814C91A3A228FEFF16D867107F74930976976D617E29684E36CD5102F203CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440342, "uuid": "d9b298ff-4424-4c94-aaf6-6ce87dfbf03f", "value": "6144:N1EAjANl04cIORxLllpggrtCtBYP8nYtjy0WI:7AN2dllpggrtCtBYP8nYtjy0WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440342, "uuid": "d758f826-6514-436d-842a-ccf41cd4a7c0", "value": 202203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440342, "uuid": "a66ddcc1-3cab-4fe4-9db2-b7a777232ecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440342, "uuid": "3299fe86-6090-48eb-8800-c800a766ee83", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d81599e-43f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487237, "uuid": "5b821c80-65d9-41ff-9802-be161743a4db", "comment": "Malware payload", "value": "711f4847f6b589a53e9b4e8a4383307d", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487237, "uuid": "50bc54e9-7f80-47d8-8a25-a5a2eb08f76b", "comment": "Malware payload", "value": "62728b506804574c9745049db8687594daaa89fd540503bb4f5b0ccc3fc019d4", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487237, "uuid": "5c0f7660-fe5a-4dd5-b61a-7810ea05e13a", "comment": "Malware payload", "value": "d1fae509953868f91f6dd58a9ccd799087463d23", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487237, "uuid": "19a3ffad-d439-45b8-bf34-b39c33ec495a", "comment": "Malware payload", "value": "35aabe99a60e05978cae4bf20dfa15dbc283e45a09363c3614f2396e9a37d6280378b872a884ff142d1a31d200226900", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487237, "uuid": "9bb00f95-73c8-4b6a-bde3-e9792a0c2ec9", "value": "T137279D47ECA145E4C0AA9135CA669267BB717C884F3163C72F90F7282F32BD0AE79751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487237, "uuid": "e5c10ded-add3-4573-96c7-bb165ab80586", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487237, "uuid": "8c3ccae0-20cf-446b-b26c-315b1365958d", "value": "196608:1TphRkpVIy8I2kwQboUVhcmNUJB0HXZQZ/DSkmLauVYk5sylzPhE2eRalQHlCNRP:1Tph6pH92xwZZSjZ/DKuoYczheGG9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487237, "uuid": "8f91beec-d867-4986-b66e-aae68d73e28f", "value": 20539392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487237, "uuid": "9ce69794-8a34-4840-b1f0-dab4b5fbe952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487237, "uuid": "971b9a1c-496b-4765-a221-f03191b55c81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b351c53-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494642, "uuid": "d33229c4-4059-4d7c-b52d-3508d1b81e8e", "comment": "Malware payload (Mirai)", "value": "9277c1483eee04366d1e92b8667d4915", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494642, "uuid": "b030c8d9-1253-4125-85af-223d261ca872", "comment": "Malware payload (Mirai)", "value": "630dcd5f3802e290fe3dd7a89c43af3e23e5dd0e8d557e28c7a76854799ebb91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494642, "uuid": "00818742-1580-4a64-8e7e-78b53f1aae4e", "comment": "Malware payload (Mirai)", "value": "47005bcd9d5e8b05c69f3660dd82e18eeb114449", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494642, "uuid": "5cd6a724-3583-4255-8bec-30786b412c71", "comment": "Malware payload (Mirai)", "value": "c0ad5e7c3f067fc051e35995a4a1e143ec99a81b25c25b45bdd682e5aebd00bf0036e9f0e13bec963d49d41ddc1b347e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494642, "uuid": "9241d216-753f-45f6-a17a-a9c06008e023", "value": "T197730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494642, "uuid": "400a3523-0227-456a-b2f1-90bd5da24b0a", "value": "1536:RcK8MffyU5RL+r9RS3TlUgf/wSBO7kVgu3Urpbr5ag1416mEv6+8H:RcHCfyU5MuTlUgnw/Ygu3Spbr4q4HDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494642, "uuid": "494f0908-8b1e-49a4-b502-8be7c75b7d51", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494642, "uuid": "6f8a0a60-bc36-442f-bed4-b7d474ce83aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494642, "uuid": "6020ab69-de7c-409f-83da-8f722609ad10", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e213ef2-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "4ae5db24-2abf-4fd3-b150-8f36c43a7f9a", "comment": "Malware payload (Mirai)", "value": "fb4ef02d9d6914156d57e11c882cb52a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "1ccc2f85-fab0-4929-bef2-dc8477c6a525", "comment": "Malware payload (Mirai)", "value": "647fd15c769c505bb5108d67c746891c4e16a56515e88a8af82738ee51b5a2d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "516157f2-ad45-4b93-91b8-d060e33b7f05", "comment": "Malware payload (Mirai)", "value": "079ad0c7e120af4be5c33524453c6c0e114c29ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464153, "uuid": "ca11bbfc-1b52-4984-8cc8-8e4f46b038a3", "comment": "Malware payload (Mirai)", "value": "a6e66e0c0198032d290ad9af25607c5cd682a104b2d23847cab179bc493f89f0400cc5d63c69317c53729ed4100a20c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "e11d335c-ef39-465c-afa8-91494215b0cb", "value": "T11AD4BE93F261DECBD11A4FB8003EE330874AE5A21333B580F67A83651D635A5FE587A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "0f3a3563-8e4a-4c53-a136-ab8080a5e867", "value": "12288:ttHFl1iLGXadKzGXzZNpO8ePlDvq5+VuNpxvb8pGjOmuH8b9l:tradYG7veP1ypbOz8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464153, "uuid": "f407f713-b254-4661-85fc-b174795b78b6", "value": 649516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464153, "uuid": "c9eb8ce6-497a-4e15-9329-50bb127702ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464153, "uuid": "fd8bcfba-b503-459b-8ff7-4dba3e190d8f", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063b0f0e-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451577, "uuid": "9bc28853-4c65-49cb-961c-eaa992722986", "comment": "Malware payload (Mirai)", "value": "7b64605870f43896748b19d908b7b158", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451577, "uuid": "0d7c9b2f-ed97-4939-809b-5f2380ee9a30", "comment": "Malware payload (Mirai)", "value": "64ae5db068e064c0403bcfebf3c6da642064afb1fa6c0b6a7c34cf368cd56ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451577, "uuid": "2eb58787-1c88-4f18-94b4-f04b44c22de9", "comment": "Malware payload (Mirai)", "value": "b3ac46bb42f018695e360b3b7be454a68d317bc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451577, "uuid": "bab86f96-c89f-47a9-8955-3bd5ac085b17", "comment": "Malware payload (Mirai)", "value": "de29502534a13a8397cb40c8631a34f7dd11f4dc72c4aee1a2a41e8a310b70c6a9daca914b3263c49d685889a1f8a0e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451577, "uuid": "3a6c9e9e-b311-47c4-a9b5-28409f1cdd7c", "value": "T1DC6329DAF800DD7DF80ED6B70417090AFA71A3E146430A32776BBDA7BDB20A55826DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451577, "uuid": "365044bb-042f-4bbb-9481-b9ee867c4336", "value": "1536:mETrSnd45Tm68satWN5/Jt1Fe9GrgjGFHU0y:HrSnd0TmHtqtPeInU0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451577, "uuid": "95749ca1-f1d1-4f4a-99f7-4336e8940682", "value": 72876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451577, "uuid": "038445a1-0c8d-4bca-842a-d36978e77bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451577, "uuid": "721fd650-edaf-4980-91c1-c14eae2a9d3a", "value": "asuna.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4379ee27-4425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777506226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506226, "uuid": "8fde39f7-2594-46ae-a56d-4b8cfc352df1", "comment": "Malware payload", "value": "bc5a1b30bc88eb7893e9be6d1390d182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506226, "uuid": "73107e01-333e-4a31-8434-d94405c60441", "comment": "Malware payload", "value": "64b03a9fbd71274f8130bba25069d65ccc8befcd5d95976323ed29b5a2cc7fd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506226, "uuid": "258cc855-fb08-4ee1-b8f6-8679f9b0346f", "comment": "Malware payload", "value": "6895153da8ea033fea0c267625721db4f716273b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506226, "uuid": "9daededc-e64d-4a04-8585-b06bd32b83b7", "comment": "Malware payload", "value": "0e9b214cdef755ebec120c6067434d5586f904a7d1d62cfa3abb8d8032d9e9698f28bb7187781e9f3bebdbd8b1bec6d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506226, "uuid": "de27d495-cc35-4c67-8f10-a02ca1bcfbfb", "value": "T10416095BB8914682C0E4367ABC7E41C432A70FBD9B9B126B6D05FE3C3ABE1990D35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506226, "uuid": "f260f3d9-19bc-42ee-8c70-5febe12c7fe7", "value": "24576:hmQTXL0BGdDLpzRLMwu+t/uvxe0Bg0iKB2XjLWFbFTnJ0+rkHyLaW8tL8XPqdZtc:gwFkWZVtzES3GtHqnAaVfuyf8oZD11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777506226, "uuid": "1fbd5629-4e48-4e94-8625-3ff98d126bef", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777506226, "uuid": "2c03c035-c7d8-4836-99f3-0960982c1ac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506226, "uuid": "c440f248-78d0-4595-87f1-a9796ff29d46", "value": "SecuriteInfo.com.ELF.Agent-EHC.45113933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb085e-43c6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777465647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465647, "uuid": "05a4616d-1f82-4618-b42c-893538adea76", "comment": "Malware payload (AsyncRAT)", "value": "8c552d3c27940848a460e6096883958e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465647, "uuid": "9d94ca75-c08d-4556-a400-5ebd17f26e12", "comment": "Malware payload (AsyncRAT)", "value": "65471e745397e92b3dd2ab9778cbd9c4c0f1471f9075c5860c9004a61ebd6a00", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465647, "uuid": "e1cd6538-e38b-4edf-b145-37ad3d92da40", "comment": "Malware payload (AsyncRAT)", "value": "8d178c52de9bc046c20e5e90f53d434747232122", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465647, "uuid": "cd93e341-9bea-4b11-8dc7-b4b2d16e015b", "comment": "Malware payload (AsyncRAT)", "value": "c1d55bffb22f5c8bc482b190a4d8951a87e9430f7963ebd0f9bba87f39f49d28764d088dcc11cf1380e78e92dd09f047", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465647, "uuid": "44a372ae-18fd-4245-9f40-46b41c50ff37", "value": "T11C15F11066C03FA8978F1B2990BF2199D3B0098F5958660FDB13FD42BFFB604A2575B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465647, "uuid": "25839bb8-4511-47bb-8399-09dc98a242de", "value": "24576:N9+TUpSjUtsGKbpuvp9+TUpSjUtsGKbpuvaW:N3WUN+w3WUN+TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777465647, "uuid": "cc12cc17-c573-4f33-900c-ea2f7cf05e83", "value": 888615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777465647, "uuid": "b2c189ce-8207-44b3-9f7d-29e770fe1f48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465647, "uuid": "86f54afb-72cf-4743-8647-d769e5ade7e4", "value": "something.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc66eda-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455561, "uuid": "2894a335-6535-474b-a2b6-8ccd98c8ec12", "comment": "Malware payload", "value": "93281b0eab5b5be95d47aed466ec55fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455561, "uuid": "9eab7852-0620-49c2-868d-17dda2812727", "comment": "Malware payload", "value": "655cf54b5aa3bd6fa44059ffab0666a2a92f80f7bbe4967d8fed24b53fb92af0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455561, "uuid": "53c3dc3e-6d3d-4271-9653-e9f7f67095ea", "comment": "Malware payload", "value": "7634e6aee31db6d6f19860405f62ac4dbf25f7e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455561, "uuid": "f6b89890-453b-4f0a-bac3-dafd4a856a42", "comment": "Malware payload", "value": "c3ff4f16fd96c8577bca70f008bac22e62ff21b5caec8884ff908f8bf6094004042d46bc1ff9662cb81778f0093727f2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455561, "uuid": "fbc761ae-3200-4bc3-9db2-10dbe49c69c1", "value": "T15B3723074BBEAE2B9F1D31D95CD73A0FA5D4EF0411744AEBC6A20E885B9DF96084346C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455561, "uuid": "b4788bb6-f875-40ee-a0e1-faa1c021bedb", "value": "49152:kHAHyH1H/HiHgH+HmHjHoH4HxHIHvHTHLHnHAHMHKHTHJHfHGHgHlH7HNHlH5HDQ:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455561, "uuid": "3a8a01a5-d359-49ca-a615-89f3a364169d", "value": 22643817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455561, "uuid": "459b6740-3aa5-4547-9862-ac58d318c77c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455561, "uuid": "c037b363-170b-4edb-82b1-e9fb637f06c6", "value": "invoice-1645080830.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2a1f67-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485728, "uuid": "054c3481-ab10-4c3c-ae41-33ffc9e2995d", "comment": "Malware payload", "value": "ac95ef83cdf09422ac04b2f97025cade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485728, "uuid": "d783a4a2-cf80-4ce5-820a-51355f289db6", "comment": "Malware payload", "value": "65c4d4f57e64db69bd54e4e8267ea2fc65e38a7addc98bb00a3da3de35e0e4ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485728, "uuid": "d9c94134-2af3-4f05-93ca-b6312af34830", "comment": "Malware payload", "value": "d5fbdd2ae653daed020a4040c00e1591a80e9d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485728, "uuid": "c3a89bd9-6f4b-4531-bffb-0d4b28233325", "comment": "Malware payload", "value": "1cfe140ed75ec45aff7d90e07c868b23829e62c19c5a2725a7d81dfd7117bc337049d9797fa8a5c22db6c9862e655d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485728, "uuid": "695fbb3d-5fdf-40cb-8ce3-3ee230c303e6", "value": "T1B6436C47B2A386FCC016C17489E756326F72F87604306B6F2785EA312F10F619F6E95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485728, "uuid": "df206253-9e64-4ec6-9e46-874e9068f035", "value": "e54ed313aa15b1c2c7cc3929ddb713c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485728, "uuid": "6cd4273a-f473-4c09-a283-b3334c0c1997", "value": "1536:VjVii+SgaHaOzRAy1RR+t5utYfA19z9Zwz:Vjt+Sv6SD1RYtMafAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485728, "uuid": "dc3c14aa-0cdb-435c-b0c8-8e48cd3a20e6", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485728, "uuid": "b79bb5be-b98e-40fc-b12d-882ddab01616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485728, "uuid": "91aad520-c05d-4d3a-a1f4-1f374a900928", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf32bb22-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495266, "uuid": "63eae091-19f6-41ae-aa72-7cc4437d8487", "comment": "Malware payload (Mirai)", "value": "36fda4ee6ade1d1020bf6f02e91c1189", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495266, "uuid": "15ad9d06-b5e5-452a-b2b0-b37c49c42d27", "comment": "Malware payload (Mirai)", "value": "65febd952f51182c38b1255eb43f6d9daae9bb1657284e5c3a46504d039eb179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495266, "uuid": "b5010ed6-6d0a-44a5-b155-afb0be53be5a", "comment": "Malware payload (Mirai)", "value": "0bf69caf7eb799cff467a020102fef40ac1eea7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495266, "uuid": "160c92b4-19ed-4e4e-ab70-c7526b92e394", "comment": "Malware payload (Mirai)", "value": "9bce82cbe8a8694d15687ece3507261b66d649e4608ff655e23dc148786a7951fe58193dee679fedfebdc48a1e69520b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495266, "uuid": "78ea848c-4d7d-4114-994c-239d6c84df89", "value": "T1B4930C46B9528E12C5C212BEFAAF415D33136F78D3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495266, "uuid": "c509d38a-4484-43c2-9887-e0ea268e8591", "value": "1536:gknJxjhCMsBMl3EVGpOFnbRfGqtCMrI53yHesYIsOvVaxyXM8aBQ2iS4Rfe5lzcD:TtC5MqVGpOFn1fGqtCF5CHeseOvVaxry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495266, "uuid": "971ec32c-ffc7-42f1-9e89-3727bf56c84c", "value": 96864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495266, "uuid": "9feb181e-83ed-4cc6-8e7b-0d9999c6917b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495266, "uuid": "32d0c260-a098-482b-b849-e0f91e720a29", "value": "night.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24d21ae-43cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777468696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468696, "uuid": "2d62c3ed-4cce-4d5c-b09d-13f6fb7f533c", "comment": "Malware payload", "value": "7a029adbf488fce946455333bddeea69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468696, "uuid": "e5c9bfbc-0150-4645-8b8e-b24e4b481c1f", "comment": "Malware payload", "value": "6618bbfb615abace02efbff9c241da3e894e775c185e7611b31df8219c2bfdb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468696, "uuid": "4d44d06d-cd8a-45d3-8ef0-8a0fdea10090", "comment": "Malware payload", "value": "479ac74cbd3c5395699335fd3589120ee505bde2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468696, "uuid": "a5a9f9b2-e96a-49d3-9e5d-66f63df5b792", "comment": "Malware payload", "value": "79e9e5f97cf4d87331a623f8b982cc05ae8dbef1fb28a7a55a2d97734a1c009cbf23d710bfe54c4b5756ab037cb9d28b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468696, "uuid": "ad7ce06d-af65-4da4-a96e-e1f478d229d6", "value": "T135136D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468696, "uuid": "d6843347-5bbe-4239-8ab3-bc864bdab1d6", "value": "768:bGXRWNGxVA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bilxbcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777468696, "uuid": "c0a8f668-4b32-4cc7-a941-858e56ed88a3", "value": 45425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777468696, "uuid": "376fdffd-e3a9-4bd9-b10d-750f702acdf3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468696, "uuid": "173fd7ac-5302-4682-b001-95f35747f9ba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dafe767-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485707, "uuid": "862cd0c5-6352-46d4-b890-ca6b78fe93bf", "comment": "Malware payload", "value": "c388c54970583ad63c7e5bbc6368c374", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485707, "uuid": "a2cb0d19-c21f-4df4-9314-db05d80aa26c", "comment": "Malware payload", "value": "66b76767931fb577968dade07ed23a28528a37a1189a933088b49acbb3aea710", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485707, "uuid": "b7d1cf99-6715-445d-bc3b-1b5761a7d6fd", "comment": "Malware payload", "value": "8e1cfe19e6a2cad0166110674f50f6e2c1b83dd2", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485707, "uuid": "7a3ba70a-0174-43dd-9666-d06933b4d71b", "comment": "Malware payload", "value": "d5e85e60ee2161b110cdd61cfc31fb60eecbeadddca331919c01dea1fe1a45952263007ee1690c4db7332aec8788c292", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485707, "uuid": "2d401ec4-694c-4f10-9029-fd97f096901a", "value": "T1CA13AF146690C3648FF74A53547A49C0497AD8A562C4D4BD8B9CF76E398F83FB8F80B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485707, "uuid": "f8d006dd-3b45-451d-bfdf-148c56b68f3d", "value": "768:uIsvu2w87vyk+08yrLUrhf1ttikrRoGLm2JDEIay8VxXjEKYsDDTsFjUBTgcg2Nx:Ipw4+3KgnJDiHDEKYsrsZUdkByc5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485707, "uuid": "8915cd5f-aa64-49c0-9050-0141103c61aa", "value": 42572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485707, "uuid": "a0e9e7d2-9253-4e06-aa16-ac6c76534466", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485707, "uuid": "40b5ab19-3917-4419-b037-adcbd1447557", "value": "aqolu(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c07652f-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494644, "uuid": "ef57c35f-4dbf-4a17-856f-a8445e6567e3", "comment": "Malware payload (Mirai)", "value": "06b770df8c8c011b2b17c22a965ce86b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494644, "uuid": "553bbf8c-f7df-4c8e-b641-c46210d0bfcf", "comment": "Malware payload (Mirai)", "value": "66b8fa4e5c3dea96fcce63a092df5bfe8653bc675600e5548aad0bb50abc5d79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494644, "uuid": "29c84b0b-901a-497d-9c98-f0ddcdc0d9e9", "comment": "Malware payload (Mirai)", "value": "690904add4a81847d0bdecb14e026e6ef7df48ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494644, "uuid": "4323bde2-7d79-4b03-b607-31cb8d6d7581", "comment": "Malware payload (Mirai)", "value": "b86f7e22949d54a781dd9bb34638a0d84d16e8609b2127fd27a753c0923c84bf5a1514e57a441b98d310add7157ee024", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494644, "uuid": "45ae2f6e-18ee-4c69-9562-4b2e5269c6c1", "value": "T19E831A0377090F03C16329F0267B1BF097EABDA519B4B284755EBEC59271EF22186F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494644, "uuid": "583b805b-3e95-4ef5-9857-fb70c07206aa", "value": "1536:9L7tgTewtH/OoQQ9F4ZcNAHeS+/PqU+mmJKlhv2qMQXrzspPl:9af2oBKf+DmXqr+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494644, "uuid": "1fcf5b7d-75d0-4fe1-b6d6-d8f7501b3aa8", "value": 88724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494644, "uuid": "363ef458-86cf-45a1-bb5e-8f87943f96dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494644, "uuid": "f0721085-0d12-40fa-8087-b736126919ce", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edef6922-43f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777486755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486755, "uuid": "d75e8419-d1dc-42ad-80a8-1be0c658972d", "comment": "Malware payload", "value": "3c06d18ec909db44d08f5d10c191889a", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486755, "uuid": "207df663-3fb3-41b2-b9c7-5c26c128b4c1", "comment": "Malware payload", "value": "67338fa899447eae929f395b208e6fdd7bc8abbf6ca4f87e7762267364420807", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486755, "uuid": "372ee7bc-94e1-4aba-a347-7ac2b588d355", "comment": "Malware payload", "value": "23b31a00b18f0b59c0c105d09421d625817ba826", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486755, "uuid": "0731d811-0e22-487f-8106-bb418369d684", "comment": "Malware payload", "value": "169eeaacb726cba9f5077ce6039d9b4489facf062f3a3cbff1f168218e69c12b17d5fe54d2a8af3ce63f0782e76e885c", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486755, "uuid": "7aa7293d-7e75-47d5-be59-18c42e5ea914", "value": "T1B2E29DECFF721C7103E57E4674BD18D49B9CCF7F2784B95EA340A4982EA6811E628471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486755, "uuid": "f8ca1d49-7e58-481a-b86e-33364b350faa", "value": "768:uIsmr4zY3q/vZpBc7+Mgtu2qZcMiQhsTX50FF4uonS2NoylWM1c5hKN:hr4zmshpOxzZcMiQ6TJWTon8Byc5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777486755, "uuid": "5f929b9d-1b44-4c42-a728-49be5daedc41", "value": 33368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777486755, "uuid": "a1e79a71-2ae9-49a1-9f8c-80e8a64c9e08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486755, "uuid": "0c10e616-814d-4c2d-99aa-e79e082a1708", "value": "akusu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603b41a2-43f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485229, "uuid": "860dbd42-1f3f-4634-b694-a4aeec34f96f", "comment": "Malware payload", "value": "2434cf5e49f3a0a3561b70fc415c52a2", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485229, "uuid": "cecbdbe5-ea5c-4fb2-9426-bb0948393e17", "comment": "Malware payload", "value": "67ccc9ca894afd6b4a975a0b373789e01b6450ea1b89d9c965ab2be92c1ae97e", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485229, "uuid": "9925afc9-6e6c-4546-942e-715381b45246", "comment": "Malware payload", "value": "40c146b727b398cbdc1902c89c9a6082ac530fa7", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485229, "uuid": "d397fea6-8986-413a-ba35-4f02a3bf83c0", "comment": "Malware payload", "value": "f13f9890414c7b071c7eb04dbee1b06a7fae9579bb5701821a08ddd7f4e4d560d7f6a6faa855c736e6975e554a3f2033", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485229, "uuid": "4d3d898a-a739-46f3-b18e-073b2a4cd63b", "value": "T163A28D60F71989E86FEB17B354BD5CE1CB38585F18CABAAAAB0071383D53660F761431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485229, "uuid": "c64ea2e9-4a1f-4637-87e5-489e23a0ee61", "value": "384:uIsrkcZSSTySTPdbpvgghdmd1+RvxAF054LgeiaZLQi2N9FclWM1c5h6tA:uIsrkcZvTyO6Xd1Gj54bZl2N9ylWM1cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485229, "uuid": "5fc8f7b3-1f0f-400a-9693-f80f3e85f3c3", "value": 23244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485229, "uuid": "b87dabd3-428a-4127-a830-0bafed2ac5e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485229, "uuid": "c0f5ea35-255a-4011-91c9-6054c799eb06", "value": "urasu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe012903-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455429, "uuid": "6ce41735-25c4-4152-afa8-c9ea75cd6c22", "comment": "Malware payload", "value": "6788242d7e290e5a2063f1b8b1f238b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455429, "uuid": "a6428b63-1fe6-4aab-bca8-fd9d5f6db1ee", "comment": "Malware payload", "value": "683602c20314922430dc7e69b7a2858c943535ced53c6282bbd02f4938cc24c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455429, "uuid": "a80b8b3c-4631-45a7-b911-f1ad7b00fb01", "comment": "Malware payload", "value": "5a8c12d123b95c82705652ef12e01a23521f235b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455429, "uuid": "f4519e35-70c5-4ea7-ba67-b28ccc4724dd", "comment": "Malware payload", "value": "d216db3caf4d5a5d548f54336f8effcaa6c692c5178b784b57ba2d395ae20076d360efe6c8d3cc3c583347b86d535c5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455429, "uuid": "4e9e52a1-b50b-46f8-a602-cef2ea8c2188", "value": "T11A3723080B7DDFABE5BCB59E00A633174C29DE0CDC26B8369BE355CBB598F06164E149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455429, "uuid": "e9aa95cf-aa43-499c-9268-9e4083f39293", "value": "49152:QwI8wIWwIGwI/wI/wIxwIUwIDwIEwISwIxwIz/wIBwIHwIAwIAwIh8wIvwIawI7S:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455429, "uuid": "36320038-fe3f-4801-9c29-06dce4b0a48d", "value": 23684328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455429, "uuid": "1e470e8c-8faa-4fe9-b62d-3b7d412d33fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455429, "uuid": "b74a6196-8deb-4267-a209-9374ff553595", "value": "invoice-1645080830.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79d8d6d-43be-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777462209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462209, "uuid": "76aecdee-0442-470d-b355-c16cf99204a9", "comment": "Malware payload (MassLogger)", "value": "30cb2e0ebc6bdf58ac5648fb7ccc7f94", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462209, "uuid": "ecf44186-6b76-4270-b9bc-8fe886e0f68e", "comment": "Malware payload (MassLogger)", "value": "68ca74e65fc49e5a1e5aa9c875918975bee57e677530e99d739953436003b180", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462209, "uuid": "5ffe3513-9734-4c2b-aac7-dfda7f5077b4", "comment": "Malware payload (MassLogger)", "value": "f29f4f149d9cf4c73c526096e1aff2c78950bcee", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777462209, "uuid": "3bdf0fea-8734-437a-8a18-73465744cd8b", "comment": "Malware payload (MassLogger)", "value": "e53225fe931b08c4922e4f64c096686af834cf548cd4c0077808f79d6e9affc55de4908fae26d0f4da14873339032526", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462209, "uuid": "64fcd28e-83bf-43db-bac9-4400406ae96a", "value": "T1E134F126CAD81B19CFB8172900FE120EB3D08B9E5056759AE6A7BC4B5FDF504870B1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462209, "uuid": "efad48e9-303d-4bd3-8d3f-0369cfb71610", "value": "3072:Ekb+uTL8fGpQq0lRxwULlDv1hbgWOKmJPOI2QE8eBAAWtq9JsLRlSmGOH4RPFBwy:EYMvDpNVgWOKaOIWuDtq9J8RGCkFGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777462209, "uuid": "2c7fb0c1-9684-44d4-a008-5724f6b39299", "value": 239628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777462209, "uuid": "8a6fe336-df0d-4d1f-adb2-ebc5e2393dde", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777462209, "uuid": "cfa33d37-1f2d-428f-b5e3-62b41763aba4", "value": "z1FEDEX_E_DOCUMENT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181e9458-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494986, "uuid": "b89e8b1f-720b-45ef-8ece-7c8f8e917c2e", "comment": "Malware payload (Mirai)", "value": "aaedc41f7a3d628269aa4e46ef6f51e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494986, "uuid": "8ce2e5f3-c83b-4109-b98e-de4974a7da70", "comment": "Malware payload (Mirai)", "value": "6a04253eabd21a304b289cc4f98d7754d0a607e8da3293647ca94d43c0ba01f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494986, "uuid": "2596c512-7f9f-496e-a930-68c28bc31a36", "comment": "Malware payload (Mirai)", "value": "7275a56b91fed7f9552a39ddb644880aceaf7973", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494986, "uuid": "f60ed3d7-c9ab-4eaa-95d0-77445602b09d", "comment": "Malware payload (Mirai)", "value": "7dee761b05ab02856f7f64f9dc4e5d0305de4d54bcbbed3d065cba3490ed7ba21432cf5bdaa8134ef644b8882c9f2339", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494986, "uuid": "dbdf3e96-9f37-4270-aacd-2eee4d5f12b2", "value": "T1A393084377094F03D06329F026BB5BF087AABD6118F5B284B55AFEC99271EF16042F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494986, "uuid": "0608b356-14b1-4b61-a07c-3398708d2cfb", "value": "1536:uLMm0jisRhf6Y4aK33rSCWlT1nfH5jATqSPvFFqTItVnrTWPN17J:umvR4YoTCJHSFqT0rWJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494986, "uuid": "57c0c2c5-3518-4fce-9622-c15aad057847", "value": 88804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494986, "uuid": "ef2da58d-b710-444b-82ef-98edc04b0005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494986, "uuid": "3da0689b-8383-4736-83a9-02f02a99596f", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dba188e-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479990, "uuid": "8ef2d121-8e4d-4286-a341-8083034471d8", "comment": "Malware payload", "value": "76e7469d90e30c791d6875b210a3459d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479990, "uuid": "8f785475-7fc2-43c8-9534-5626f4c11dd4", "comment": "Malware payload", "value": "6a4839a9ab9ea77d36c25955c39b28aa6602fce3489c21a674edf81f9ec2a7f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479990, "uuid": "519eb692-bcfe-4f7f-a788-d69af81fd96b", "comment": "Malware payload", "value": "987ab4a37df9ef59021554866a92bfb27225b25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479990, "uuid": "0dd1dd5f-a3df-4a12-be57-e046adba06b7", "comment": "Malware payload", "value": "53646f0943fcec851cc174a8e67a4aa00a0a81730347697ab5f87f001c481d173d6517b0929819057846b4882e22cfd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479990, "uuid": "afddc80a-0ff9-4df8-8ae9-16093f0f5b26", "value": "T1A7183393E8FCDE63D2FBAF319BF00093919A51C648481956D25627FAFACC18E551CB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479990, "uuid": "9b300629-79fc-4cec-8065-8b2e21bbb419", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479990, "uuid": "1ef052c0-82d5-4264-ac05-a6c8c8e3e248", "value": "1572864:BS2YV2qHiQ0Co6FALauLYbTWhEngG0PXJIfKY2PcT/bkRo:BS2YVjWCHWX6TWDIfKHcrYRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479990, "uuid": "d9ae7cbd-0f87-4115-a488-8ba43b5a95cc", "value": 89195736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479990, "uuid": "f2feedc7-09ef-4671-ac3a-3c256066dadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479990, "uuid": "e5607b40-2d89-4dc9-9144-60fa82f1d712", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b5806f-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451569, "uuid": "9f76f01e-543f-4bcd-b1a9-2286b773636c", "comment": "Malware payload (Mirai)", "value": "aa0b7689b171d179d872315f8a2879e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451569, "uuid": "7360fe70-d763-46be-be80-d75106b191e8", "comment": "Malware payload (Mirai)", "value": "6b2bc0c5d3cb202fc392c3d571ce99234501685df39dced8370d8638304c0f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451569, "uuid": "fef94fe7-4090-48b7-9747-a288d3546dac", "comment": "Malware payload (Mirai)", "value": "4e1cc83377da07f9f6a2db87bc268a40a844bb34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451569, "uuid": "90f2dc8f-0b9a-43f6-80bb-75404f0d95f2", "comment": "Malware payload (Mirai)", "value": "36359b9c16ca6082d22b325d1c08acc088c9e0ef8313ab23c7cc510b04696521988bc6dadb23bab05aa1f8cdaf0c55ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451569, "uuid": "4b24f46b-5c65-4d31-a311-d82292c34272", "value": "T1F1633A22F6350A27C0D4A57922F74715B6F287DF29E8D70E7D710E8ABF506402992EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451569, "uuid": "ede02a95-5e9c-4277-a917-4411ce122a3d", "value": "1536:xL2nCShOi7DU4XVy8sgUthQyjh759Qtezrj:RY9R4hVpzrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451569, "uuid": "e7ff9f1a-ad4a-4148-95cc-068d5e355643", "value": 69872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451569, "uuid": "310abd96-a4d3-4f2e-9d92-71a6504f4e71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451569, "uuid": "504be85d-0ab0-466f-b918-5f5b9b9e85c3", "value": "asuna.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7343ef-4414-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777499240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499240, "uuid": "626580f7-b788-424d-800f-0b0698aa9a67", "comment": "Malware payload", "value": "41ccdba4a1a4039263e8aedd1cfe25ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499240, "uuid": "46250962-71a8-45ec-bcca-e755c1bcd65e", "comment": "Malware payload", "value": "6cb4b6539f6f468bebb8e086413db41180cac3b195b953727bafe01da72c9d9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499240, "uuid": "30af6289-e7cb-45fb-ac46-31939e701a27", "comment": "Malware payload", "value": "37cb7fcf164e93b7a56462b6e97b2ee7d78da54c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499240, "uuid": "f76f01a0-7b8e-45db-93a0-a682e5f977cd", "comment": "Malware payload", "value": "bac4ce9bf5cd7da6a57d56cea71ccb4d4b19965b9628d538455d61f6de3436390b1372af18409b767441cc8dd3f4f20a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499240, "uuid": "1a8cf242-55bc-4b7a-8418-ab609b205f1b", "value": "T1AA04F706EEF91F27C08AA3BD9EF39693B2363CA13753974B9304A21619413D057CB65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499240, "uuid": "368f81b4-ea0f-40b6-a0ad-a9439d4cda1c", "value": "3072:obQdGlfc1f/c74KsU5Hjk1s+zUO1p51/4cb4KsQuktk:obZ4UHjk1s+QObn4hktk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499240, "uuid": "3f3df48f-2f4c-4091-b23b-b66bd1e3a67a", "value": 187880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499240, "uuid": "21a2dbb7-e783-45e0-933a-b029b9f29cb6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499240, "uuid": "fca46e32-2ceb-4ee6-babf-48d065050f47", "value": ".mainhelper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d32445-440a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777494846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "d8f22888-bd2f-41ff-a6bb-e9ebbdef16e7", "comment": "Malware payload", "value": "13473c724d830c0883903fecc4bafaaf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "4b2dd49e-61f9-4aa2-8d2a-d00de25dcefe", "comment": "Malware payload", "value": "6daa1bb05b7ea7d5094eeef50893f79f8aa6c7cbee1163d37ee60224fc8f64f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "6f59a88c-cb58-46c3-b323-aa8248163198", "comment": "Malware payload", "value": "0dd08652dd197a8c3fe5bc53f9526c11c66e7ab8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494846, "uuid": "94fcfab4-6c9d-4bb7-bd85-cdd226bd9fe9", "comment": "Malware payload", "value": "b982c4bc8a7ac9487e58edab79e2c8a5c76d6abaac844378a956015e7c34f633cdb4133714f304b5ca4e243838d30033", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "ea072bd2-56d7-49a2-942a-c4e3b14cb992", "value": "T17FB3F845F8509B17C6C651BBFF4E42CD7B2A1758E3EE7203A9256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "4fd55675-8001-4531-999d-c0f95f57d365", "value": "1536:/djRs0MRZQUVhJTsk+llBaZ54ChTV1ZzlYf3wywdcUsrO0dr538OS5pDvID3:1jGRZQgJAkVv5hTLJiMC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494846, "uuid": "6899528a-7e49-4a28-98be-399b83b7b3cc", "value": 113284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494846, "uuid": "c5ae5604-1778-4fe9-96a4-4f0a56114ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494846, "uuid": "6bd173b6-da46-466b-a155-0b1a636bda68", "value": "rage.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde326fa-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495291, "uuid": "bbdfc616-c34c-4a06-9197-ccbcf049396e", "comment": "Malware payload (Mirai)", "value": "ea37116e352d079c5d176f2f74289f6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495291, "uuid": "2f5a3548-ebeb-48c1-aafe-9a56a11f9c35", "comment": "Malware payload (Mirai)", "value": "6dcd3171f8dfe9ec4615a2f99cb36456a9681ecb3ab06f5f935543b37e68fae6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495291, "uuid": "0d88bdf4-a5d2-45c7-8bf5-14a2e7cff142", "comment": "Malware payload (Mirai)", "value": "8e0f8aed2e1e215d1e5919f6f093230b4140a44a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495291, "uuid": "9a88e18f-32b4-4948-a111-7315ab9bee89", "comment": "Malware payload (Mirai)", "value": "5edc1fbc72434654ee0a9b1f6698d274ebfdb9e9987d70c9c98f68b81e90691d512b201d3d663733e0ea006722245a4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495291, "uuid": "e16e4f9b-d91f-43f2-b30c-eb077d1cde84", "value": "T1C9A30887B902DE7FF80BD6BA409309197531FA660E530B76B367BD93AD311D41922F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495291, "uuid": "e98d7cd8-2aed-4d26-89e7-e263ddee4650", "value": "1536:Xyb7fahHxOrsCxjtwZgNU68FF4PDW0gsRmDZYvT+Ff8OUdKxZS:XyvyrCsCxjtGgNU74ZgN+tOUdsZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495291, "uuid": "c78ea1fb-d21e-4f09-86dd-b0ef048a5528", "value": 99684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495291, "uuid": "31df705e-b2d2-4f6c-bade-4ea51a662f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495291, "uuid": "89070e1a-fd27-4c47-af9c-540e211d1c1c", "value": "night.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265c63d9-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "5301b287-04dd-401d-b122-403da7f9ec42", "comment": "Malware payload", "value": "2644ed75f0ed3c6f2adf582c9f211fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "32bdbe1b-f653-49fd-be7c-bf5f1bd78619", "comment": "Malware payload", "value": "6e44ac52d6fccd54bcd9e86f60ae8a17de58d69a1e0168042773c78ebd76e745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "d4b97e01-707e-42da-b05e-829c1ff940a2", "comment": "Malware payload", "value": "cca4404bb9b47cc5fe2475328f06140cda9659d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479978, "uuid": "b2a47693-ba3f-4820-ab9b-f10865ba6ae9", "comment": "Malware payload", "value": "d09085f13bc824322aa14e79c7953cd8c994e82bd3e43764ec0588ed3525254ad17d2e9cbee3e80845d2c8030570fc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "75a19b79-5f44-450f-91b0-0ce77d22f77c", "value": "T1C9183353E8F8DD63D6FBAF70ABF00493869B54CA4488149A849627FEFA8D1DE111C731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "c9d99e54-7906-4ac7-8d66-39657381eec8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "42b10848-51b3-4d42-8b34-5d6e48ff9a8e", "value": "1572864:UW2YViHWbMrCo6FALauLYbTWhEngG0PXJIfK4T/bkRt:UW2YViKMrCHWX6TWDIfK4rYRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479978, "uuid": "cf7e5363-019a-4eac-8071-9adcfa1b16e1", "value": 89223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479978, "uuid": "f1cbffef-d608-4ded-9184-08a9d707231d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479978, "uuid": "0d8b00ff-2c0a-4e26-8af0-cc5c17d5f549", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac92767-43f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485219, "uuid": "15705859-3d14-4ea0-8378-6f2dc13c18ce", "comment": "Malware payload", "value": "a505a7c041fa021b5c1d7a49ed67ef05", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485219, "uuid": "0b7afe3b-2bfa-4342-83f4-ca19edf12e58", "comment": "Malware payload", "value": "6e5e513428af63c01b245ac55004fa9a27edbf7849bdebe9fcc576186607e72e", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485219, "uuid": "32146d0a-51bc-4fb0-8ebd-6e52577161f8", "comment": "Malware payload", "value": "14ce3e6241bc8605314c1f2add56bf4a61860945", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485219, "uuid": "fe111fbd-6a24-4b55-9e81-4ca88cd61e2b", "comment": "Malware payload", "value": "b547163c932a3ab87f4108dcc6953fe6ecc9098575188a8c96c262d9d49f275affc0addc770123dfea642089559d27e2", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485219, "uuid": "202158e4-09ce-4e52-bf12-1653d6a8b417", "value": "T1AC139083F3C059ED468B37B6BA2542C5477C5ABBE6C12BDD734A7E021A48708FB60539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485219, "uuid": "49ffc3f3-575d-44e8-bfb1-750e4d9d426b", "value": "768:uIsUEhu6VvWaCqhUQV5I4b0cXqEvTcKdP9Kyw4yPQ2NPylWM1c5h8G:fEeayQV5BbaErcq9KywXxByc5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485219, "uuid": "6f274208-f22b-4650-8d3d-a1f49ce5856c", "value": 42292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485219, "uuid": "7ea33f35-9bd3-41f0-abd4-70a5ef8666c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485219, "uuid": "e98b60f6-50f2-4c81-9014-8ffbaf808558", "value": "aqolu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5532bd5b-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485640, "uuid": "6b7609d7-0647-4761-9139-cee685f18a74", "comment": "Malware payload", "value": "dea832173d18360f741d5cffc9d958e2", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485640, "uuid": "9c371fe4-946c-4bd3-9b53-e2a00c4c3fc8", "comment": "Malware payload", "value": "6e6f40cef29357b48857d891867b35f2605b3c15b8199cff0e1b798656bc3470", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485640, "uuid": "e071553f-5c14-490d-8779-220e9fcda52b", "comment": "Malware payload", "value": "ef3ec0f15f318176c8a5bd6f576bd3b5b9ec9ccc", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485640, "uuid": "513b39f1-c515-47c8-8388-fb681ed70364", "comment": "Malware payload", "value": "27557b6ac19626b1a3ebf60574d4115ff72439547514cbca37ae9a016fedce6ea88ea6678b131d0c660f4113beb6161c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485640, "uuid": "11093054-1b41-48bb-a2b3-3bf8a77ed00e", "value": "T11ED2F11707B4285AD09ACB398C3B11828277763B331FE76D4194666E2CFBC536D98572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485640, "uuid": "6d8359a2-6206-4973-9c15-7a852c6f2390", "value": "4ceb701a968df43f91ce5d704b86ca8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485640, "uuid": "b43d7051-a208-4464-ad17-e6ec219109f4", "value": "768:bgLwDWk+lOsQ0iO9lZAVOJLVpPOhlOg5UfHNgS:bgSWvlNQ0vXrDNgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485640, "uuid": "4aa1f1a8-d5d0-4165-a258-e6fead65fba9", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485640, "uuid": "20bc9ae1-028f-462e-9383-ddc6cd3966ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485640, "uuid": "b37c41f0-d603-454f-9a4d-2d28aabc6ce2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566879ba-4393-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777443551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443551, "uuid": "fc6a66f0-10d1-4713-ba90-b61d3b9b029e", "comment": "Malware payload (Mirai)", "value": "7d6de0e0a901bb2185934024c2517e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443551, "uuid": "d80c9047-6747-42b0-b293-fcfeb0215329", "comment": "Malware payload (Mirai)", "value": "6fbd27ed6f09e1c7531f9a8669807e854bf52d56e06da72c152a442045eab9bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443551, "uuid": "92230f62-f1d5-47e8-8157-aea3e879071b", "comment": "Malware payload (Mirai)", "value": "320e15806663dd426a5eee806bf8ec845272063d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777443551, "uuid": "e1f6d455-3025-4014-a075-e3381f1a6024", "comment": "Malware payload (Mirai)", "value": "d2215126058a3d51aca9a31ff86466bacb5f58e777c4e7a692043c19dbcf1317008c594900b5ecf5e0c5314693169e67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443551, "uuid": "1b3dd525-3e0c-445f-9e6a-b656423585af", "value": "T120A2D0306954CE77D8E34839FBBC9B4A798B9E3CD1C9B161576A8314F912408E3F0784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443551, "uuid": "0976d9f0-3a5b-4068-83fc-45560d7801d8", "value": "384:Bj9sLPApJx+2dd6ZE5JWUTm6DmjhRRYWD9KEum10eB17hymdGUop5hb:N9sLPCFdUKJWOvDmjrRdoEuu02s3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777443551, "uuid": "b1b6fbbe-c6ac-4a56-adda-26c6f7d99642", "value": 22192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777443551, "uuid": "0aa70d62-8962-4501-b80b-71a4cf7ca126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777443551, "uuid": "6ac5493f-aa90-486f-bd1c-5b6bd71304ad", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3936117f-43ab-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777453810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453810, "uuid": "1c3d7d0a-d515-4a1c-a2d2-1f68c234494b", "comment": "Malware payload (VIPKeylogger)", "value": "c9925236dbb3cf9eef95961574044877", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453810, "uuid": "300241b8-5af8-4799-8bd6-4298fb9d5620", "comment": "Malware payload (VIPKeylogger)", "value": "6fd8b59fa6f120cce3a6ac43e754b0b54c001e5bda90b38b26e5b77bd43de268", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453810, "uuid": "8eee8fca-20a7-40b6-90da-68068a6c11ae", "comment": "Malware payload (VIPKeylogger)", "value": "96f6fd4312ed001a1bfeae7eb19d9f88bad0ffb5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453810, "uuid": "51f35e30-34d8-458b-92de-33b3a54814af", "comment": "Malware payload (VIPKeylogger)", "value": "9becdf3675143de6066acc69173c86559c5e85d872f42ac7687151a752b0e01bd7daafe529e276ac08d4e9cbff78c871", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453810, "uuid": "eb943ae4-a394-4388-a5b5-31df1d53a128", "value": "T1D7C4F151C9D81F768FE9A62940BE2A0D73E0894B8416758EFF33BD0B9BFB500161F198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453810, "uuid": "ad67c83e-e6b1-4a05-bb5c-25eda5960ed1", "value": "12288:J4/Jg93kNJTlC3LJ8KCBT0Ii4N1WD06hXj6Gc7y/aLDfeA7h1/qxQv2ZxnhxXcQP:eKdlYzyfhIfQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777453810, "uuid": "97adc76d-85bf-47b5-994c-fd38005ef8c8", "value": 563980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777453810, "uuid": "e7b622a7-e485-47fa-8b92-4e920491f706", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453810, "uuid": "9eeac051-639e-4482-8f57-a6bed3fabf89", "value": "RFQ-SNQ09-07080-MQ-06979-0409-PR-058680-Order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9458cb0a-4399-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777446232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446232, "uuid": "e9db870c-65c8-4d7b-b0c5-5c5c4447ee9c", "comment": "Malware payload (Formbook)", "value": "4791ea6d0bad82c6a3282a162fdc825a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446232, "uuid": "4f513bfa-62c2-49f3-8202-e1a8cf0df5ce", "comment": "Malware payload (Formbook)", "value": "70b469b8018947ea2bb648a030f8cb5f7f3412be30e2742050c8e0ddba531599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446232, "uuid": "3fd0781e-ac2f-4279-86b2-efd6cccb60eb", "comment": "Malware payload (Formbook)", "value": "f6756d2b1585fcdcc4c9fd66b6869ac276c93d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777446232, "uuid": "cc479a88-21c4-4faa-8811-bf58b36dca03", "comment": "Malware payload (Formbook)", "value": "4a222a0445e0b1494623ccd508fda686850bae1a4d57976f49b3a3901bee238e800c5f0ef64e96a13c1dd49130af0c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446232, "uuid": "71eac5bc-a66c-4347-8cbf-81072fb96a8c", "value": "T19915BF207E822F55D1AF1FB88092045967F68C06AF46F75B6EDD76F53AB3782C902813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446232, "uuid": "70b69678-d238-4279-84d1-3b9e512e2658", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446232, "uuid": "e05dcbc2-e06f-4cae-855b-a133dcfb3400", "value": "12288:b5PkKBW/9bTL7tsh7ytgfBKd+1EhVEvgKV5+ecewK0NbJFUdOdEj2mYnC5:byKWRTLhdgfA+K/8cJtZJ2qC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777446232, "uuid": "5f0d4c8d-b4c2-4f27-a12c-2999ca2cbad3", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777446232, "uuid": "ae7a0260-287d-4d08-ba38-1fe42df0cf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777446232, "uuid": "8d33c62c-8978-4e0e-9227-8d83edd052c1", "value": "Arrival Notice (BL No.INC01412329).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96da0d9b-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494769, "uuid": "324520f9-3c14-4072-b74f-aff679826fa2", "comment": "Malware payload (Mirai)", "value": "90571e004ea09f061b947579cb6b855e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494769, "uuid": "b041b016-a07e-428c-bd3c-6e6557e1b654", "comment": "Malware payload (Mirai)", "value": "7227ba27cd49792a0f16d87c913cf159930c55b9b30d0b82b365f19b3a13da1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494769, "uuid": "e0e7dbc4-5239-4760-b274-71144b22ed7b", "comment": "Malware payload (Mirai)", "value": "79e7fbb4ee0e54c8de8e98c74c673f9c83f810a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494769, "uuid": "b6dd324b-051f-4fba-be09-db76901e0036", "comment": "Malware payload (Mirai)", "value": "405bf1e01451147106c2a049c3967c07c54ea18aa8d4a45a79e1daf9db499c2e0066211f25c8d840f67d9690a00606a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494769, "uuid": "1752a6be-87fd-4256-9a81-e5a6fe7fabb8", "value": "T102A349B3C9656F68D628E1B5B0B18F7927939A6181471FBE2877C2B44043D8DF6063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494769, "uuid": "a5742c7f-ca54-4867-9c92-41d571a217cd", "value": "1536:L0lf0olPhgCNKyUcw0u7I5V9HuIW9PwgyuSpfae:L0lf02PypyE7I5LOIWBcumf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494769, "uuid": "be4b0054-a5cb-42fe-b78b-e51e159edf46", "value": 101060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494769, "uuid": "4d26f024-a706-4188-b332-258eb19dcd03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494769, "uuid": "05abcf8f-652d-4d8c-9c2b-1a9e0d04a002", "value": "rage.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19f1b1e-43cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777468695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468695, "uuid": "fc59fa93-79bf-4307-b500-0b947068bb34", "comment": "Malware payload", "value": "346c2ef15d8a1b844526914965538c1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468695, "uuid": "63218d2c-b495-441a-b82d-947b108c4350", "comment": "Malware payload", "value": "7303fdf8a8348101d69459b8b1c81e327a29b37b5b8c47ae9306377c653075c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468695, "uuid": "1113b6b2-6749-432d-912c-24076f07635a", "comment": "Malware payload", "value": "06991ee2a3f6759c651b6f31c54bf6ed506c64a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468695, "uuid": "771a97c6-5eb1-42a9-903f-a88f541090f0", "comment": "Malware payload", "value": "ccc3be33cf323e91beefe82b13bbcc2d747d889bb323df200c0fa49fb9993a8a15f6cd01945f1958c5b8fb2e35089b61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468695, "uuid": "ae182adc-b34f-4fcb-9e52-ed35e1b08d56", "value": "T1F5255C06BF405FEBC4AFCD30492EC71711EDE9C696D6A62A71F84B8CBA997050BC3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468695, "uuid": "a1e94f4c-9896-41be-9d76-7cf408350823", "value": "12288:rVFrVaozW/NzbQkbiBwNV7ZXz9+21iv7Iy0bvL8hSMLdQvDJsisDJkgDJqgDJx8Q:eatrLzSbPcxzvSMLjDO/ROrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777468695, "uuid": "4701dcc2-7407-4327-8391-f6473e9defc6", "value": 970580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777468695, "uuid": "57dc66c9-b806-42a5-9925-a603e6cfca8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468695, "uuid": "1a78b44a-e090-4933-b59f-37233876fb5a", "value": "x.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f444de-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494768, "uuid": "1646059f-804b-447e-be1c-1540bb618399", "comment": "Malware payload (Mirai)", "value": "c00086d5da181465a0da4b20fec7b93d", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494768, "uuid": "ebd3f0ef-f39e-4db8-96da-364d778baea8", "comment": "Malware payload (Mirai)", "value": "732280457c504c124844fba0e71afcb80d27d780c407c8383fa0bd921fe0313c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494768, "uuid": "a371b75a-643c-4c38-a16e-a2087ec78c95", "comment": "Malware payload (Mirai)", "value": "3dcb29d8338c1bd14139830b9a140e82f137d0df", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494768, "uuid": "1e55747b-e49d-42eb-9415-b2b5518c0d2d", "comment": "Malware payload (Mirai)", "value": "426c16938c21327d514a7767c9d6da072232b60551007e0ebbaa3b8c939ed2afcd629a241f28d3d94a1d97bbd2d92966", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494768, "uuid": "82a075b1-1c26-467a-8409-1f30c6496fa8", "value": "T10813F254E62B6CCEE7EA7070068E57999F78EE16B390CDEBD6868F96444213E800CDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494768, "uuid": "e620f39b-7b12-4628-9a27-ebff826d3236", "value": "768:+pVs+TZp1PlO/ktwwjEio6w7IhL1D8Wp1PYM3le4npOCDRJ9GZ4uVcqgw0t4T:yyYv1PEUBxK7I91D1p1PYMVe4pf9O4un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494768, "uuid": "b74db4d8-94ce-440b-8b1e-650deb0fef13", "value": 44316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494768, "uuid": "003e1c08-da8f-4836-93ef-8fa05691627b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494768, "uuid": "b3b40d4f-e52d-4348-a664-4f759601f6c9", "value": "rage.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bb8d5b-43a8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777452547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452547, "uuid": "b3bde410-a0b3-4aa3-8d3d-ce3e471fe85a", "comment": "Malware payload (AgentTesla)", "value": "045b99a2b9ccdb426b7b4f5d8c7aea6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452547, "uuid": "78ecf67b-df13-434c-8f1e-0be1f6345ec9", "comment": "Malware payload (AgentTesla)", "value": "736a4eb5d2963b75468ffd482b0330f94575fc1982e1d42a3ea194e17e9fd464", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452547, "uuid": "aaa3a8e7-3b06-4aaa-b87f-a93babc25a28", "comment": "Malware payload (AgentTesla)", "value": "d9c57a67d4c29c30e7dc491add74862c9671339e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452547, "uuid": "9f98a9d9-ff80-4a95-8609-408db6c7e7da", "comment": "Malware payload (AgentTesla)", "value": "79403e19347d36d2427ed1978ce90709b9d11476c5c621917edaa77d3970d3002ae130f64f5dcffd76fb3923b4889c17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452547, "uuid": "4353ac20-553f-4e05-bc38-f9e82f05b304", "value": "T15BE3022211CB8D7624F81429AB0E751FF76CC0C98B8CE5DE415DA6AB200CD97C7AA779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452547, "uuid": "eb2158f0-1ed9-4472-b3ac-059ace4b6378", "value": "3072:PR0PvUwwGhlEUiECg7CYzTi/IdhBUK7IcoDTxwXm+S6bAoJ+qTOIyCS:xwwGTE+J7CwK5K7Ico5wXmze+qT/yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777452547, "uuid": "e556de37-1552-4189-87ff-0f60787d4c97", "value": 150189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777452547, "uuid": "8efbe14f-1ef8-4450-bdf4-3b8cc636ee54", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452547, "uuid": "3a5975d4-3706-4ad0-9f44-f9ff4edb23ef", "value": "Quotation. RFQ # 28042026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dc0b0a-438f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441931, "uuid": "80dfcd4a-b1b1-492b-aed6-32d7ca95b713", "comment": "Malware payload (Mirai)", "value": "cf9cc859d8ed026595d3b8471fd8cf92", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441931, "uuid": "92aa5b46-e1c6-4c9d-aaca-ec7a8db61626", "comment": "Malware payload (Mirai)", "value": "7393d6d31d87a0b4282e5061e63a06860ffde23e7126cdc20e8bedff32b642b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441931, "uuid": "dfedccae-4c7f-47a7-89aa-a7665e49b294", "comment": "Malware payload (Mirai)", "value": "5cd87cc4e0d67f4ae67a960181d140b68dbc372e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441931, "uuid": "bcf0e6bc-7181-447d-b158-a826c3e0279b", "comment": "Malware payload (Mirai)", "value": "ebd051393d21f8c04e5b20e10ce5ea90c3d686e712679825a7e7a000a4e88cd25b489439db47acd520286d28d00f4896", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441931, "uuid": "1e1716f6-cd08-4e72-860e-be7243999492", "value": "T153D33C437750DFA2C36CC2720AB3C752AAE6269217D19459A32DDB1D3E24749783BFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441931, "uuid": "89280480-8959-4529-b189-af624fca6c45", "value": "1536:oH+VXyI/col4pwpYVhbzWMllZG39zeQsVPquy2lC0eO+INllEf9N/2QvrKBwjtCF:S+ByscoOnOMlZGN8Pqh0eollER8U/jm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441931, "uuid": "21ea52fe-30e1-401c-986b-3e9f62999030", "value": 138592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441931, "uuid": "8d80d985-f17c-4945-95fb-a646dd710d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441931, "uuid": "50f64700-7054-4816-9981-80d36e1f0830", "value": "agent_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104b7082-43b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777459325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459325, "uuid": "551d181e-2e16-4022-8c63-5ee878f60396", "comment": "Malware payload", "value": "5fa9ab16acb226b568c217fa4a0b002a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459325, "uuid": "f6ddb2c6-d486-4ab2-943b-15bc03ccfc0f", "comment": "Malware payload", "value": "73b6f611e14a76d0aa8177066c6218a1b8086a55140341d0f2c3247cf268d7be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459325, "uuid": "1b7cab28-b3d2-40d8-8001-7da0394b055e", "comment": "Malware payload", "value": "ad7e1b139fb4eb88022a3bb6236c562eef1f5fff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459325, "uuid": "405a152e-1e02-4e8d-8204-7ae4d2c6d7a4", "comment": "Malware payload", "value": "b48c8dc22d540f13cc23f04c514527f8bdbfce360f6b7542c5449d3aced06aac2c30264153e975fb5d4598ac87fba994", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459325, "uuid": "2646b290-10a2-41ea-a341-cdd192b97563", "value": "T13052C0DCC1C04F395A95A67D0C006F8963AEE0C287CE6BA3D8540E4A36B781B065F393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459325, "uuid": "e866277e-ae86-4277-9e0a-2b52f6083309", "value": "384:JsbVr6CWxDXrwlmeIIwFOmHe4nl1/SrWdloBWMH1rhs/bq:Js5sXrwtIrHe4nl1/SrWdloJ1rhs/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777459325, "uuid": "de4267e0-f5a7-4493-8b9a-63c7153122f7", "value": 13337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777459325, "uuid": "2845e56e-17e2-4b30-9a37-2dd1e43c09c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459325, "uuid": "17ecbf37-19f8-43fc-837b-a768681c0840", "value": "photo-553170366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1008324-43ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482035, "uuid": "e56aa722-67d4-4494-8f58-e4abd7bd9b31", "comment": "Malware payload", "value": "9685f93cf6ff298d3d0c54904c8bdd62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482035, "uuid": "97066a6e-fc56-480a-98b4-6bb0418ee2d1", "comment": "Malware payload", "value": "73cd25352ee3846cfba700a5b0cf908b9ab0efcd151e8ee2fc1324c5b713d08f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482035, "uuid": "bfa865d2-a645-4db5-a8dc-c124f2594d50", "comment": "Malware payload", "value": "803b30c0fe3bbe40527cf0ee49cda6085eb96f77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482035, "uuid": "e2a3fa42-2a2b-455a-8b65-a3fde5db2b14", "comment": "Malware payload", "value": "eff4edde5e5006ff039933e47a1cd971d8e652531efc7eb7ed1e3b7953dbd25a0155b8688bf64f27cb7d0c1436887be5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482035, "uuid": "1ef98571-d387-44d4-97cd-df4e7b4a34e2", "value": "T15957CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC8B0E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482035, "uuid": "2d142eb6-cc70-4415-8385-f7945125a2d7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZEAoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482035, "uuid": "1669f160-fe69-45d0-ad32-1bb2984114a4", "value": 29589504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482035, "uuid": "68778bcb-37dc-4308-9c59-dcf8405addd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482035, "uuid": "b5e5a0b0-53cc-473a-862e-b5063691fa47", "value": "73cd25352ee3846cfba700a5b0cf908b9ab0efcd151e8ee2fc1324c5b713d08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff0761c-43fb-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777488342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488342, "uuid": "8fedc7f9-e2fe-4d79-8152-825ff5b17fb1", "comment": "Malware payload (RustyStealer)", "value": "954cde77f962e51124e6e248027f7dff", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488342, "uuid": "35643922-0e60-47af-a1c9-986b859cc9a6", "comment": "Malware payload (RustyStealer)", "value": "75729bc82a25434c0ecff58ebdefcdc0f461f5c8381e5088ffaaa2403a6bc061", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488342, "uuid": "9051895f-a0aa-4989-ab72-147a7dd2b056", "comment": "Malware payload (RustyStealer)", "value": "edc31af25696b6774fd4d08b45f46d5efe7862ac", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488342, "uuid": "d63f8c2e-56fd-461c-8521-a97747d20ed1", "comment": "Malware payload (RustyStealer)", "value": "91e05f6af5399b882c4fa25a3042460b6a1a801aa5dc66eaae56f782edb3794c4f058427f573b3fd7c11966f6e73ff92", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488342, "uuid": "3b75bd50-e431-4445-8caf-3adb3ebebe28", "value": "T12B659E92B2441F6CD6A2C27D8297923AB97932493332DFB709999D30AF5BEC54F0570C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488342, "uuid": "fb7cc136-2624-4583-acf5-75986675ee71", "value": "0b5f92f4d6635d03e5f7b86c992bd05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488342, "uuid": "8464d8b7-dbb5-4c36-b9bb-13ac74c2d89c", "value": "24576:EeaynrbNE5e0ws23nk/fUmIQTfeA8lsdwje0aViDFDT:TakrbNcws23nsUmTfeA8laEe0aViDFDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488342, "uuid": "1034b1b4-8a53-4cf0-995f-e89f8104d0ff", "value": 1526786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488342, "uuid": "5e3ad9fc-a8be-45b9-96ac-ecaa1a42e904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488342, "uuid": "e324d1e3-18c3-42e5-9f2e-7950f823b491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b716de8f-43e9-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777480650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480650, "uuid": "016e9be8-a573-403d-8e7d-3b85e28d4e9d", "comment": "Malware payload (CountLoader)", "value": "4f57edb9b2cc86c1b10b16674eaa958c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2041", "colour": "#CED7B1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480650, "uuid": "f2e67ea0-1733-4008-ba14-b55ddca1e857", "comment": "Malware payload (CountLoader)", "value": "760ff1234010dcf743620fba9441832bd3f46deaefd294a765a5dbe60ae7c094", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2041", "colour": "#CED7B1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480650, "uuid": "756e1412-b1a2-44b6-bad8-d83590a67651", "comment": "Malware payload (CountLoader)", "value": "5a7e6857b0e81f80345e842f69666da7a5678b45", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2041", "colour": "#CED7B1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480650, "uuid": "efbd48a9-756d-4e81-aae7-9243ca768e8c", "comment": "Malware payload (CountLoader)", "value": "d8b8d9e4335d85b1e786a788cfb3079547dace8a99de478de0721f60b40438ea52e30f49381971a6a768513161324a21", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2041", "colour": "#CED7B1", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480650, "uuid": "b5a04405-547e-44cc-a809-1a8e0a7d1f5e", "value": "T1B20733D20353DA690FDFCDC888606B377A2B123E4492664ABB0DD9FADE767410E31752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480650, "uuid": "f95566e9-640b-498a-b397-bbb37f4f5f4d", "value": "393216:w8Lk/J4QCPNgYMAngGU7Oh9mMG+/+NaGSjuK2f2JypZVqZr0AXniX:wweSQCPNrZ/lGSjuXOJAqZr5iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480650, "uuid": "da3f5a02-dce0-4ff6-9299-55eebd474cc2", "value": 17186499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480650, "uuid": "512eee0d-f938-44b9-ab00-e10761fd5d08", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480650, "uuid": "5088a942-cbc0-4c16-87f7-bec83ed70ccf", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43271ca5-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494629, "uuid": "c7b0020d-da78-470b-a944-58b5044c3653", "comment": "Malware payload (Mirai)", "value": "c7df06c602083f3ab288a5c286bcc366", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494629, "uuid": "6e9adbe4-0030-4cd7-aa58-10960bcec5fc", "comment": "Malware payload (Mirai)", "value": "76db6d7b7e7388d84001c5b43c7454023ee617be40c2d9bd79221273a3648cce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494629, "uuid": "677a9516-0d63-475d-9d31-6300a2123497", "comment": "Malware payload (Mirai)", "value": "301adf2a71b4ef81a7be6d94205837a8088496dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494629, "uuid": "0e7539f2-40e0-437f-a395-6be3ee9e1b64", "comment": "Malware payload (Mirai)", "value": "51bd64f622bd2deefaa2a8487331a53f2c91a6a74ebb2ad55570cb02bf022b97e0a5d4fb5f1931fa237473ca69e3e73d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494629, "uuid": "866ac187-9316-43c5-96ca-a483a8fe94d8", "value": "T148931C46B9528E12C5C212BEFAAE415D33136F7CD3EE7212DD20AF9063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494629, "uuid": "403ecb96-e2fc-4389-97fe-566ccca9e04c", "value": "1536:gUnBEkjRCMMZ0l3EVepOFnTRfGqtCMu/5hyHvhcY4smvVaZ6fEEarNQ7ibQZfn5f:KktCB0qVepOFndfGqtCV5YHJcOmvVaZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494629, "uuid": "8d688728-0407-4435-9f45-445ad80f55ca", "value": 96856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494629, "uuid": "f7a55024-3821-43da-b4f6-d266c27d860c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494629, "uuid": "3a46595d-5498-4e18-aa68-7e433940bba8", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af079e4-4397-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445357, "uuid": "5d64e133-b3de-48c3-a4e9-10baea79a3b0", "comment": "Malware payload (Mirai)", "value": "faacd44aa0ac70ba42044379e9557551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445357, "uuid": "76cb5273-68af-4fbe-8901-6bfc59acc9df", "comment": "Malware payload (Mirai)", "value": "78bd5ee553f84430afa3c432eb32482394a9682fb633c869dd4c91db25a0490f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445357, "uuid": "0436e889-9d43-45d8-8e9a-2d5fb7480fd9", "comment": "Malware payload (Mirai)", "value": "e40c89d0330dd4f811e45f3abe8354641e11762e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445357, "uuid": "233c1d67-7c59-47a9-8349-c8f667d52250", "comment": "Malware payload (Mirai)", "value": "9756cc9fccaf9903ba7d11e40093ea3c0f45fdbf5e4481efa932cee67f3802f7c7f1d3e42a17dbe8e653236520a9e41e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445357, "uuid": "9b0eab81-7c8b-4a2e-aa33-aa48d29bff49", "value": "T1A8432922BA7A1B13D0E4A47D21FB4B19B1B15ADE21A4C64E7D720F4FFF116806A43DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445357, "uuid": "573f5546-c14a-423e-879c-bd581b9bf8d6", "value": "1536:puzkK1PO0ZoDFGjJ9oShEtcfD7TFY/BQD:MHBH1fD/FKQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445357, "uuid": "1606af1c-6528-4261-b360-c1c989ba7403", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445357, "uuid": "0131ccdd-8629-45f1-8a63-aec6b836d530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445357, "uuid": "f3eb8571-881e-401f-87a0-5d48666303e1", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd95b58-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494860, "uuid": "cf57430f-2bbc-4e75-b967-91510a0ba7da", "comment": "Malware payload (Mirai)", "value": "1f559c97cbc6f7211627cc23ce447fc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494860, "uuid": "976c0c16-361a-415d-b5fa-721ec060e400", "comment": "Malware payload (Mirai)", "value": "7961b4118604a590c1889b7f1e9f29d2748d26b430dd392198b4a87ac1316cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494860, "uuid": "5d75df9a-d0a3-4320-a27e-5883452ec22c", "comment": "Malware payload (Mirai)", "value": "7cb51e95e6e382ba771dd40b2b005f59b74f4902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494860, "uuid": "3325f2ee-1c05-4cf1-8fa3-01939653dcf0", "comment": "Malware payload (Mirai)", "value": "060017a262aaade3df165707388ff812ce40ba907d90ff44076cbac89ce1d063fddd98e55ca79e5a4c3629da26d9b526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494860, "uuid": "3ed34ca5-143d-4b22-916e-9c28b2c3beb6", "value": "T1BF434B49F793E4F0DD060A71115BB77E87748E125024CE6EFB847E66AD32B12A12B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494860, "uuid": "276bce17-59c4-49f7-a671-fca42341b7fd", "value": "1536:ihzSZwjk11rwGboUa3WaU13180dwiYjCfxr:gS+jkXMW+bnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494860, "uuid": "4b371541-1b85-4bfb-9f81-9159e52e291d", "value": 59376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494860, "uuid": "e0830819-03ff-4fde-ada9-af9b3858626a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494860, "uuid": "85661308-9ec5-46f9-9fdc-2285cf609f1b", "value": "rage.x86_486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11c1790-4389-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777439435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439435, "uuid": "b0698a19-e766-4cce-b273-998253874eef", "comment": "Malware payload (Mirai)", "value": "ad6eac0ff9790f4c8a84ee2b4558298c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439435, "uuid": "b120c4db-a399-400a-8e46-cd47e06c51e1", "comment": "Malware payload (Mirai)", "value": "7975ce4557e0d273dd7a929d8284eb6649a354e00c64340800426a336e5ac97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439435, "uuid": "fec8ddb9-8e84-4cdc-a709-819553e78f0d", "comment": "Malware payload (Mirai)", "value": "91b7ad07e01d5ced314dd19ba444a5016228da5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439435, "uuid": "b847552e-2281-4d7b-813c-551f3095d7cd", "comment": "Malware payload (Mirai)", "value": "f4e3b4ccc8afe69a46e76b5520d7be127520b7d482b8c24b20c9862ba2a54504f1539e801420e352d697b2c1b464af73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439435, "uuid": "eccfd113-412a-48a8-a355-404c5abdb4ba", "value": "T14582C0326582FCA1CEA09C38EE3AC54763825EB4D1B571672B140BB177CAC54A87C983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439435, "uuid": "76b1c3be-bb58-41c7-b87e-529f701f89d1", "value": "384:VbqdLequjNry11Q9BAlrWg1OLz+/0wOkCxPReihymdGUop5ht+:x0LeqOyXplrW4OP+/m9xRs3UozL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439435, "uuid": "5bf86811-548d-46f0-88bb-28798c3901b1", "value": 18516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439435, "uuid": "2a7f28bc-4356-4171-9e60-180336fde7e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439435, "uuid": "a17f5e4b-b9e5-4ddb-964d-e129b89894b8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2262b518-4395-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777444323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444323, "uuid": "89a07a3f-dd62-45e5-bbd1-96e143a81922", "comment": "Malware payload (Mirai)", "value": "6f18af19816d8edb91271b7c43db2cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444323, "uuid": "216e2ecf-c1ff-4506-9e47-1b743d54c33a", "comment": "Malware payload (Mirai)", "value": "7984c6184f4e1dc5e2394b76852d41461db7f1bbdbaf70cc77aea76ad66f5582", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444323, "uuid": "09093092-06d1-4dd6-92cc-67a7052e3ccb", "comment": "Malware payload (Mirai)", "value": "d55a5da355bf3dbc0db2d6cf4be07beff7054921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444323, "uuid": "8b9a13da-c0c1-47a7-ad4a-c493624b10d8", "comment": "Malware payload (Mirai)", "value": "21da0bee932541e8d08d4b6af57f421f21c95771cea3431835eb7cbd293674eade221e9eeea04701aac8fd529133f7f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444323, "uuid": "72abb38b-ba60-45f9-bb24-7b33f9d3bc2c", "value": "T1EB637C23DD201E9DC25599B0B070CF799B63945582831FBB57A5C6AC8187ECCF58A3BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444323, "uuid": "7a980dec-5009-4980-b111-368a7dda4246", "value": "1536:xtKBzreCKfD2ypfskh+ZWSsu6RCQoEGzl:xkBzr4fhfsM+sBRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444323, "uuid": "3868e681-40f8-459d-ad46-d5954c5aa204", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444323, "uuid": "79fc8eee-946c-4bb7-84fa-e5e0557150ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444323, "uuid": "34d61539-21e1-4636-b3fa-c0179ca4b7ee", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cefc847-43e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777480579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480579, "uuid": "7ab1dbca-0fc1-46e2-ad9b-7d740bbeb0e4", "comment": "Malware payload (Smoke Loader)", "value": "e6db3da3772df3db0f6938a83d728a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480579, "uuid": "98b2c830-1c10-4007-b8d2-5cd49e9c168c", "comment": "Malware payload (Smoke Loader)", "value": "79c6d3c9a85c4dd9d1156718f0087e6012d7b332d316c56945be704c6442cb5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480579, "uuid": "93dc0e30-1a42-4c51-b767-18cbf7c14c6f", "comment": "Malware payload (Smoke Loader)", "value": "57953680a109f06718d8bb72740f5fda3ab5a333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480579, "uuid": "e6f41b7e-97a1-4224-b2d1-a61f86856982", "comment": "Malware payload (Smoke Loader)", "value": "f308f1f39fe7b0751b2e0339b6d21cebd388cb92d6e70c8e79ea75d0666c83d5fe2670eaeb042926ccf453392b770a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480579, "uuid": "90675c41-ea1c-4df7-a3af-5a13dd01bbe1", "value": "T1CCA55A4278D004FDC4ADB63248F276867B34B8580B3627D32E956A783E77BD11C76B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480579, "uuid": "031d1ec9-1727-48eb-a1ba-1d31412bcb97", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480579, "uuid": "bfd7b889-d133-4252-94fe-96c0e8ab51b4", "value": "49152:BC2tmLLNCq3QOVQLOFjzWBkQEWc89WDDRj3eN:BCQgp/QLcW+QEcWJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480579, "uuid": "5a4ca7ec-4f27-451c-b747-687ce54e6850", "value": 2204360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480579, "uuid": "cee62011-ed86-4b85-97c2-e736fc1fed99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480579, "uuid": "e53458af-0574-40af-afe5-6b0701f65221", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9515a90-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455421, "uuid": "3a107bde-47e7-4ba0-b461-bc224c31ba3b", "comment": "Malware payload", "value": "17baabc1df6b5ddbaa7d28c0bf52fb58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455421, "uuid": "b3cdaa6a-e24f-4e60-b0c3-43bd9d819eae", "comment": "Malware payload", "value": "79d1b6d418b1cc44f5665b1bb50e7d0626c276264b35169679c68d6ab7a9f03a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455421, "uuid": "29a290bf-00b2-4570-9149-42aef7f68ec6", "comment": "Malware payload", "value": "151cfdfa637f5b7e27cdf97a573a53367523733a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455421, "uuid": "bf538905-0bee-41c1-9e83-4cae7faf6f1e", "comment": "Malware payload", "value": "729ce987580dc442e3d72a253baef3e4294d886104780d69d099832bce3f32d062ddef4439404495202f344f29986a13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455421, "uuid": "6052a6bf-dc4a-4887-b27a-727599aaa8a1", "value": "T12A37232ADE3ED55F0236187C306E0DE962BF0A35105DC7B6CBF3F640182DD265A276A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455421, "uuid": "35e050fd-ead0-4a56-8c5c-b6a7bfb0cdce", "value": "49152:sUXPUXeUXQUXQUXvUX1UXQUXTUXWUXOUXdUXf4h6UXuUXzUX9UX5UXC4hPUXJUXc:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455421, "uuid": "b22c9d38-a4dc-4ae9-81c0-116e3a34b36e", "value": 23684333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455421, "uuid": "bdf84de6-33eb-486a-b999-dd09134ef156", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455421, "uuid": "6721f36e-45b1-44e1-8721-a906c612fc04", "value": "invoice-1645080830.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163807b1-43ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482957, "uuid": "f7d8c7ec-0200-41d4-8e09-9db81e27b60c", "comment": "Malware payload", "value": "6eee70924d8d0fd7c0f2956e3ff7f433", "object_relation": "md5", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482957, "uuid": "ae655a1b-ca85-4865-aed2-c62690e717d1", "comment": "Malware payload", "value": "79d5249d1893ab6ad1280369c7b846cde6a16e59ccda328449284a8b313770f7", "object_relation": "sha256", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482957, "uuid": "29998e34-85de-44bd-87e0-4891dcd6ec75", "comment": "Malware payload", "value": "3c5f409fa408523b071104cd52267524a76ad575", "object_relation": "sha1", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482957, "uuid": "939d0466-f87f-4a5d-9e8a-e3d66af94e55", "comment": "Malware payload", "value": "b75e2cdb959c65274d0b16492b420d3f1a4f1bee9d2c8919fcbf338a9e342b520351a6e3a1e64aa566382c69e1c38e38", "object_relation": "sha3-384", "Tag": [ { "name": "can-vg", "colour": "#5CA134", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482957, "uuid": "7576ad51-9b26-4a32-a565-ce7d41e9a91b", "value": "T1008231A317C90EAE9AD189D7C15AB606A8EAC47F1C2D12CCF5E14647B03ED24B715F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482957, "uuid": "204b1e9e-f388-42dc-97c3-20457af2c334", "value": "384:sFXAMpdmPjzhNsJo0cUEnZ1Wuh3LRjgd50g3PHsi+:sFXAMpwXhNgwnZxh3Lm50kki+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482957, "uuid": "4f3bb7af-6026-4895-885d-b919b0501f73", "value": 17996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482957, "uuid": "69ea2f49-0a94-4af4-b7f8-1bb559f729e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482957, "uuid": "d2af17d9-16d0-484c-ad2b-9e0ecc3a49c2", "value": "seo-following.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb45c75-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470591, "uuid": "2939f5ed-3814-40b0-bbae-17d0dc8516a1", "comment": "Malware payload (Mirai)", "value": "35703dc804ac1757adc31fcfc36a1f00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470591, "uuid": "066f9b11-1c3c-44c7-b49c-a30f3bd33cfb", "comment": "Malware payload (Mirai)", "value": "7a568b446b245f59f1d346dcc1e55b6b4eb1dcb54ee4531b4e2f6b306ca49b9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470591, "uuid": "b8fcfec7-ce71-40d9-9c5d-ff7b7808bcb0", "comment": "Malware payload (Mirai)", "value": "85b691718cdab37ffcbdf4429b60ae2f297b0c62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470591, "uuid": "f9b03f99-32da-4a49-a311-2de298c19686", "comment": "Malware payload (Mirai)", "value": "ebb47a7cf951a45fd7d7445ddb7266ae1ac66510ff9427ddd7096668ee058f39a4c01db192ee87f34e14068bfe932d9a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470591, "uuid": "213387de-4980-469f-8804-9bc4dea3f289", "value": "T14C83E942BD429F13C5C221F6FBAF019837266B79D6EB3242D931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470591, "uuid": "1272cf94-7e14-4443-a3e2-0e018387457d", "value": "1536:PKDLhQ3BlLywjmConIxqPONb6uKBJw3Q2LKvDHytGwoUi+j0AnWPfn7a:PKDqXjmConIxq2B6uKeL4DHyOAWH7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470591, "uuid": "4d388ec0-7aa4-4f76-98f0-5629cac19a9e", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470591, "uuid": "14cae414-9b90-4a0a-bb75-a468d1ce1b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470591, "uuid": "ef3a2242-3c87-4cb7-8cc0-d0aec00b245a", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaca9ee-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490031, "uuid": "098d73fd-cc27-4b94-b697-f68bb93e7cec", "comment": "Malware payload", "value": "82b8795ee710e93f8ba36063c4577a00", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490031, "uuid": "3f006147-43b4-4d76-abed-9f86bdc45d9e", "comment": "Malware payload", "value": "7add4d6431d5404127b1bcb4d75366b1376d0073f0259f9158be6362733b10c7", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490031, "uuid": "138e1000-2b75-430d-91dc-3ed007873c5a", "comment": "Malware payload", "value": "26a4af61004b44737867514df77b4836d10a6ccc", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490031, "uuid": "e5b0dedb-707f-4f78-b263-8d7d5f17699e", "comment": "Malware payload", "value": "be1a00f25374554bbd491bd16f08aa527757b61c9652a1c41bbe2ff033e5956ad0bea72aa33cb6d44a939a5559ec2659", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490031, "uuid": "de095f8d-31f3-481b-aad4-bcc33d086605", "value": "T1CBA28E9DE34F499C81D62EF6B93A48E8DF9848C40DD06657E34FFB213C4A919E8680F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490031, "uuid": "cc643a03-5d03-4fcf-b752-e8ea9e4e358d", "value": "384:uIsXG9Uwu0T7rI/tAiPfkaEBjjSqgfi52JuODgVn+9fcEE2IlrT4ZAl+X2N9Fcla:uIsXG99TAjkaExSqgQYw+dZE2IlL+X2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490031, "uuid": "b83f4bbe-4f58-4364-9af7-012047ca5467", "value": 23248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490031, "uuid": "2b58b665-54c0-4fda-9a4d-8e2a73f248e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490031, "uuid": "62ac0fa4-45df-44c5-acbf-2eecb537db59", "value": "ecite.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a77c556-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455557, "uuid": "bb97e695-f387-4aa6-ba0d-023268d3b9b3", "comment": "Malware payload", "value": "ba4c814cf82792c722709265aaf8d7c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455557, "uuid": "e1583387-fb1f-4855-9c12-133d120263b1", "comment": "Malware payload", "value": "7af78075171e3e089449a8f0f976f00c527e552b2f5b4f19dd130a83685ce49b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455557, "uuid": "c813d9fe-55bb-4a86-9b9e-b5b4b0d28d4f", "comment": "Malware payload", "value": "45be0e888da0a44668247e4363e543b4ef4fb59e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455557, "uuid": "84967e4a-fa04-4f90-9c83-81fa6eaea5c6", "comment": "Malware payload", "value": "627e328b4447ab6a2feab520bae5785b90e63ff800f1018c3af9b9cd6dd318bc61b35ae78a43bc214c71dc76f4d24334", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455557, "uuid": "b2d1f056-fdca-46e6-ae67-0d592cd92451", "value": "T11237230E5E2ECF9F0674256C047FBF5F2AE9542224D28EE03BBBF462474E685148167E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455557, "uuid": "ffa70bf9-01f3-4760-a9ed-2178bf0e84ae", "value": "49152:+Y8Gb9vFMIDWOjHQIWmtNNjHQ50IYnalPPy8U2PejHQ2jHQNx36jHQUZ1yYJJCKT:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455557, "uuid": "cd0ce99b-6003-448a-8676-7400f6de8d9a", "value": 22643828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455557, "uuid": "9777b9b8-b5bc-4781-97d7-f74f24326bc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455557, "uuid": "ecbbc29a-d0c0-4f5e-9a60-21731362c88f", "value": "invoice-1645080830.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b09f9f4-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777488978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488978, "uuid": "74314cd4-c21b-439b-a9b4-a2ce892ca9f1", "comment": "Malware payload (WeedHack)", "value": "ab0d693a021e2343728eec4aa47eba66", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488978, "uuid": "f24589e1-2978-4f48-ae4b-d121d703c495", "comment": "Malware payload (WeedHack)", "value": "7b090a4f81dbf363d892ca3424df0abef3b3671420b0fa9f8ca7f13a78463e50", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488978, "uuid": "352db71d-130e-40c7-86cb-5db247b77cc4", "comment": "Malware payload (WeedHack)", "value": "0dcb303622dbaf45c73ae97c97717d1864b731d4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488978, "uuid": "4033bb5c-c820-4336-913e-5b6a5897f81e", "comment": "Malware payload (WeedHack)", "value": "4e4c9e19d1e67fb78cc9f7836ce5396305ef3391d7a0a6d0a32e5ad669a539aa17470bf0bb550894ee48bd4a2739bbc6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488978, "uuid": "ddbfbbc8-55d8-4a5a-9905-96e9dec2cc4b", "value": "T1F5028D975FF9C62CE1066C359A1169C0722D5BEA41482D3FA69C7AE4A0F59CF2302CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488978, "uuid": "970a6f8b-3ca1-4b70-91c2-475ddc6fb8c1", "value": "192:KBiOMQD4HUxk94eN54cS4cgeBvhqFlx+/ptUa4nr2:giRQAUxK4eN54jpIzx+/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488978, "uuid": "f67f3c6c-9197-4729-ab7a-1c5155503150", "value": 8941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488978, "uuid": "c47d5144-21c0-401e-8d6a-525a6c22aa9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488978, "uuid": "8be51650-f486-4c21-b9cf-511de003942a", "value": "DonutDupe Utils.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2827b5-43b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456880, "uuid": "b0c6198b-63b2-4086-b542-ea6785629453", "comment": "Malware payload (ConnectWise)", "value": "af7a84aeb3d1ef5b2c4feae1669a1044", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456880, "uuid": "e6d5e590-bead-4d16-8b08-6e86fae155ed", "comment": "Malware payload (ConnectWise)", "value": "7b382d57978651b5a3a03d91ceafab42c79b4cc690c7e520f7fce3af19b735b9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456880, "uuid": "dca2206a-7fe7-4ecb-aee9-da6be9c7e309", "comment": "Malware payload (ConnectWise)", "value": "089ca3483f51ee4973659b0e6a5d5c495502de37", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456880, "uuid": "3eafcbfb-729d-4a3d-b0e5-401514f38d22", "comment": "Malware payload (ConnectWise)", "value": "814709f777c5331a4bf3f4d3157c3b06ec2b86e1848a08f69eedf7ef08ea70f178d79566d042b0c97c51a85616c13ac9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456880, "uuid": "71b411f2-63d5-448d-a7a1-8b71a4c04764", "value": "T157647C11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456880, "uuid": "7bb7b005-cad7-4dfd-8474-1c4dd3d96875", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456880, "uuid": "d88d11f9-1ac1-4c9d-8815-f74575071eb8", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:B1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456880, "uuid": "0e4e0ece-180f-439b-8245-fae4f94a5524", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456880, "uuid": "8e7ea968-0bc2-425b-9626-2d0acd41ea31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456880, "uuid": "7a179a16-f994-4084-a179-499a25d6dc47", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3f7389-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777479747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479747, "uuid": "c5a905c5-db7e-4012-9e72-3b4900a7042e", "comment": "Malware payload (Amadey)", "value": "9748ee207d22e6d74466f465d0a6a69d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479747, "uuid": "70227bcf-2ec2-43b9-bf34-848f5b86398a", "comment": "Malware payload (Amadey)", "value": "7c04168c29f60968ab1c73db41666951c376d7a66af0c8b5a46103476396f050", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479747, "uuid": "294347a4-2e36-4579-a299-79d61866beb4", "comment": "Malware payload (Amadey)", "value": "e4ef86696d44530f30d577bf3c15d7a45b117aea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479747, "uuid": "05cac1b6-f726-480e-a51a-ff4eccabccf5", "comment": "Malware payload (Amadey)", "value": "fd263135e210727ed44234f70528ce65b5fe6c11cae727fe7f08ab241b0b30f72d50501cc3eb6f9d3729f85f7c00b388", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479747, "uuid": "1cce1490-dd9c-4606-8405-e8a990eb0c06", "value": "T1243412C3DBF67E5AFC60243CC38638AA68B1039567F19FC421F1182B68A8DE665455CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479747, "uuid": "0fbf68ac-13a9-480d-a7fc-426c1776aac8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479747, "uuid": "76d8c482-d7e9-40ef-b4d0-7d4ab61020ab", "value": "6144:AFdO6HN84UQuQm3ezuysZImBH75l528VZJMGzwjBwZx:AHRNu3GuHZImHl528VvzwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479747, "uuid": "425a9994-6e49-427e-89c6-ef6365e59bda", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479747, "uuid": "2bae7a24-493e-4300-93d8-257f10442c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479747, "uuid": "1dbef49c-4c1e-4efd-a15b-f1f2671f82df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d8edb5-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777484894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484894, "uuid": "e46b3d67-afa8-4c97-9bc5-14814574612e", "comment": "Malware payload", "value": "460b1e018b551618d6eb6d78d1c36864", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484894, "uuid": "55ed7c75-6721-4a9b-bd34-3182850a5dda", "comment": "Malware payload", "value": "7c12279f40f9f47fc200b813a38e078e2a385ca6da51a05cf15e0e96aeb33a9c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484894, "uuid": "861e5fcd-99e9-45cc-a0bd-d711cf9ded14", "comment": "Malware payload", "value": "34ac63aaf23e2661619114fb44220345aa191fc1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484894, "uuid": "8b33595b-ee52-4f00-b669-d295b2cf5333", "comment": "Malware payload", "value": "24b1b03192023420d198788d5318e88b8bfc675a3b034185a42f108288697221ec099f4f020434c272792b0c0963e62d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484894, "uuid": "0d9edded-b22c-4bec-8507-f487e655d5bf", "value": "T11451B4D421C8613E7CF6D62E72E5D066B0A0645369EF2F0CE8DC35A589DEE046E40F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484894, "uuid": "8fc815bb-2cb7-4aa7-9154-682854326214", "value": "48:vpG/Go0MspGKGv9lMspGs0GsFabMspGN0GNFLbMspGMG9ZMspGwGJBMspGGOGwIa:v4eoDs4Bv9ms40aZs4NDMs4r9qs4PJCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484894, "uuid": "058a7bdb-0da7-4974-b55d-a1c97d97bd13", "value": 2835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484894, "uuid": "148892c6-b087-474a-82a7-50bf1d75425f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484894, "uuid": "3317cd25-1514-4195-a8ea-a0410ca0a24c", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b48fce-4396-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777444991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444991, "uuid": "14d772c2-6e98-4eff-92df-b331388f8f4e", "comment": "Malware payload (Mirai)", "value": "9a865af0e5b4d26a086616b7bff5db59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444991, "uuid": "474e9281-c600-4b6d-b4c0-26bc1405cddd", "comment": "Malware payload (Mirai)", "value": "7d618084951c4f7b62868410ce1bb24e50decf61fa86ba701fb4074d831f2d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444991, "uuid": "db25dfbc-eb28-4ff1-873c-761f45fba429", "comment": "Malware payload (Mirai)", "value": "44ac2cb4973781ea2f30d458529a9e34a21e4111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444991, "uuid": "c2b2c7b2-9ec0-4397-9b95-4dc4935fb6b8", "comment": "Malware payload (Mirai)", "value": "75667d2d326cb1ed23867d7ae6935f5dcb55038046312561b74e7a09311c738f2cf9b59b416548232cb5eb8e756783fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444991, "uuid": "d7504e00-0be9-4523-8550-0c37d3f20fc3", "value": "T150B3B71A7E21DFBBF169827047F38B70579976962AF18585F25CE7081E302CE281F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444991, "uuid": "9c834dd9-6994-4acd-8384-389f688fe97e", "value": "1536:ael3pzBSyzgWgMHUC6peqcrl99rHGIEsYWQfPaY:agZz//HzJ9xlE9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444991, "uuid": "aeb3b774-b506-4b66-b662-eb6bbeaf55f3", "value": 112472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444991, "uuid": "ac273c5b-2095-4517-b51b-f52fd6d1e881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444991, "uuid": "1951dd95-67e2-4f95-b129-89d36500e54f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff610418-4381-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1777436103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777436103, "uuid": "3a3c68d7-a4f9-4463-9a8e-cf4f9dd0806f", "comment": "Malware payload (SnakeKeylogger)", "value": "1d7b384787323717b4ab7364aa2162de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777436103, "uuid": "a8980eee-84f4-42e4-813f-80a1b578d4a8", "comment": "Malware payload (SnakeKeylogger)", "value": "7d90636465939a1a5782cc67053d0bed02988df0aca5f9b39a36d2799b3f2bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777436103, "uuid": "7ab028db-a6c0-47db-9875-76109d5e8a28", "comment": "Malware payload (SnakeKeylogger)", "value": "b742ebbd1bd34f86999c3a437dc072f4b52e9c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777436103, "uuid": "15247b03-f36d-4301-be59-33a415e5c946", "comment": "Malware payload (SnakeKeylogger)", "value": "ec336ea8b6beb66ec25818ec328cd3be424021292e72785df60955952b08ba5ee6469d967d515aff57c5e3150f96c7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777436103, "uuid": "f629ff1c-87f9-42e3-9028-f761ab2fa63d", "value": "T10775AF15F3C85B98D46AC534CA2B9722D2B279260771A1CBFE9533592DB3FD11B3A302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777436103, "uuid": "49a39180-a412-4bc1-b0b0-647b170cea34", "value": "e69ec9920252efc67032a564d752219a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777436103, "uuid": "d9daefc8-34e6-40d5-a2fc-171ad9296bb7", "value": "49152:V4bsJKvIIPlIFdWA0TNsmor79O3wjYurdt2:mC6NTor79O3wjYurdt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777436103, "uuid": "24032d9b-2e40-442a-968a-ace9c795183c", "value": 1576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777436103, "uuid": "902815a5-f162-4b59-8ace-918cd19db4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777436103, "uuid": "99b40f75-a2f8-4971-99a9-480495c77fc8", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f174c5ab-4416-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777500075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500075, "uuid": "a68c2900-ec36-4f5a-b8e6-cc963dd8d641", "comment": "Malware payload", "value": "e91d53823bd21e32b0ed09b97fa1bdd5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500075, "uuid": "f77c0dda-88dd-4e48-8811-58240b5fcb9c", "comment": "Malware payload", "value": "7da05b41ad99763a6506eff14d99ab9b572050bce376df6fb631649302cee3e7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500075, "uuid": "c59d2aa2-30c6-4571-a73d-51494e029b55", "comment": "Malware payload", "value": "efe4fa10e7b386990ef35cb91e8c26bc7f64f3c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500075, "uuid": "4557f867-25d8-426d-a0b0-c6b66a9a2af0", "comment": "Malware payload", "value": "d6a807878c26dd8f6efc6b2cda7036d8c1cb2322b4f364c25a67f12e19c318bb60cc58eaaf0b9140538882d0485b2f70", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500075, "uuid": "2d48d338-bef3-40ed-9e13-8e793a2ff2c6", "value": "T1D413D15558A32A31C2D109376FAEA209C2EE1BD1207A305E07EDB2D5DF675F3D6B4C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500075, "uuid": "c515ec5b-a58e-49bf-a845-a2872b865381", "value": "768:jXGBvwESElUxyXcTYDyN2++ywtZWDxT9So8A3mHCQg8u6OrtaQmdBOCIHB8KXX:jP3E6SQCCOZWN9f8YFj6mmdPIHzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777500075, "uuid": "d58984b4-ce89-4729-a657-29c24ee59a67", "value": 44869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777500075, "uuid": "101a24a1-491c-4c73-8e23-0de2d283b50e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500075, "uuid": "78bd12db-d2e5-4c26-96de-69f56d93187b", "value": "5521_PDF COMPROBANTE DE ACCION DE CARTERA_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad36884-43cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777468577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468577, "uuid": "37b11e6e-b1e3-4efc-b2ad-bafd7d6a3df4", "comment": "Malware payload (Gafgyt)", "value": "be0a37141306be9f2a4722492e516348", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468577, "uuid": "7c0aa000-1c9c-4064-854b-e60ca3e5f072", "comment": "Malware payload (Gafgyt)", "value": "7da9a5cea45e761fa1f0cb754e8203d468fab84d0647a53f2baf5e325b67301a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468577, "uuid": "c1915b30-55ac-4327-a622-4a84d313c168", "comment": "Malware payload (Gafgyt)", "value": "413fa100fa132f3e74b73d95351c2edc646cfd83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777468577, "uuid": "2804a3fe-e38f-4501-beb2-1c83e66de9e4", "comment": "Malware payload (Gafgyt)", "value": "52f71db63d8944e881d00b9dbccccd594ee11a66c18c7ac32111d0eafc0e8b49755bb69de0512d44f2fe24625615dd6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468577, "uuid": "2ff35ba7-db71-4e56-93cc-d055b51a70cc", "value": "T180157C9BBE5E3C07D2E7E23EAB4AC3B0522B7590D31351677582032C99C6ADCCFA1651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468577, "uuid": "3c25d5b4-d370-4f69-bc05-9c6730f584c6", "value": "24576:zUUq6qH9YN5uenP+gs7dj/j/kHVDHS88:zs6ZPO/jcHVDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777468577, "uuid": "fd66c0b3-b263-4eab-a4b1-657d9bba865f", "value": 936088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777468577, "uuid": "8d675c68-c77a-4957-95c9-84e832c3ca6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777468577, "uuid": "936f2517-02c6-4546-bc31-97cd993dc22a", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097dbe9-43f7-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777486357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486357, "uuid": "e9e74328-30cf-4a6d-9f20-a82c1ae029bb", "comment": "Malware payload (AgentTesla)", "value": "27867a22bf7bcdaef977d967b2737a76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486357, "uuid": "0b51946a-4761-4641-858c-da6fdb20fa91", "comment": "Malware payload (AgentTesla)", "value": "7e29c0706f16531826a1f621829e47fa6660b500c88c054fa5cbb42255c4e1db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486357, "uuid": "5db05604-a182-41d6-8d25-bbaf54d5f8e3", "comment": "Malware payload (AgentTesla)", "value": "fedf8a0a6742a00e365410ce4c11a31ef4bdfd60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486357, "uuid": "614cecb9-c5ab-441a-b967-34dcec3832c7", "comment": "Malware payload (AgentTesla)", "value": "085a92783a3958c73dc26979201871e1268679db0b2bb47c7378c417aae3c148c04538351c637b6d47f959929d93a019", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-abcebikes-com", "colour": "#01BE49", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486357, "uuid": "8ff29ac2-bdf4-44ed-84f2-9a0e1a3fd55a", "value": "T1EE65F12156C02EA48B9E271D60FF359AE7E00A8E7415694FF722FD46BBF7701A3021B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486357, "uuid": "5f371cc3-749c-4237-801a-3a58515d077c", "value": "24576:DvUAwobV5UqRwtzah56x7o/dEaLNeXOvH7Oz6ts:D/glpNOqeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777486357, "uuid": "fbac3bba-8010-49ae-8837-cda01e2bf472", "value": 1527148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777486357, "uuid": "60096422-1b3f-48f1-9082-d887d2caca41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486357, "uuid": "432b515d-6f90-40cf-89b7-7389c6b13b71", "value": "Transferencia bancaria correspondiente a la factura 204A con fecha 28032026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aaed5f-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479995, "uuid": "7eeccd60-5492-40a3-9f1b-67247608cdb5", "comment": "Malware payload", "value": "a5b2c7cfec8e7b71ff19505edda4f792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479995, "uuid": "89359a8b-1763-4f4c-8020-4ea54b530639", "comment": "Malware payload", "value": "7ee03083416ea73e004b75a389fb5c1f55e7bc00d305222b0756f1a8ea1135ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479995, "uuid": "1bd80f89-5374-4458-ad1e-4dfa2f0d5884", "comment": "Malware payload", "value": "82af038da99a3cb34e2410bae7dd3516cd711b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479995, "uuid": "2e8db794-f1f7-4707-8132-ec9cb8d37508", "comment": "Malware payload", "value": "2241576ffcece5aaa498c6de2dfa81482aa28572b0b5f0a0b1ff561d25407e079ced7cfd76f07292ac8f41b34fc029a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479995, "uuid": "246f34c0-ae48-4f8c-a5db-83e2e589494e", "value": "T13CE733739E4C9C88D5CB1E7903AAEF516A996E524C32150BDD8CF6C376AF8C50A0B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479995, "uuid": "15e8a385-659e-4a4e-9871-f0102ff237d1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479995, "uuid": "56d4c93e-b860-4352-aab3-340f1779104a", "value": "1572864:065kJo/13rQcTe/FEd67As/ph6QSoXUwNSyaGtsfYHldqJ:0i/17QcTeOd60shNVXUwNbay6YHeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479995, "uuid": "1349e5cc-5f47-4961-b89c-aa10efab7bc0", "value": 69959384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479995, "uuid": "de47547d-4be8-4529-ac03-6c76d72969cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479995, "uuid": "93aaf3a5-4914-4a69-83fd-34dd7ea33796", "value": "Install_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e817d2fd-439f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777448949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448949, "uuid": "62b25bb5-8eda-4474-b22c-dd94075f6275", "comment": "Malware payload", "value": "69a8f7d3ff0b0438aa4d8049bc6061b9", "object_relation": "md5", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448949, "uuid": "44c7848b-c9df-4ddb-b4b7-bdc9359e6130", "comment": "Malware payload", "value": "7f0431bfd29e1ba71f07ce67aad94f2b2536e6fb7eb61c92554356b664756d5e", "object_relation": "sha256", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448949, "uuid": "6e59ac8d-78e4-4ea8-9452-b50abaa2bde5", "comment": "Malware payload", "value": "72523ee5792d7f1db6a7811c5b025f2ac0e4edb7", "object_relation": "sha1", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448949, "uuid": "8a358f09-8daf-4eec-a3d4-362f7ae17808", "comment": "Malware payload", "value": "6079e20b605bf63cff8c57495191ef38692d9199e081a7846764677f82ae25989c53d1a8c358c45fe7e7f22d8a256eb9", "object_relation": "sha3-384", "Tag": [ { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448949, "uuid": "fe21ea78-d19f-494e-888e-2b3d2c6a8506", "value": "T1DB544A243AFB501AB1B3EF598BE475A6DA6FB7733B06545D1090034A4B23E41DDC2A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448949, "uuid": "5358d120-8a41-48a5-95c9-802f38c48096", "value": "6144:zUyE8y1hH0yZuj+oqSWz9H3F7Q1fValiXOE4QI7JAh9PDVz2pomd:zCDH0yZuj+oqSWz9H3F7AValwOT7JAhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448949, "uuid": "be995763-89d0-413e-8b7d-eb09d23c794a", "value": 279144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448949, "uuid": "1ba99efe-0ff7-4ab4-89d5-2021f96d9e47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448949, "uuid": "adc2aeb1-87f5-4e4f-b99b-9d10aaf48762", "value": "Sales Order - Order Confrimation VR 14063130878526 - 0061-26-EXL-Q_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3412a0e-43f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483704, "uuid": "8c6206bd-7d97-45b7-a64c-25dc42c9b833", "comment": "Malware payload", "value": "cd4498de5256187c30b00af658e3342d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roadflo-icu", "colour": "#3F1AB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483704, "uuid": "42569dec-11ce-42db-bb57-fc233e0fbd8a", "comment": "Malware payload", "value": "7fad7dc28d928df12498a043cba620d37de8e10ede4c0ea9725550d9f6da4c49", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roadflo-icu", "colour": "#3F1AB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483704, "uuid": "01cba9a4-d3b9-4f94-98bf-4be1e33c6eb8", "comment": "Malware payload", "value": "3c520ef35f12eb4b8e1b25098a1769a1afda128e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roadflo-icu", "colour": "#3F1AB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483704, "uuid": "9eb44210-82dd-4a73-9062-d52e6e7697cf", "comment": "Malware payload", "value": "e8a45de5476a1187d4b77e66acfb51ef3b5ad4413cc4d2faf35f1cabace553dc3c346fd521c2b6c763eb1edfe64bfeb8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "roadflo-icu", "colour": "#3F1AB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483704, "uuid": "f17c1514-1690-4f1f-90f7-cc946a4243bd", "value": "T12DA55C60EDD344B2D543363252A2726B7735584D0F3EE7A7DAA16DB9FA3F2860C23205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483704, "uuid": "55272705-60cb-4b11-a6e5-a6affd8d9787", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483704, "uuid": "9bed5893-a235-4422-9a95-bd5fda63fe0e", "value": "24576:x1i2q+zNQftYBreaz1Zt6QA14+dm4Xk7lLiXeqM+8RXHs7QGVeFazkx/EJb:xQ00sVXIiUdDzkx/EJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483704, "uuid": "17bb35b3-62c3-4819-8707-28f8633fce7e", "value": 2180296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483704, "uuid": "4dbd5421-ed6f-4d37-9030-328cab2a50f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483704, "uuid": "5b728ffe-bbe3-41d8-9f93-a42ecba58f53", "value": "RiBf3V4Up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c5105b-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494989, "uuid": "e6a822cf-5a6c-438a-9186-ad603ef2e4ab", "comment": "Malware payload (Mirai)", "value": "612a05f6a857c1a1689d07d6502847ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494989, "uuid": "7d2c20ca-de09-4f4c-b769-b5d9f7d442ea", "comment": "Malware payload (Mirai)", "value": "7fd715259c366bb7009b5f4f5826ee7346233c8c217b16bc1833486fe330d596", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494989, "uuid": "230dedd4-1e65-4f05-bc3f-66aa642885e5", "comment": "Malware payload (Mirai)", "value": "e46a53bebf9d22c2057f889764b062baf64a791d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494989, "uuid": "383a36ac-609b-4141-b209-05945b8a69cc", "comment": "Malware payload (Mirai)", "value": "047a6f480b5f19c8f50bacb6cb11223ef07d5fbbbf3af4edf298fc9105f933fbad3a769d6f563b794ff27b0d2a3f7516", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494989, "uuid": "017bd5a2-5f87-43c7-80ff-b124def16e38", "value": "T143831A0377090F03C16329F0267B1BF097EABDA519B4B284755EBEC59271EF22186F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494989, "uuid": "a5514415-e3da-4879-b9ea-a64dccd40bbb", "value": "1536:9L7tgTewtH/OoQQ9F4ZcNAHeS+/PqU+mmJKlhv2qMQXrzsp9l:9af2oBKf+DmXqrsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494989, "uuid": "0b4a6fe5-bfbc-4944-901d-2063270c54a2", "value": 88724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494989, "uuid": "76b6a1f3-6679-4b88-a1ce-2677b3b0f5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494989, "uuid": "1c22910d-f66f-4e9d-985d-9dc2b72a7137", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766f8121-43c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777464650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464650, "uuid": "b111a245-0b47-48ba-b95d-218aea85fecc", "comment": "Malware payload", "value": "f11bd2f683d7aeda6257c4ffc809dd9b", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464650, "uuid": "a2fcf9cb-e8fe-4029-9828-aaa516322415", "comment": "Malware payload", "value": "80553effec12cfea2d6f7bf8648e98a6b45635ac92906ebd2346a7f4ef9ac3a0", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464650, "uuid": "1fe1e78c-4cab-4f90-bba4-b04ba02e6022", "comment": "Malware payload", "value": "b30b0c44b1aa0f0b9e5acf15eb9e388d39b60435", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464650, "uuid": "da30578c-5d33-4b95-8ff1-4ffb3046985f", "comment": "Malware payload", "value": "a5e2bbcaa23a5c8ddf35ad900de0eac34c7b984a422fbde258a43711b4a43a2988d3211beccbb8446322dd2fb941f6e6", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464650, "uuid": "856dfc38-1110-4c87-b682-3ba155e45071", "value": "T1D7083384F5B9125DCC39C73DB69C4A56D704862BD07BEBA5BE76E28034CF0A28BF4245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464650, "uuid": "ab929c4e-5879-4388-87d6-5dd290646418", "value": "1572864:SpZS5Rr5Gi36YcejvemuWH6wFmM+IW+vQ1mRXTftQ8VkzmfqgLs4:S3qr5GiKP4vrN7YP+vEmFF/iaqb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464650, "uuid": "083a71aa-9df0-4e62-84f7-233e720fbf3d", "value": 79329687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464650, "uuid": "1f548ac9-2ef8-42e1-9c68-2e0753abd8f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464650, "uuid": "1b753fc6-4908-4c89-b23f-73ccf721e285", "value": "document", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e6e4b2-43cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777469290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469290, "uuid": "7cdc8afc-6e9d-4150-a8e1-5cf36e5d6e0f", "comment": "Malware payload (Gafgyt)", "value": "dfa736ffd9f0a76daba1630e4a797cea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469290, "uuid": "1049d19a-dd0c-42d7-8c46-052aecf46a9b", "comment": "Malware payload (Gafgyt)", "value": "8180da36f21c20510f37cd2879d8bfa1a2867a24046bf70a91faff8df5055371", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469290, "uuid": "bb881dc9-13a7-42a4-b8c8-1d5913131e6f", "comment": "Malware payload (Gafgyt)", "value": "02e518ed1721f7ce10a243e6fcacef186660ff23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469290, "uuid": "45f137ac-e16d-4117-9593-2256dd6cc21f", "comment": "Malware payload (Gafgyt)", "value": "b6cd31a9eb5396437eaa8547e7cdb6942b69389dde661deb757b233460ea1fbbb64a9f94bb3753e83c0bcae59909ea72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469290, "uuid": "3f3c4118-5630-4565-8b0e-2ac51d5fd10f", "value": "T19EF4BF53F2A1EDCBC0564B7A042AE3308357E5A21723F680F63AC3581E63659FE4E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469290, "uuid": "a12d69ef-3692-41f4-96b4-8ad4be8e3de5", "value": "12288:P298l5cUZW64IrDf9Ek6TaAQuVrTVywlv/x1XX8pBjPmn8hX7NENNr6GS:o64IrLI2AJr1/IPFX7N8Nr6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777469290, "uuid": "e52e7866-d99a-4fce-a65f-81177a65e5fc", "value": 755044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777469290, "uuid": "c8c4765d-5e7a-4f1c-bb35-f9ba9f75941b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469290, "uuid": "1c445137-54e8-4c5d-873b-5d4efc7e11e0", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d044f3ca-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494865, "uuid": "941c80db-47b5-422a-a6da-58da72142372", "comment": "Malware payload (Mirai)", "value": "21513fe48870c8afc0d699e65f84226a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494865, "uuid": "8c6d95a9-1206-4918-a4cd-a9289ae96fa5", "comment": "Malware payload (Mirai)", "value": "8219a545bd7c5d309c6e2edac4251cf39ea77eceb98726601f2491d67e7dd99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494865, "uuid": "690d8878-8a85-4868-85a1-0b26776ffc5b", "comment": "Malware payload (Mirai)", "value": "e43d74b476b6a410b916ab9f13b553030477c820", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494865, "uuid": "48e351c2-5da5-4a51-b4f5-3f82e8aa20d7", "comment": "Malware payload (Mirai)", "value": "ac710e1da281c21a0b24b84919e7d46d8c48ab125c8148b13aa93cdd5a43ba4074a3ad1cec7c3367053281e409b73893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494865, "uuid": "75766dd1-feec-427a-a214-965c2ef80bd2", "value": "T1D9738D8AFB83D4F2F8E305B1517B53668733D42A6426DB42C72D6935EC22A11D72B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494865, "uuid": "c44eb713-7258-4000-b227-f41c756b9755", "value": "768:xN/KISvOUO389NdNjFP/nprpIo8FJY4lk7V+Ndk9s/SnfaPWAMsjpcKmm1QvI+0F:DSIWe89NvFprp6DsSO8SiPZLmiIGso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494865, "uuid": "b23fd853-797a-42c9-8eca-010ac51fa57d", "value": 76088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494865, "uuid": "110939cf-5d6e-48bb-88e8-f45a721ce5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494865, "uuid": "1c6e23b0-b06c-4022-9f14-bdcfbfcc29da", "value": "rage.x86_586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61823330-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455595, "uuid": "ff082b28-75ba-4a08-9781-673d10e48b4b", "comment": "Malware payload", "value": "3af7779533a05db74b7da023df7b3401", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455595, "uuid": "13c612fc-b7b2-4bfa-a59a-4f008bcca486", "comment": "Malware payload", "value": "8220cf91c2eff01e52765c32f7ed4366287cdf2bb6dde839fe4cac5f7c2df4a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455595, "uuid": "1aa99ebc-422f-4661-9b7b-bbabd28c7915", "comment": "Malware payload", "value": "9b95f372f4ef608cebd588b9449dbbd5c63d63bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455595, "uuid": "d6e0d89e-98fe-48de-be9d-891a389a2e9a", "comment": "Malware payload", "value": "ab695ae538fec3c947da5aba30eecf1a6eeaebfe800fd065fe83b8283f499097585a68b42bdd1c80ed4cf20be334586d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455595, "uuid": "e8689d80-46cf-4492-a569-20dd2d5226f3", "value": "T1BB372320AD2D9E7FA9BC24582C7F4E5739B14E405A0429B3369F60E95C5FB30513F2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455595, "uuid": "10523713-57fe-4130-a29f-821aec50e3a8", "value": "49152:olfs//telfs//telfs//t2lfs//tJlfs//tVlfs//t3lfs//t1lfs//tnlfs//tz:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455595, "uuid": "4277373f-a8e4-4494-bef4-02d7d75fa2c0", "value": 22643801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455595, "uuid": "fd4266cf-eb57-4759-a260-de2b929a5303", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455595, "uuid": "35c03288-4fdc-492a-9d3e-afbf5edbc951", "value": "invoice-1645080830.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e53ac-4403-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777491896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491896, "uuid": "a18f3a87-9bbe-4925-a440-557d1ad0e47f", "comment": "Malware payload (Mirai)", "value": "23b2a4c7b9ca256b544f6ce620d0ca68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491896, "uuid": "e1302885-c709-4d3a-9cd4-b8d0878f215d", "comment": "Malware payload (Mirai)", "value": "831d9d5edfb9dd87442e564b32b7e1d644eea175e9b148ad3af56ef8e6b8be8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491896, "uuid": "35ac3368-246a-4ecd-9578-c936737fbb3c", "comment": "Malware payload (Mirai)", "value": "0684c71feb48c6a13777ff4424a2a6c34d8731f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491896, "uuid": "da90da33-8ed1-46f8-8302-f8dc2d55dd98", "comment": "Malware payload (Mirai)", "value": "2468eb4c4051baf532f3f5223bc50f44098c109d3bdd229832e32261aafc81a12accae3f8b83ca74c333a8fd091e1bb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491896, "uuid": "2858916e-5d6a-4980-8f3f-13b45a3a5aaa", "value": "T1AB533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491896, "uuid": "24203543-db12-4348-9d42-ed8dc273f8d0", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyTgGhd2G4NMiplImpcvwJZY10UuZvBqJ:0aHuAzgjjfUKU0NONyTgG+7XtJa10tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491896, "uuid": "fbb58480-9dfa-47ce-89f2-9444ec9c526f", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491896, "uuid": "d273ef94-b2cb-47f5-bd04-8c23a6bd80ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491896, "uuid": "e7c29548-7afd-4b52-8feb-90c5a7402f59", "value": "RpcSecurity.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3e94c7-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495315, "uuid": "457bd5e7-4bb8-431f-bd01-c7aa2a6c2e41", "comment": "Malware payload (Mirai)", "value": "21bf0901a6f0b556dd8be52acbfb6809", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495315, "uuid": "2bbf1b4c-b9c0-4293-a62b-7c1ebc335431", "comment": "Malware payload (Mirai)", "value": "8501eb2fa9990942d31eb08d3759b34cdf0f142ec8aacc130da1f44d46c13f64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495315, "uuid": "3c0788ae-0586-4238-b66f-2880f30e5f63", "comment": "Malware payload (Mirai)", "value": "61afb5a31a3032a985654d88dde63d1caf88062b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495315, "uuid": "51c91a29-ac0b-4110-bb2f-c8e39be52717", "comment": "Malware payload (Mirai)", "value": "26f4d7c97cdf21da6dd07109f3bab5e741e5996b40954b81a883f7dd673f529b68ae8309fa51b967c142306101537079", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495315, "uuid": "ca9f91c7-2147-4572-8bba-cc90ea2cfb48", "value": "T13293080377094F03D06718F426BB1BF187AABD6118F9A284751EFEC99271EF26146F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495315, "uuid": "45f63d20-c7b7-4c84-9c82-2ad71700506e", "value": "1536:GLM+0jysRh/6Yw6So8TS2W9z8w/3fxDo7qq0xeVq7QZlnrsevVhFw:GOPRIYEXK8gfreVq74rDTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495315, "uuid": "3615c569-fb03-40b4-b694-ad42a33861aa", "value": 88812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495315, "uuid": "9184e4bd-5ffc-4705-9c0a-8b65c32467d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495315, "uuid": "ab9b8372-921b-4793-80c6-4bd34c86a0e0", "value": "night.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38eca3f4-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495041, "uuid": "be8602fc-8d58-46e7-8a38-2b6c95e64614", "comment": "Malware payload (Mirai)", "value": "920f7d90a7d834729f0a8e73e80fc229", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495041, "uuid": "40acf239-5298-4aaa-ad36-b74d549e419a", "comment": "Malware payload (Mirai)", "value": "8581eb99d50ceba5a188b7649953db7ed023a4efb660cf695b42f788a09c218b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495041, "uuid": "8817318d-c19c-4fd5-bf25-f0221f2f2074", "comment": "Malware payload (Mirai)", "value": "fda7d36d99b5388db8cb32edcfcb780c0626ebef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495041, "uuid": "6543dfcb-9f8e-4814-b563-3af371bfbd25", "comment": "Malware payload (Mirai)", "value": "d64cb337c6b44030b70984cba8e00623ddddd88284c6c8862aa74ae3f36da99a4afd798f2de064877d576c0f33f35899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495041, "uuid": "9e07065f-a8ba-4ab4-abd0-f53a02bc5b0d", "value": "T154C30956F9819B15D1C151BAFF0E128E77131B3CE2DE7212AD246B307B8B9BB0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495041, "uuid": "aa69d675-7d49-48c8-ac0f-cbaf523cef4c", "value": "3072:3vS+UDa7Z3MvapAUYwDcTi+qrzc30GfLGHs:3AD85MvapAUhgijwfLos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495041, "uuid": "450f96cb-00aa-4f77-909e-6aa9e15a25fd", "value": 128892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495041, "uuid": "b30e4976-f56b-4565-bea6-7445c31a5341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495041, "uuid": "309f5007-c909-44c8-ac61-796522bc0fa1", "value": "rage.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a3e8e6-43e1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1777477240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477240, "uuid": "ee5deaeb-d320-467d-a6d4-ea9e62dc5d2d", "comment": "Malware payload (CoinMiner)", "value": "943a5ed7ac770e31104d4c4362fda2bb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477240, "uuid": "040a7344-97a0-4000-bb0e-1d2ff501b6d0", "comment": "Malware payload (CoinMiner)", "value": "859299c6b50a802838d7d551382a81785b1ebcd33ae2dc9380a25ae1b87a5ce2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477240, "uuid": "41dd7513-5140-4323-8094-4eb989135ada", "comment": "Malware payload (CoinMiner)", "value": "3403c1cecb743125eea94251ea57debabee13391", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477240, "uuid": "14d9b720-3d4d-4190-bb27-0121e766395e", "comment": "Malware payload (CoinMiner)", "value": "06ea2b54ff98cffb66e93e5a13e40a911b874c819cde1dd649069750a3d8749f2dc73475f21585e64a246b6f532fd476", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477240, "uuid": "f14f1f6a-76a7-4ec3-bb9d-cf70f68d5dc1", "value": "T10122191A7E8A4331D39049B05479834B653D6633E383A7EFF773929A0B913498850EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477240, "uuid": "9d37d9ca-b48c-4982-8c66-0a48a5d319b6", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477240, "uuid": "2ebc51ed-d4fc-4afe-b0d2-0bd3b64b9d8b", "value": "192:BbK9oMTlUzBuVx+eGlIPFJxTEZmFhSmuXFh:JsoGUQVwt2PFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777477240, "uuid": "91e36d4d-f156-483e-89d0-7418fddda6ee", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777477240, "uuid": "cf57c7fc-aa89-4ba0-94a5-08d017f782ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477240, "uuid": "489e14d5-7c10-447b-a902-39f018d5b837", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce307a5e-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440316, "uuid": "d1af6525-4d61-48d6-8ff3-4e4ea48ebcc2", "comment": "Malware payload (Mirai)", "value": "1e7ef7202c78d569e9f18dbf6bdb2008", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440316, "uuid": "429cb9be-08b2-4616-8963-3fdcc66b0f49", "comment": "Malware payload (Mirai)", "value": "85996769105e5014419b6aea10fb9f6494e9c80767f9e0f59890e9d4861e77c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440316, "uuid": "2791bff9-d34b-40b7-8fbe-3082d3f38800", "comment": "Malware payload (Mirai)", "value": "5dae9e2faaad935d26665c7e31c35cdf481470b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440316, "uuid": "3878fc2f-ae8f-40e6-8a6b-754a452d48d3", "comment": "Malware payload (Mirai)", "value": "212f9b073b672efd45fd85c20719023ee82983dee6ab455e7e629c28511c9df26007fdf75984ba4d53c0907820b8cd81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440316, "uuid": "0b9b4c33-cb07-48da-99f0-a27464f27005", "value": "T175F33969BA0F6C41F2C2C3F8DA8C87E13E1735E3C6778DA1790152EDDBA39D95980912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440316, "uuid": "4cccb8a9-8cc3-49e8-961c-f76773478d03", "value": "1536:WZp34PkF4G/2r07HYXh5B8yOlz29b1X75J1+l50VyBIRM4REn5p5M/LW:i3AB8yAMR7P1+/0Vy+RM4Rxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440316, "uuid": "5cbd50f3-c16d-4508-ab4d-3dd35fbc5571", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440316, "uuid": "ca51dd55-1d68-4c29-a446-03bc28ac2e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440316, "uuid": "d0e7ab89-7247-4a89-90fc-58618fcae9f3", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbdd478-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440319, "uuid": "d929de49-b735-426c-87e0-78d2fe512af6", "comment": "Malware payload (Mirai)", "value": "dda04e444417249a63cc196924e9241a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440319, "uuid": "3fbc83f7-3733-438c-9794-6e88e7451d93", "comment": "Malware payload (Mirai)", "value": "85ffa5d305eacf1cd513927fe30e947851fd6ff05e21494379a861fb8eb38a61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440319, "uuid": "221a4e8b-9c2b-4516-acdd-9e333818a475", "comment": "Malware payload (Mirai)", "value": "40c1a2e382355f1a400305ee0dfce13c06e97f7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440319, "uuid": "93468255-c4a9-456d-bb57-d1a92abe76aa", "comment": "Malware payload (Mirai)", "value": "ff8f7623e8e4dd82e86a4053351d72c55ca7ad89505c5b63c77c4835f9bd9a47e3d9e3af153bed98d6d5f627d87fc00b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440319, "uuid": "9c8853bd-6f9d-4489-8784-cede60ad5a43", "value": "T114C30946F8819B15D5C151BAFF0E124E77131B3CE2DE73029D24AB747B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440319, "uuid": "d08614a3-8104-4826-937e-f0b1caac95ed", "value": "3072:paUJUwTHv6X6BltjHakuJyqxuWfmscpLdJNF:paUJPz6Xilt7a8FWfmdLdjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440319, "uuid": "983393bc-c047-4cdc-8b12-9670283cd438", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440319, "uuid": "e8431c0a-f372-4b8a-af80-1585f60ce2a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440319, "uuid": "f33c0149-6fe5-4cd4-bf23-01d8e1581148", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1770be43-4401-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490690, "uuid": "2da9f5cd-bff3-46f0-b7c2-df6226555a33", "comment": "Malware payload", "value": "a2e20bdfd95a9625ef1cc7c345075ace", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490690, "uuid": "173466e4-078d-4de3-9ce5-2791bf3793e1", "comment": "Malware payload", "value": "8639a2adbe1bae441bf3296b775b3f6c3c36de0163155b4f6046d81ce2d88334", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490690, "uuid": "15e1a0da-c139-4e04-bf96-64bdf540f02c", "comment": "Malware payload", "value": "acf7d240c1ae2e7e293e126b49d93973f92e605d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490690, "uuid": "e87421ca-77d8-4b62-a92f-77efaba7072a", "comment": "Malware payload", "value": "43e326cd10be3bb2880b23f7e5ba01531b5b76901e715a27c9522ac7312893b9cc987f9b4dc6e691b03e733ab4170cdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490690, "uuid": "ecdac82d-3da4-4404-9df9-0da4a9800043", "value": "T169A56A0A7C9104FEC09A77324CF772917775B8480B2637C71B926A782E767E25C3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490690, "uuid": "2fb7c552-7e78-4fee-b8e3-1339b9c11eaa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490690, "uuid": "4cd99eb0-ce97-4bd5-bddb-bd24f70d1310", "value": "24576:MTiTeEKu/+/ya9KMFdLm/X+zJ7bjfF2iczG2m1eR7Sx74nhele5nK23UFQFcF:MTgeJu/Za9K4193Om1eR7Sxwdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490690, "uuid": "0190d7c4-371a-4e00-b378-4a83957cfbee", "value": 2222800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490690, "uuid": "af3e8657-86bd-4a30-8d47-9197072c48f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490690, "uuid": "ab49955f-0523-4ee8-8d15-4f3e1f7599f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6222b4cf-4361-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777422096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422096, "uuid": "b2387754-a716-4e43-a93d-a1d6874b8699", "comment": "Malware payload", "value": "a41f9b873fcf2109fa976d6a4810277e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422096, "uuid": "20e6878b-3e0e-4955-bd69-2279fbfe8179", "comment": "Malware payload", "value": "8677487dc5b13df611e02a77c453af7672aa0556a8b3f5b54041036bc6aa2232", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422096, "uuid": "36116347-4723-4e45-a566-f1be0eb7ce17", "comment": "Malware payload", "value": "199abed1f54925db5db0846923728082b3b27c27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777422096, "uuid": "e512fe83-791a-4b4d-90bf-4f72f52c9477", "comment": "Malware payload", "value": "dd2c1abdb11390cac4c97b52e1dd55fb1035b516812511245497afd828d17a900903c00a836b8656c9961c1a73782793", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422096, "uuid": "19ca6f87-7043-4fd3-91b9-d9759466d204", "value": "T1F4136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C55A9CE218B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422096, "uuid": "b731056a-65e1-49ae-914d-3d4329ac000d", "value": "768:bEs9NyXsZztCy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bxHusZmcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777422096, "uuid": "4cd84d0a-0b87-47d9-b224-2e0c251a62b0", "value": 45421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777422096, "uuid": "ae510b16-f792-4b0a-b1c1-216ad98a167f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777422096, "uuid": "1e32206c-c539-45ef-abf5-d8e609cc989e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaf872a-439f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777448980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448980, "uuid": "ada103d4-75e7-4128-8237-1a0d2bc369ed", "comment": "Malware payload", "value": "5c4ae153cde24431d08e04f345ab8fdf", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448980, "uuid": "f47e63ff-48d5-4f73-9259-72c8aceb2165", "comment": "Malware payload", "value": "86b6fd1cbcf3a37d61719b7c86a723b95d7b3b42dfbedf9986c8cda28a69449a", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448980, "uuid": "f545d8d2-d2f4-4143-aaf8-4f20bfde0221", "comment": "Malware payload", "value": "10e1a877b80e02215871162ed77617cb50b0e5e3", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448980, "uuid": "92eb71bd-dff3-4995-80d8-a53d46bdfc36", "comment": "Malware payload", "value": "71d561acb9baaf88fb3a80334420e341836ef3bd7b75aeb334252ee61d7364545f14e4cd92f9ef21fb12a0b439779c47", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448980, "uuid": "4e2bae72-e796-47e2-89aa-c91afd274b4f", "value": "T1397533E7C44E99EDFEDF412005031B90B6DA9B928694787A4C25E3BC821C53BAC25F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448980, "uuid": "c50bfbc5-b345-46c5-a949-da2e37c5bf3b", "value": "49152:cMpiSgpjkjIrbKT6gBXO3jMtDwQvE0aDG:r0ajO3WO3jSDjvEBDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448980, "uuid": "834a5320-2bbd-4a46-8443-2d559d20fe69", "value": 1649472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448980, "uuid": "9f3f075b-4c26-48e3-ba66-e5ab49cc6b95", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448980, "uuid": "5a58257f-b83a-4e9b-8a45-939f2a4d7aa5", "value": "imagekdfgueuehedb6666.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacd43da-43ec-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777481971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481971, "uuid": "e923996b-5e82-4925-a267-46a709eb9581", "comment": "Malware payload (ConnectWise)", "value": "af3daaca30e81fff9ba84c4caa5baf57", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481971, "uuid": "c6397630-122d-4bac-a8f5-b7ccfc4df066", "comment": "Malware payload (ConnectWise)", "value": "86ea845f4f0e2afe824b11315c4fc37a9e60cfa51dbd24c8253960b50a9d3e8d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481971, "uuid": "de3b1f2d-25c0-406f-9751-88c954e9cacf", "comment": "Malware payload (ConnectWise)", "value": "4c689ebb9041d133b3b100f532c772cfaa42f5de", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481971, "uuid": "a6b95366-b346-4434-a9f1-56b590dcb3a5", "comment": "Malware payload (ConnectWise)", "value": "46c1d90fa4538757bacf53db4d6f22a1b32ba159c2beac8f478e97969e8477a466a59b13fbf9e31ffc3e99f8379f63c8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481971, "uuid": "02991a12-3932-4a88-92f9-8283f03560af", "value": "T1C2646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481971, "uuid": "4de576de-1873-4481-adba-66084ccebc7e", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481971, "uuid": "cf79b7ac-e5db-43fe-9d35-2a67ad0522f7", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9+:51iw7gryNkSV1hy1Z1u2JLu9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481971, "uuid": "cf8c588a-4a00-4a37-af98-355f38f1502c", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481971, "uuid": "2ad1d8a6-e41e-4b3c-98a8-93b0e908fb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481971, "uuid": "43905b22-9297-46e8-91e3-e0e3609fd50c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77a5b45-43ec-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777481993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481993, "uuid": "259b8ab6-9c70-49a2-8c36-a5da1fd2667e", "comment": "Malware payload (ConnectWise)", "value": "68b54133b70814a1ed856a0b5e48183d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481993, "uuid": "fbd69855-f2c9-4cb7-bfd5-7f4278cb228d", "comment": "Malware payload (ConnectWise)", "value": "882a5e7f041631d476d37c6af4de271d1016a0d2d4ead2d12856cae6598ed868", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481993, "uuid": "c71f9f79-36fd-46f4-a639-9f70073992ac", "comment": "Malware payload (ConnectWise)", "value": "c929395af50147110f0d1abc21920b521a3a469a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481993, "uuid": "0f32e791-f99c-4467-9350-2aa77a60574f", "comment": "Malware payload (ConnectWise)", "value": "9b04011ec57121e34cd162b49c076a3db9bc4c1eeb7830cb2b18ed7310bace3c3949230deff92d2232b8d1eeff568d96", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481993, "uuid": "877aae65-6da8-476a-95e1-2ee6e00991b0", "value": "T1F056F101B3E685B6D0BF1638D87A46A55B74BC049712DBBF5390BD692E33BC04E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481993, "uuid": "984e4760-1dec-4218-8af6-ebc88241a915", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481993, "uuid": "470fd973-49dd-4ac8-9446-5e2d1164e713", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481993, "uuid": "baa243ff-cc68-4822-8907-421a5d77270e", "value": 5965016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481993, "uuid": "fb16c463-276b-4388-a869-7246e3723512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481993, "uuid": "adac9d29-65f2-40c5-91a0-f0e1b231bcf9", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9be1605-439f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777448872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448872, "uuid": "94266d43-148f-4293-864c-e85ca3616a93", "comment": "Malware payload", "value": "9c92e5678adeb3fbbad9ed3d02db2356", "object_relation": "md5", "Tag": [ { "name": "14063130878526", "colour": "#44BFEB", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448872, "uuid": "4ffbeb70-ae8d-4bb1-9610-e263ca71a206", "comment": "Malware payload", "value": "8999fe8d7c77548a02358156a4c89da687ed847eaead460f81758d50b53f42fa", "object_relation": "sha256", "Tag": [ { "name": "14063130878526", "colour": "#44BFEB", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448872, "uuid": "41f46625-b9c9-493b-8118-6425ec6d5d67", "comment": "Malware payload", "value": "d7cc29e95d01b7bfe6e46cddfe2bf24b97d1f333", "object_relation": "sha1", "Tag": [ { "name": "14063130878526", "colour": "#44BFEB", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448872, "uuid": "3060c334-29e7-4268-af4d-53e37407cfed", "comment": "Malware payload", "value": "e1021462fdd782c172980ae535051eaca1f08facdf651e53fc267ec4d3cbb1fce56e628f536edc8faa4b33f0127d1779", "object_relation": "sha3-384", "Tag": [ { "name": "14063130878526", "colour": "#44BFEB", "exportable": true, "hide_tag": false }, { "name": "everycarebd-com", "colour": "#E2E930", "exportable": true, "hide_tag": false }, { "name": "imagekdfgueuehedb6666", "colour": "#34FA25", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448872, "uuid": "47f25a74-505b-47ac-a38b-c10ea579dc21", "value": "T17DC31305E2F689F6052006DCBD67DE05F3069A1BB4D987E607D8C77ACA5F4F0E469D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448872, "uuid": "4f99fca0-e94f-48b3-a4b7-834679f95681", "value": "3072:tCON/66vey1gi7cHytIQx81bhmLa9DaytNqzdL3:RNf11mSSmu9fqzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448872, "uuid": "1c992363-86ba-4d5c-9356-a1a43197a74b", "value": 126726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448872, "uuid": "4d9ae1bd-4b15-4548-88a1-c50f34a1368d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448872, "uuid": "8d28af35-a094-4d33-b336-3677683fb0ca", "value": "Sales Order - Order Confrimation VR 14063130878526 - 0061-26-EXL-Q_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49baf3e2-438d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440953, "uuid": "5bf16154-0630-4aaa-afe1-9dcc6ee22e88", "comment": "Malware payload (Mirai)", "value": "1a3461022e05789e226537e18fe3109b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440953, "uuid": "11fa1e8c-d985-423a-a46c-62add01f10eb", "comment": "Malware payload (Mirai)", "value": "89c79f634434605fa3fe645d1d69c098364d18b861d8ab5bb4303f5853bb5691", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440953, "uuid": "c003148b-972a-4899-ba55-e0f85f3fa3b5", "comment": "Malware payload (Mirai)", "value": "e115e6391cd4cc13c57abaa96c0df5aa3a128f5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440953, "uuid": "a7f999b6-32ef-4a40-8a06-e7638e218691", "comment": "Malware payload (Mirai)", "value": "431c6cd0bedfd758b5e1c4ed373246517d68e94624cb9bcd401754715b73ffcdf0b32dbffaf7bf71708485eb34751eca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440953, "uuid": "37a7d3e1-3ae8-485d-bb8a-2bbbe1dddde0", "value": "T1AC314D8F61B20E42A688CF0171E18DC8A706F5DC61DAC632FD92AE76CD99D643119E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440953, "uuid": "fcf591dd-463d-4562-a120-911e64bca1c0", "value": "24:zDdsM1e8rBM/hpQ1bMo2wE6fKo72gK5Jx4pH9:aM1exjo72M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440953, "uuid": "d261abe8-7698-4a49-a18a-ebca63e225c4", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440953, "uuid": "61a1f471-2a41-4fb9-a902-2a852c23c3b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440953, "uuid": "ab43c210-e548-44fc-9ce8-fa3487281b7c", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca55c0e-43c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777465090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465090, "uuid": "aeae32c3-7a71-4663-82f4-3f3e14973d24", "comment": "Malware payload", "value": "ee07f106d53c88cfe53c265c363f3967", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465090, "uuid": "35c71e8a-81cb-4b90-9a18-2fe9e101eb72", "comment": "Malware payload", "value": "8a559ab8f2cc7f4c0c52fb78beeecdb9995227ffbd766f4ff8e82721fe7b4438", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465090, "uuid": "8050d11e-5dd8-4148-acb4-92589b2d1604", "comment": "Malware payload", "value": "8a4020d121847778fc634095f5522e1b5e58adf4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777465090, "uuid": "130cd488-8680-4465-992e-9b499f27c211", "comment": "Malware payload", "value": "c70e0032941dbdda3478084ce872743263191e99d180dc62400aeba3f1d76802c17d7bdaa9c3ae3dea9f56e9924d09e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465090, "uuid": "49f10da8-8e2b-4366-a38f-7bb492b35b18", "value": "T11FE0204FC09A253516395103E311CF24300510125EF2BBBCC449E722C747014F391F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465090, "uuid": "9b6a189b-c2d1-40b4-a091-46f681642b59", "value": "6:hrC1OW4oZYLWfp87Ty76VyoK9q4WgBtNW+1jY7Ld+1jl57c/AqFUCSkn:ZCkceLWa7Ty76Vyowq9gnI+yLd+dwbFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777465090, "uuid": "e7f3c9e9-7adc-4ff0-af69-c7928b3f8dac", "value": 321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777465090, "uuid": "3bcdacda-dc15-42e2-b5c2-ebd41c71db87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777465090, "uuid": "b7dba69d-99c7-4d48-b48a-ec076c6ad570", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11d0872-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494840, "uuid": "b72c2582-5873-4a38-a973-baab760328fc", "comment": "Malware payload (Mirai)", "value": "572fd4adcce21341b0959fd8378b1cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494840, "uuid": "e982a20d-7bf6-417e-8ccb-27da21875d33", "comment": "Malware payload (Mirai)", "value": "8a80afeb31d264b79f100e6d484b995767d49a58d55fe271f1eb78e59dfc795a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494840, "uuid": "b3d23866-b561-4171-806e-0d1d6f26a929", "comment": "Malware payload (Mirai)", "value": "b20451be69f5d90b149d678f7f18c1b28c47dc6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494840, "uuid": "3eda3e6b-d0da-42c3-a81c-1c1a4d6a262f", "comment": "Malware payload (Mirai)", "value": "af6cf5d54c8466272e98ab529d42ae89dba535af46d448da06bc2a2f75f5dd0044dfb65bac609c5f95eec8df499a555f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494840, "uuid": "da31dc69-a62b-4552-afbb-68380afd0eb7", "value": "T1DEE3B71A9FA50EBBDCAFDD3702A9060239CC905722A43B753674D528F54E94F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494840, "uuid": "c42bafd2-aa1f-41d7-a569-2e35e5b4290a", "value": "1536:7xylq4vUzOko7Opxgvy2yqiYC4fzKMv921Wv6v7/YTZJDNRGnCa9L9QXa5z0Fc9x:9DEVygPvjTaZKa5ccn9xAAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494840, "uuid": "bf85ecb8-ec3a-43c5-8bdc-3ba7a5ee615f", "value": 152676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494840, "uuid": "6b3c1be6-f263-47b2-b1f6-c0bab9a02ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494840, "uuid": "d7fedf26-25f7-4b89-850d-18504d70e3ff", "value": "rage.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d68f488-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464152, "uuid": "26720efc-5a39-4ff6-88b5-ba380a39f1d7", "comment": "Malware payload (Mirai)", "value": "a0e10925a7bbb34b1097de52f1d9736e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464152, "uuid": "23f8ff64-b6fa-4064-9c95-08f829e18ab2", "comment": "Malware payload (Mirai)", "value": "8a9ab6ed6bafe2149b390154d0b886233cbfb7ffef7ce4623e2759c1de5d070e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464152, "uuid": "35f6c2dd-8c55-4d94-9b82-002d91e3432d", "comment": "Malware payload (Mirai)", "value": "f03a2325b03441e95cd8050d5185984bdeeace10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464152, "uuid": "5f9884d8-2aed-4395-a552-d08d05ae273b", "comment": "Malware payload (Mirai)", "value": "2c08f8e912ac599f59ee799d6c1fac3a6f078af2d62c8e991d84f51522286d5deba5a9c06a4e09edba196adb7816c254", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464152, "uuid": "54517bed-9c4f-4df9-89e2-3d3f9eab6409", "value": "T1C0D47D99FE4E3C42D3C7E338DB4A83A1622B75E4D36352637A42420CD5D6EE8CBE1951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464152, "uuid": "90cb9b51-161d-4709-b295-98da68b1c046", "value": "12288:pluc/wO2tnLJklbsc1DSbe/l2gli2Ps5slJH3M:pd/W2bsc9T/9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464152, "uuid": "c1bf587a-fba2-4db1-8323-1a807ad73fe9", "value": 608720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464152, "uuid": "306b0d3a-f27f-46fb-8a1e-1d92a8d53a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464152, "uuid": "a55193b7-a64b-4e6b-aefb-324942356fc6", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc6c23e-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455398, "uuid": "ffd351f3-9b37-4044-8147-b7563265bb43", "comment": "Malware payload", "value": "50a102289096328425f90b14cd92af9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455398, "uuid": "5ca00b56-ba67-43a6-9e2f-c3b98b10939b", "comment": "Malware payload", "value": "8aea3381775bef10361c56b058f8c6d8cdfe7bc0801c1beba416ec798ed5c25b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455398, "uuid": "02785c41-e86f-4e36-a536-ccb0762900a9", "comment": "Malware payload", "value": "92451538e7e37b434a23de4a8d50a605f188f524", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455398, "uuid": "ae88096f-d699-4b9d-a4f3-7cc4480ea287", "comment": "Malware payload", "value": "5b61488010e84a33ae7f98eaf8ee85cf40a014e6732c065fc7ae797ce2c93d51d9a9fa6f5f46fa008223dde15cd0d0d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455398, "uuid": "2131dff2-a00a-49da-baa9-0f1996638dbb", "value": "T1A7372301CE3AC67E46A834FD653B0B6FCB889F1462F13A3FC74D0856969E90668C51DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455398, "uuid": "066e60ea-14ed-431d-97ca-884784e52efe", "value": "49152:VljvcUyJzx79zCZI6kLfjBCZIni+a7WCZ/6giSUNCZIwCZIH3HTCZIOtzgbyqVFl:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455398, "uuid": "6add2ef4-b219-4667-964c-55b6f9298d4b", "value": 23944458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455398, "uuid": "3e7993e7-6fba-4fea-8127-b47029f7d624", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455398, "uuid": "e12ac5ab-e2b1-4482-b95d-1c0ecade4b12", "value": "invoice-1645080830.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab72a5b-4390-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442216, "uuid": "c9602d61-3d82-4797-8dd2-fe30abfafd96", "comment": "Malware payload (Mirai)", "value": "11eef2da145247c7adecd05fc2554d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442216, "uuid": "475a9941-0f25-434e-9867-ffefa9eb5c83", "comment": "Malware payload (Mirai)", "value": "8aedc38e797e32d0c271d628e539e0545a847f21b7edc91df1e165cf1ecaeb43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442216, "uuid": "f0358d22-b19a-4afc-9e6a-a8f516bb73ac", "comment": "Malware payload (Mirai)", "value": "293ec118c04ec0bf26a93aef1e49a26b7bcd301b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442216, "uuid": "9d008c9c-9c63-4fc1-abdb-31db07c8fee2", "comment": "Malware payload (Mirai)", "value": "60fe26eabd7bf9454ce35d84037b2de029558b6ac608e69769cff8c9bd598330679a4d1473f9bc67e8b8d9805f4cfe23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442216, "uuid": "6d2ce9b8-8039-4e60-b5fb-f1e1f59fc123", "value": "T15CA2E1A1CAE548ABCDBDD57B13D600DAC6B85C0243CE23C733FD83A58A67C1325A585C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442216, "uuid": "c3eef183-fbcf-4a2a-b490-2c5f73080822", "value": "384:MsGkxJpigCQ87j2zgxD+Rg0nZbB52MzJxDsapnf0uZQQd1AZuvy6BEx6WNFs+v16:1Gkx/ig6yzISB5RTpnfpQQd1AL6g6qIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442216, "uuid": "2b1e6ce8-46bd-4bca-bd2c-fbd6d2c5c01f", "value": 22464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442216, "uuid": "641e45d7-2042-4fa8-81cb-390d6cd48b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442216, "uuid": "70c9ee3e-fc6b-4143-958b-39547cb6bfc8", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1052812-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455407, "uuid": "15ef0a19-0550-40ae-a851-407664aa6d0b", "comment": "Malware payload", "value": "92df6c8395f777fc65fb131cdf985c92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455407, "uuid": "1950fc8e-6048-4c41-9a34-54c78d129e5b", "comment": "Malware payload", "value": "8bb87852988b1b88f3fd0da4aec9bcae5d603388fad3371bf8b35358ae30f0fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455407, "uuid": "ab8de879-adde-4642-8b32-a9902a34b0ce", "comment": "Malware payload", "value": "cd3039ea5f1bc81819b803e00d2ca481204bbeee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455407, "uuid": "d3477e88-e629-4ad3-8b2d-e98716439a92", "comment": "Malware payload", "value": "7b4e163c410c1396f31d0bf3da62102ba2a0fc5de536205cdcad93eb74cd6775605f9e542f3f4e10f1e958a77aadc0bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455407, "uuid": "ffe159b0-7191-4644-be63-5eba98790d1a", "value": "T14C3723094E1C8FFF0798615124FE1E8BE674857842A21FF70BDB619BA76FC4620B3295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455407, "uuid": "4d2b7e4a-22b8-4325-b7d5-69a013433988", "value": "49152:PodpZodpdodpLodpPodpGodpAodp6odpRodptodpgodp7odp32lThzodpNodpwoy:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455407, "uuid": "41854d7b-38fe-4bad-8766-ae9930874453", "value": 23684350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455407, "uuid": "ce0ade88-38ac-4497-9c21-0997f151b2de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455407, "uuid": "0467cf77-c624-4641-b1ac-a1e1f5794afc", "value": "invoice-1645080830.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70f7a39-43eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777481536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481536, "uuid": "276d5a62-670c-428d-bcdd-a64dd4406492", "comment": "Malware payload", "value": "875e998ef2d45fb492546fd751262655", "object_relation": "md5", "Tag": [ { "name": "83-217-208-78", "colour": "#F153A0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481536, "uuid": "d9030b81-65d1-4786-8d44-60ccea79898c", "comment": "Malware payload", "value": "8bbd5525d11b0aeecd5d9bc385c080cf2fd1b4a6aba76caf62b16426a0840ba2", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-78", "colour": "#F153A0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481536, "uuid": "f28b2772-357b-40ea-8e69-04dbbfec9869", "comment": "Malware payload", "value": "32a7bb88504af80a2b1cc5852fd489475ef83c72", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-78", "colour": "#F153A0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481536, "uuid": "7796823b-c4cb-4272-9410-7b8b0dab81bd", "comment": "Malware payload", "value": "8266465c5bb8bbed13bf0848b8d0e4b7925b9d84fe0c6823a238af1566434d1177b038704b42636b3a2ea5c341739dc3", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-78", "colour": "#F153A0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481536, "uuid": "e6c12a4e-c85c-4050-8f8f-ee87b683ecaa", "value": "T1F3653BEF676069C8D8D16AFC94B76D0157A0BCB379D2409E1982EF1BCD28913CE38275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481536, "uuid": "4f250245-fee4-4795-96a8-98571b0ec7f4", "value": "24576:J40t7jW1PUaekYF0Va8lTnoRDcqR9YxHs4pW24tNKJGyO:t7uUV4VtT0gdxHsUaNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481536, "uuid": "6e1722c1-0769-4b58-9099-ebd0fba2f649", "value": 1487536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481536, "uuid": "3f6ef5be-6038-4c43-8583-2df0e0c8c3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481536, "uuid": "b92ae3ac-4515-4c9d-b097-8e7596385eb0", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e5a0ff-438a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777439554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439554, "uuid": "bfcf4dd7-2118-468e-ae03-3445ad524a2d", "comment": "Malware payload (Mirai)", "value": "14212a10916be8b731e08deacb1d6330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439554, "uuid": "c7b16352-bcc4-426f-bc8b-4c3f709fdcef", "comment": "Malware payload (Mirai)", "value": "8c926fb6559e1a6dd7a70f8a85ce45b2aa980700c9c4df21d5f14976febc8f85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439554, "uuid": "6ce1bce7-829a-4cba-b051-021842dcb779", "comment": "Malware payload (Mirai)", "value": "d33fcca4e108a50b2a807a69bf5e48b5ecb702d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439554, "uuid": "207e932e-1def-4b08-83bf-4bc8cb9eac29", "comment": "Malware payload (Mirai)", "value": "0a21ebf8cd16a27dea72e83c091288c3b9e46a4907a2042f02fbb5a6540e5715b783691334996f4bdfbfc8a80b274ebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439554, "uuid": "598056dd-6e83-4bd6-a514-88cb53b452e4", "value": "T1E3338D36E019DE90C55645B4B0AC8F740F13F1C893535EBB2AE945B1A853D68FA0AFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439554, "uuid": "01c89993-7027-4171-96a4-3298102066ad", "value": "768:+aHUueq5seDYse+tULrJUMU4fXat4e3bz9pb/C3ofN2AuCLAw:+aHnaHsFu9E4fqFfb/rfFuCLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439554, "uuid": "2c6b3895-8559-4618-b4bd-7974ab14f70e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439554, "uuid": "d955a3dc-7071-4348-95a4-044ec2fb233b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439554, "uuid": "c8b8d4eb-b7de-4535-8ec0-e6f198f0731b", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec00b93-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494648, "uuid": "ab922779-dab5-4771-8e8f-ec18fba8aa1d", "comment": "Malware payload (Mirai)", "value": "4bb43e2a439c0376f142d3b5aa4a4cd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494648, "uuid": "664352e7-414e-42d2-9511-714cb5f7d6ae", "comment": "Malware payload (Mirai)", "value": "8cab16f04a2f58ef2df5bc6e34498618f9e179ba0736ec2642d70dd153159b3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494648, "uuid": "099a1456-16dd-4cc2-bd86-ca75f61ed78d", "comment": "Malware payload (Mirai)", "value": "5c61ed9cb53630aa78bee81e3827332494682049", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494648, "uuid": "d5000f87-d3dd-4c25-a7cb-01ba09d24725", "comment": "Malware payload (Mirai)", "value": "6395d5ea7e96117dc9073396608bdfe215ce705b9d80f7d86ed462334f6806e7beb0dc1e644af449bf4fc6efb00153e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494648, "uuid": "f8f83db6-c925-40d1-b924-e5c506881da6", "value": "T11E93084377094F03D06329F026BB5BF087AABD6118F5B284B55AFEC99271EF16042F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494648, "uuid": "6fb8470f-75fa-43b9-9672-b1764529e1da", "value": "1536:uLMm0jisRhf6Y4aK33rSCWlT1nfH5jATqSPvFFqTItVnrTWPN1hJ:umvR4YoTCJHSFqT0rWjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494648, "uuid": "26053153-351a-429d-a6e1-010ef2abcc9d", "value": 88804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494648, "uuid": "ccba26e5-f3ce-49cf-884c-d12a366a10e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494648, "uuid": "871300a0-5e19-4976-b89f-dead0aba49cd", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0d154c-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455591, "uuid": "d0468886-3f8c-4d0b-b1ed-3c4ffc2cd9ab", "comment": "Malware payload", "value": "34f47097222efe190815bd4d364a3052", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455591, "uuid": "cf42421d-8275-4508-adeb-e8495f44643c", "comment": "Malware payload", "value": "8d7c055adb31439876f38170fbc69d8f9c769d855387fa91738d8b83e951b8df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455591, "uuid": "b6096fee-f971-4747-84c8-551838c2d580", "comment": "Malware payload", "value": "4a8293ebdfb5ba9bafc07d3aef2347ccd45b02d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455591, "uuid": "54c7563c-a0be-475c-9a6a-fd9ff2a7f69a", "comment": "Malware payload", "value": "bb5fb90b28a8bf5343fe9a92430ba7e18dcbe82d82970b260d76cdf462c15e894bea032279d70bcc052424af9c2309dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455591, "uuid": "0ea0127e-3e92-44d3-9be2-730ad90e4da6", "value": "T14137232EC73E9CFE8D21159DB5EE0F4E0AA918840126119313EDF8AFD60F7492725AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455591, "uuid": "8e875bdb-b65b-4dff-b894-112e35ac948a", "value": "49152:ggEenPCbpgEenPCbhgEenPCbagEenPCbkgEenPCbJgEenPCbngEenPCb7gEenPCK:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455591, "uuid": "0b89b893-5250-4707-af37-1026f03499d2", "value": 22643805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455591, "uuid": "c35f9e09-ba93-4f42-9825-d382504efc5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455591, "uuid": "306cb650-71fd-410f-b6b0-a8619eaab561", "value": "invoice-1645080830.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08a348c-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440320, "uuid": "d9e07cab-9a88-4315-925f-66e74e3e2c5b", "comment": "Malware payload (Mirai)", "value": "25a80b6c0e7c1e88313bc359d9a75994", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440320, "uuid": "7bc6d836-2f95-4ba0-a43a-adcb6c5ca27f", "comment": "Malware payload (Mirai)", "value": "8d88b181d77f37f45d99ee4e5b8665a72d00538fb256ce9481d7698c377531b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440320, "uuid": "31f7ddaa-b13b-4005-9433-4dd34059a75a", "comment": "Malware payload (Mirai)", "value": "65f9110adabf1e9f8f2a0ff886c2aca3ce47c8c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440320, "uuid": "c27a1d1b-9a8d-47aa-9166-159049d7f3eb", "comment": "Malware payload (Mirai)", "value": "44c91d56b6d2ea5076bd27e39a76e7a7502821f07ac9bb2a2c9ebae7275ff89abdd927a780a7b915e2b200be07121bbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440320, "uuid": "9a55482a-0d2e-4e33-ae8d-a00414811043", "value": "T16593F649FD416B10E4D635FAFF4F024973934B6CE3FAB201AA245B2523CAA5B0F76416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440320, "uuid": "56f3052a-b370-4401-b455-ee9a0f8aeb2b", "value": "1536:wqnQEMDz8EdtS/pljv8oWKaFuZMgmMGKPlhKv8ioyXi/9RZRYu6:vMkEvqT78oWKaF8MgmhuyXi/9Rjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440320, "uuid": "c921ce3e-16c7-4800-a714-0f3da4b4b3e8", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440320, "uuid": "d85316d1-1481-48da-8d4b-ee6b46c0614d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440320, "uuid": "b4ca6d08-e241-4f35-8fc8-51616feea077", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17636595-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494985, "uuid": "c0ca5be2-ab4e-46ed-99b9-4a4319e4720c", "comment": "Malware payload (Mirai)", "value": "4e724cd621e88628d353a0c3b32f8ee5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494985, "uuid": "a3bb5fcf-6d89-4622-817b-5d84c720b25e", "comment": "Malware payload (Mirai)", "value": "8e66b987efa5d160aaecbba1181bf2a14bdbd9096164f8ea9008fbccf8cc09d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494985, "uuid": "f1968aa7-2f79-48be-b9e5-328ffbc2bd47", "comment": "Malware payload (Mirai)", "value": "54bb081bb29cfcf49d5393c05928395a01063b6e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494985, "uuid": "2191930d-f488-4656-96b2-bc2c08d90c06", "comment": "Malware payload (Mirai)", "value": "b7cd81947233374188d52a638294e7efb122dee42dad7d9c7d706f578f596e02d809e820b54692e25edc850f436604af", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494985, "uuid": "ab407d49-b016-4fde-b725-57af36baac26", "value": "T18DC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494985, "uuid": "d6b093fe-8959-4c0b-a5c1-4b3061fba041", "value": "1536:j4w4zW/h4SZsqEznAfgiDSAPzfO4jaXbzjZjCfPNXm/iRK0UgSSWh:0xW/rZsq8A3fHjarzjD+XWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494985, "uuid": "9d02cc60-3a5b-4122-823c-2309d8312421", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494985, "uuid": "e38183e8-874c-4e74-b20c-5aafc18ad752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494985, "uuid": "26f84515-7203-4366-bdba-442a539b564e", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb986163-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455424, "uuid": "6f79799e-995c-40dc-ae42-fe794558a87c", "comment": "Malware payload", "value": "3a25461fdaecdd1ec3a2d384db36a05b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455424, "uuid": "41267c1d-ae68-4a8c-af87-ac06dc67b79b", "comment": "Malware payload", "value": "8eaadb174fe5ea0f53666652d36420a240b9249a553f1fc439aeabf4df4f0d8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455424, "uuid": "f612bbb9-5f69-4c98-b8a9-30a778ea54a7", "comment": "Malware payload", "value": "bc225b4008c7783b3ee3b302053925e4e0724d0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455424, "uuid": "b1d83ff8-8c7f-4694-82c6-695e5ca7fda9", "comment": "Malware payload", "value": "2fab4723acc39af62af64272390852a1d62428833f59ca60af78838c4d540c711a40a5669f418f7b146a7308e10cadb3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455424, "uuid": "867ea852-2e7a-4e6b-9b5c-1dcbf5c5dcb8", "value": "T15B372383897D0E3CC4ACB4AC3A3B2F1D46584E215942FDD2B2FA79DDD4AE65944AF00D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455424, "uuid": "ff2a7fa3-4969-41de-b8c5-8939751c1c29", "value": "49152:gyPy/yyy/yLy1yxyMyIyryGy45UGwFMyny4yuyCyD5UGwFjy0yOyxydyyyDyXyTq:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455424, "uuid": "53d4a703-2151-4801-a9e0-881077d387b1", "value": 23684330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455424, "uuid": "474bf94e-85c8-4b3b-a832-5ccd1508dd57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455424, "uuid": "521eb60c-54c3-4fe3-9abc-b6453c46ebf9", "value": "invoice-1645080830.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511f1099-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455568, "uuid": "039e46ea-a08c-428f-a531-6224d92bb1cf", "comment": "Malware payload", "value": "4d963a00eb502405ce548b2193c0c10c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455568, "uuid": "813bb1ef-393c-469f-a98c-331b79934347", "comment": "Malware payload", "value": "8f045e22b7570b0c93f821115b579012dcabf7014606db22e7dfb0e1a4b1baa0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455568, "uuid": "05c4884e-2be8-46db-9c0c-a494ba1d3ab5", "comment": "Malware payload", "value": "006f790743b2a2f5b9e437136f4121463f0dbe45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455568, "uuid": "20562ac8-0bd9-4b89-b13c-a9f52b1bf87e", "comment": "Malware payload", "value": "b02adc407ea23b92c6201fa3b459def3702b609ed4e7f2bfc2f568cb8a7a836438710b3f106a4c76cdef2ccfd1aff32e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455568, "uuid": "257cb26d-a1af-4874-b46e-b2a56dfcf718", "value": "T1A137232DA92A0D2F4D6C65DA20BC579DFAC84E067D24D4E3A0D0DDDF724EB87108F1A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455568, "uuid": "461db53f-e065-4139-bcad-38153d919600", "value": "49152:yxGr+mgJNZvXhtOxTswktlBB/2ud5ReYAiPztWtpiKqt672xahRswEiAE9QpK0pD:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455568, "uuid": "786e6422-d641-4074-8541-17401478a0ad", "value": 22643815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455568, "uuid": "176d9ae0-2c68-47eb-b56a-a03a805199b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455568, "uuid": "fb7a5de6-4e6a-4cd2-b51e-0a98daa4dfde", "value": "invoice-1645080830.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e0a7ce-43b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456833, "uuid": "8aed5dec-06c5-472e-8ffe-250128c70846", "comment": "Malware payload (ConnectWise)", "value": "5ce4403780b330a9b377a9e4965f92f0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456833, "uuid": "83dc36d7-f0a4-4a2a-a8f2-df2f3c2f0030", "comment": "Malware payload (ConnectWise)", "value": "8f2c0ab88bd1eb86152499a7099954390a2fe05135b50994826a76cdf0dbb82c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456833, "uuid": "5835c95c-7b1c-4ff3-825a-88dd43dec7fc", "comment": "Malware payload (ConnectWise)", "value": "abfb97da36a95bab2888d6968f5e9ad21ca284e3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456833, "uuid": "37124dbe-53bd-4687-9af8-4a2f0d7126be", "comment": "Malware payload (ConnectWise)", "value": "a116e27c3dc847476f9279d2db23d9dd319cdd855d80d52eea2dd4099eadd9ea7ffb5df7e40cd11ddd9e47565f0582f2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456833, "uuid": "e16814c3-b4cf-456e-838f-2b64ee5653e9", "value": "T190646D11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456833, "uuid": "a00d8e6d-37d6-454c-b7df-4c4c9015a6c0", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456833, "uuid": "a1f826d2-6f23-4d49-b813-47b66a606c26", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9W:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456833, "uuid": "f414f2bc-18f0-4b6b-8816-a89dd8b580ca", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456833, "uuid": "92bb8eb2-379c-4f2e-a6d3-9b7527e078af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456833, "uuid": "659e7a04-c712-4006-8cc2-d13c7715105a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1370d931-43de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777475651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475651, "uuid": "a72598b3-12f7-4168-bc07-75254d4644b8", "comment": "Malware payload (Mirai)", "value": "bfc185ec3dc6a48bce1e6a7e53c1d279", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475651, "uuid": "5c772809-684d-4f46-9f6b-7e348979e67b", "comment": "Malware payload (Mirai)", "value": "8fc88fba6e51167d60ddef894d65952a90417be05b1faeb67f6b55ba94d76aff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475651, "uuid": "a19719ca-521d-4e42-971d-1f1365c0073c", "comment": "Malware payload (Mirai)", "value": "7a8cbec6116c815b1002e463388ec69624d1d5c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475651, "uuid": "70018110-7bf8-4326-ac61-868264a041a8", "comment": "Malware payload (Mirai)", "value": "0853af1166450b9b41f9e2ea2ba076ea3984959b17b658d08bc8dd1afef73407c08e243f8d266f1c88c29ccdb370ba85", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475651, "uuid": "521e2579-4c3a-4e16-b71d-ef1962e75af0", "value": "T1B49319227E761F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475651, "uuid": "b0077ad9-40dd-47c2-a34f-e76ed3dc94b0", "value": "1536:5y8MSzlPyzhCJuWsZIJH11SYIZDptbwgENWq5+/sAlhEtBr:5y0A2j/SpVBJENlzpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777475651, "uuid": "2edc1f21-aeaf-4546-97c3-31dda3a4cf12", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777475651, "uuid": "d84c4e7a-8db4-472d-af80-b9616878300c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475651, "uuid": "a50698fe-698a-4e08-a54b-71c7419353c3", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c81d86-43fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487753, "uuid": "1bb522ed-8948-4dc4-9893-91f6bddb55b8", "comment": "Malware payload", "value": "5d7fc31f6509c1aef8d91c310f8e946c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487753, "uuid": "597ba230-873b-4751-89bd-4c661742ebb9", "comment": "Malware payload", "value": "9041570f5837485ef9485812647d979baa06433d9d702903f2054a64739c1fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487753, "uuid": "0601e68e-1545-4f6c-862d-44af8dcd4d93", "comment": "Malware payload", "value": "af93dad84a1afae7a45de5ffcd5dbee9c251b6f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487753, "uuid": "32fe0c12-f15f-4401-896c-2a7444368613", "comment": "Malware payload", "value": "af50bf853e71174ac0f09e346ffc403de28a8bf915094fb3bc647cbf06bc20faa6592d1650a3e6cfd5e10e1964577f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487753, "uuid": "1f189231-91e2-48c4-a36f-03d9530d0d3c", "value": "T171185B31724AC52FD96201B1192C9A9F512CBF360BB254CBB7DC2E6E0BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487753, "uuid": "dc609bbe-919a-48bb-9e0c-a6f210c992b1", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487753, "uuid": "2c8692d0-8033-496d-9d83-2d65eeaff4b5", "value": "49152:lWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5eVKPAELcpB2MpF8f:lr99u4kc8Hao8eRjYBU4UAir2Y5mKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487753, "uuid": "cd5944ac-5a18-4469-91d6-aa68f60cd948", "value": 91237736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487753, "uuid": "99500db0-bc6f-4c3c-ad1b-c4f008956075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487753, "uuid": "30320cc5-0fe0-4416-88c5-61584a378089", "value": "mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9154af-4418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777500763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500763, "uuid": "7c31b141-c868-4324-8338-d09cd0e56ff8", "comment": "Malware payload (Mirai)", "value": "0ea22ee8c75822891d8b387fc889453e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500763, "uuid": "be87fe61-454f-4607-8936-5a0b2f865d08", "comment": "Malware payload (Mirai)", "value": "913ce9b38b2132729be84626fe4606f5b5364058e706d5af2d8ba529fd4da6f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500763, "uuid": "c2696a9e-d839-4f5f-96a8-466e958a7edd", "comment": "Malware payload (Mirai)", "value": "3e0b4433f1ad799c6cc7062be75e07b6e74b03a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777500763, "uuid": "b8f2a0b0-6b94-48e4-aa14-9be66d6593e0", "comment": "Malware payload (Mirai)", "value": "5ca245af526f97040dcbb2212cf42ea7e72ddbea0df02da6b109d68ae6ca341288af6871446dcb116d0b189e75327eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500763, "uuid": "89ff96fd-7e2c-4d30-9597-096f075178ff", "value": "T13314C70A9F520FFBD8AFDE3345E90B0225CC650722A93B763674D524F54AA4B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500763, "uuid": "fd50d8d7-07aa-447a-b300-be01b5b87109", "value": "1536:/mwlmzRjEyD0ZgJUS6CNWbvZVx6hhj6zBzCjX8K24j82X2I4ZlJzwztBd3HLoCIv:Gzh76nb0T2EXACzcOvtkfPyLbOy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777500763, "uuid": "d56dd04b-14e7-41e7-a1f4-fda68b92cc40", "value": 207264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777500763, "uuid": "267ed9a5-bf15-4a48-a218-3bde7a5f148c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777500763, "uuid": "1167d784-ee1d-4ca2-a15c-a3d2631cf6a8", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4a5a30-436d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777427245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427245, "uuid": "bb6db43c-e02b-45dc-afdb-7b29c5a0692c", "comment": "Malware payload", "value": "b58f6f5f517927318edecf747ab014db", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427245, "uuid": "5a9c4d40-8560-45ec-bfd5-df4bc6983722", "comment": "Malware payload", "value": "927935812e5741c8c53d2b0339de9527c3e4a4bb5d6b8f07707132d7549c0659", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427245, "uuid": "3593081b-03d4-4450-a8e0-fa0c227ce405", "comment": "Malware payload", "value": "e9abc8d50d9b3d4c26de376e595cc748c4746a32", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427245, "uuid": "fd4b0fa1-de06-4112-9144-b3f53584f9d0", "comment": "Malware payload", "value": "97adbe75bb6c986306a7bcb67497669c36f9ccd42f1501e07bc80aa41955e51df9972d8957a8aff1b28ac3b05e5d0767", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427245, "uuid": "258a1f66-06f3-4dac-b153-4b0d10aba14a", "value": "T1F1A57D331203BDD62BBF2D80F5002D925C58BDA797A0462CF6C419DA66E6244DF7E9F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427245, "uuid": "032c2132-b4b5-4097-a9b3-28dfad0a9848", "value": "24576:6yKwn/95B0bDUgck5ZuDyUxDxB+oJ9I25jhSsQItyO4LO166bIjLbrVdUm+J6ho6:/Q93f5MP0nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777427245, "uuid": "83267f48-524c-42b9-a5be-5d05fe177091", "value": 2107384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777427245, "uuid": "0afa083a-43df-4c4c-962a-53a7dc51e97b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427245, "uuid": "e0e822e4-bd67-4257-b2b3-5b1fe0bf8d93", "value": "Mullvad.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9885ba0-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455394, "uuid": "dcc927a7-2880-4c2a-a02c-4ebd6049e729", "comment": "Malware payload", "value": "0966cd84e538a74eab3bd1532ef52704", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455394, "uuid": "ce017e4a-f0ec-4909-83f6-d98dd6a55274", "comment": "Malware payload", "value": "927f3b806019b9f0b7372c64c0553c2b2d51cc295350fd937c8f39b699bf6867", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455394, "uuid": "4d967279-5e5c-4867-81ec-a910916b264a", "comment": "Malware payload", "value": "d4e0890dbcc9cf9cd81d898fd97721ba23da5def", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455394, "uuid": "4cfa2a3b-7d32-449c-ada6-80695cefad48", "comment": "Malware payload", "value": "06287ac0d3bf2ddef7444a8e5ce0bfb9e81c16f14dd359ad3a08705f6f24ffb8775768f1b586c826bceb85085408d6eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455394, "uuid": "f798f7aa-0ba1-4c3c-81d1-29756c0fdf6d", "value": "T17937231E5D12887747AC248D743E4EC3CEE84B09AD55DFF39BAEB86E45BE74260024D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455394, "uuid": "8acb093f-3406-4bc6-ab35-4cad584f1669", "value": "49152:CHORegHORe7HOReRHORekHORe+HOResHORetHORelHOReTHOReXHORePHOReIoEO:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455394, "uuid": "0b7a4d9d-9f4e-434a-8dd3-9312c5d22b2a", "value": 23944463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455394, "uuid": "e549af1f-aca6-46ff-819e-7099e98b95fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455394, "uuid": "32157a7e-ccfe-4ac0-bf07-d6ad37b064c6", "value": "invoice-1645080830.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18ecc40-4396-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777444992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444992, "uuid": "0619519d-c7bc-4439-a160-43ce019e005d", "comment": "Malware payload", "value": "5cfab7ea3c50dbb34e91a25c5d724bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444992, "uuid": "30d2cf86-98b0-40a5-81e9-0300de5e4bc5", "comment": "Malware payload", "value": "92a388af48153c6001cb85d5562740fc0e813c04ad8058205a0b200a3ea596cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444992, "uuid": "1f51815f-e397-4332-9471-2dc390dc8720", "comment": "Malware payload", "value": "4da0909c47809ff12b4de51060deef8bbae18a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444992, "uuid": "8ddf9d1a-c2b0-4cf5-95e6-1b519e3db582", "comment": "Malware payload", "value": "39656fd70eba0147956c738cbb39de55586ec0da50ca5d615e936d6a768a0a2c5f41f3ebf394c7f019e342e8d2631be4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444992, "uuid": "de98f73b-3c9b-4c13-8d6c-af6bd77c21ac", "value": "T14D329E7652137B01FF12173284AA0AF7DAE35F19797B089238812245706E6CDEB4ECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444992, "uuid": "62606be9-a483-4d39-b9a2-6a78b77ffe80", "value": "192:BqmG3DvEJWbWxjlIYwAJzSU++Mpa9mm0LE6Col3jHhTpWOltZZEaBHKEcc:RaWLICPj0LEidDhTp/ftBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444992, "uuid": "7ec58211-2c10-4fc2-b279-0416455f7cac", "value": 11352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444992, "uuid": "f3914c33-b776-437d-83b7-9fbd7cc7e211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444992, "uuid": "f9dbeb2b-eee6-4899-a336-93ebdee3c555", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf2a16b-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493222, "uuid": "75a19d3a-287a-4198-9573-48d570eb419a", "comment": "Malware payload (Mirai)", "value": "f4deeb8348634efeaf8129feb061f888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493222, "uuid": "aa5cea62-d28e-4ba1-bbe8-968e58409ec5", "comment": "Malware payload (Mirai)", "value": "92ac09306d38447b0e33ae5d53c58de17d5c6cd12754d87e0007f5e5ffde5d3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493222, "uuid": "4b808631-a2af-489c-8657-7a889a83beaa", "comment": "Malware payload (Mirai)", "value": "30f0adde9f44fab1a89d32c056843a1db5ae2997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493222, "uuid": "592275bc-c865-4fb3-8d12-00d71b1fb11e", "comment": "Malware payload (Mirai)", "value": "b0f479aeb9ab784bb3fa7a24d143be0410de2755254b55fca32a34e07f030f9796a7deead279b97c321e409273b413f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493222, "uuid": "688ccb33-3863-4c9d-a599-943f779bfe33", "value": "T13A331951B8C2A667C2D013BAF6AE968E373073E8D2CF3227DD611B113A8511F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493222, "uuid": "28da371a-272f-4402-9756-c5089449607a", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYhSF4Xgt2FgNJwJZY10Uw:MX2R3ZNiwaAFz20eOaYhSFGJa10N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493222, "uuid": "46bb9a0f-5f1c-4d62-b895-07a5dd853c52", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493222, "uuid": "e910337f-5fcf-4b1d-b3e9-0a674526c0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493222, "uuid": "d9a06d00-91d6-4129-a973-231a3dd4d0c7", "value": "RpcSecurity.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15523d6-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440321, "uuid": "fbabfebe-e1b7-4932-b57d-db1da955f83f", "comment": "Malware payload (Mirai)", "value": "14977319f290b9499b6afbff903744c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440321, "uuid": "0cfd9668-386c-42ee-a41c-70555e363152", "comment": "Malware payload (Mirai)", "value": "92dbb1e8d16d1fd55c5321e7c1b3183a3c77e1e6ed1a459b46d1b11b77923a6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440321, "uuid": "61b16348-79c9-4522-8bbc-ace00ff2d075", "comment": "Malware payload (Mirai)", "value": "bb8ff3f64b3154551761f4a924ed0f3ecb0612b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440321, "uuid": "40821864-a92e-4d0e-9434-263ef0139776", "comment": "Malware payload (Mirai)", "value": "bc92076e6b63ed5d5cb88fa058d250b952836b808b4d1281913496ea1bda75b5de3f90753e775a08d1e8e0f7aa8107ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440321, "uuid": "994a17b0-e93b-471d-9ac8-50c91e05662c", "value": "T118332B48F783E0F0ED4A0571115BF77E96349E035124DE6EDBD4FE72AE32A12612B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440321, "uuid": "bfda26bf-8afc-44d2-9687-c2284c6d080d", "value": "768:jTbVR1qT+C5GcbiopRrnVXfUEAFeFHIruziqANOV+U2331gkLrGfRTgqDl2plTEr:jzfy9p3hFHh+U431gkLrG9HU+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440321, "uuid": "0c4a0b2c-ae16-496d-b2f3-f2e1ed9acf2c", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440321, "uuid": "a3e242f2-43d5-4ec6-9c86-fc1406c7a227", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440321, "uuid": "586a5a8b-9ee9-45f7-a07d-fb774a314d8d", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff55ca62-43a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451565, "uuid": "830bb991-ac66-4214-9a7f-9998b681b91e", "comment": "Malware payload (Mirai)", "value": "b001dba2106b2639d474d40d152c98e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451565, "uuid": "78244006-da71-44e0-a47d-386adc6574f4", "comment": "Malware payload (Mirai)", "value": "92e2d42a0087d03b11facf357c1b9a9d84e4b5ff40e44f3eccb7d135b65029f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451565, "uuid": "53389c83-395d-48d5-9128-28b847756470", "comment": "Malware payload (Mirai)", "value": "ed31820030247228f9498605e86073ae203f58fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451565, "uuid": "5bd190ec-8352-4cb6-b801-914e99376945", "comment": "Malware payload (Mirai)", "value": "599e7f86ef31893e970c7899ef1a1a0488bcd08c950390f8b6847efcda6d1019e72caace2c805bbddfda54e6945e26fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451565, "uuid": "510826a7-4422-4c8c-a157-36d6bbcfcce9", "value": "T1A7D2E0B2E138281EDEFA3E600CDCC3D493590F96B7E067C139DAE7059407906D2A6AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451565, "uuid": "10496a35-4977-497f-a8a5-4eb37d7adb22", "value": "768:tBzg0gIzrshZxK8aMgUtNnagVIK8x2Fncj6U48k4uVcqgw09f:tC4rshZxK8ZgUnnpqgTB4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451565, "uuid": "c9225628-c2db-4a3a-b26e-41b847b0fe19", "value": 30092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451565, "uuid": "4ae0a9ec-d6ad-4d1b-ae84-7c87e808bbad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451565, "uuid": "46094c6d-6090-4bea-bdfb-0042ac5d8971", "value": "asuna.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638d1c47-4400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490388, "uuid": "b4cbf6f5-253e-49ab-9a8f-e2d9b18f1730", "comment": "Malware payload", "value": "e6ce4b153e80208440b92ad26554cece", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490388, "uuid": "0329d1ab-3598-4179-96f8-ce01a05df624", "comment": "Malware payload", "value": "92f1a3dedc93cb242fc6977bfa1ff9e0312ad96cb44a4b889ea55ab53de5c427", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490388, "uuid": "dd93d323-bc21-4b6c-9239-8628c846e152", "comment": "Malware payload", "value": "f55ce8c8001c00c82b064cc4a6f9a4542043d6bf", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490388, "uuid": "41e42618-0f59-4f99-8580-1f2eb992010e", "comment": "Malware payload", "value": "b9efe045c81a2d95187cd83cda6e2964d56543c901a939e529b899dbf0897d0ce6f8389fe7267b2d00412cc077f2b298", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490388, "uuid": "bdf4aeaf-331a-48f6-9dc0-d330839817be", "value": "T1ED1612467641D0BBCA5B40B171ACC2288D276A304BD1BDD3B7A48F7499ED2F029B572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490388, "uuid": "4e3a80d2-e2f8-479d-b6b0-aae935735bdf", "value": "1cc1bcaa1fbe3c4be89ec64e10dd828a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490388, "uuid": "e972d888-9db8-4643-88b6-b138ede551ce", "value": "98304:yOM51BmBAox0L+NdUOenVAY2BvuNLyX29wd2gIZEBnF3k9:yOM5CBl+6h6dpyXseF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490388, "uuid": "b9f98c40-59dc-4c44-a658-af2f3ba52e7b", "value": 4400128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490388, "uuid": "d10632c2-8eb5-4ceb-9fe8-2abb8abd2bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490388, "uuid": "1c8e9631-d09b-49bc-ab9d-d20c1e8b4002", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff0494a-43c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777466303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466303, "uuid": "a57f81f5-9de4-42af-a65f-14bca9a16615", "comment": "Malware payload (Mirai)", "value": "126477b84b92696e21495006cdbccb40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466303, "uuid": "9f9a2eec-a96c-4068-9539-73a7edb32a76", "comment": "Malware payload (Mirai)", "value": "92fe924ec7acbcfe97dbed0d43c1d0cbee1287c698c2458b6541588dbb7b86e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466303, "uuid": "e1ca2ed6-0279-4b74-aa1d-4c1f8bb61628", "comment": "Malware payload (Mirai)", "value": "58422ad6d82c378f56f872f187f5ce2f59e87bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466303, "uuid": "5495819a-6fed-4bc3-b620-16df879fd656", "comment": "Malware payload (Mirai)", "value": "c6fe61ff5f7bd0756a0d6d7febe4ba0fbb79b9a7a57f3816f909a69237551d3caba8692de3cdc272538701805d72a53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466303, "uuid": "ed784226-7226-4eba-b507-17c2d41505c3", "value": "T125E4E50A2E629F3CF37487314BF34B2497AD72D617B1C585E2ACE1055E2025E592FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466303, "uuid": "7911d299-2367-4195-aee2-3a6a46cdfd51", "value": "12288:4Wgu5k/fUJEaGDBEEXGnG/4ASrpBwQ5jhjWl2:42k/fUJABEE2nG/4A+F9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777466303, "uuid": "ee94fa05-a244-4f85-bda4-5ed81543c41c", "value": 717216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777466303, "uuid": "6fef0504-8203-46bc-9aa5-eb1629f7cc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466303, "uuid": "4bbf3b63-dd0c-4552-a56b-5502f015a535", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de774540-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440343, "uuid": "2427cf40-da64-4589-afcb-80df3b622935", "comment": "Malware payload (Mirai)", "value": "45eee68911e76f921db4afc19ca1cf0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440343, "uuid": "c4b9f091-f293-4cae-8f30-6e89548a4e2b", "comment": "Malware payload (Mirai)", "value": "93b1b5375460560f698a23756ab0497a025915655cd529b24bad7cfc5f225878", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440343, "uuid": "610d13f1-1797-4947-b621-a59dd0f0e1dd", "comment": "Malware payload (Mirai)", "value": "6d2ddbfafa66756fe4ba0aaa6b6f54caf4ffde0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440343, "uuid": "c3e3caa1-13a9-48a4-92db-a5676330653a", "comment": "Malware payload (Mirai)", "value": "7464f01243dab29715143a2afb3c4efdb5a3d815c7165f064fe7b5950aace18a4885381e9a3f640cc735ec118a186c22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440343, "uuid": "01366051-1d91-474d-958e-4dc69ff15918", "value": "T10523E1D2937BE7BDC791A4BB113C52D5FCD12861D9281B7A3E1E20E468175012E36BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440343, "uuid": "72b1ae12-e415-4b2e-9a43-161c8080bc62", "value": "768:DAcqhb++kwZwsn8mwYDTYXomE3a6HTLZO98mxKg3q0a/IXDMJyc3pv4J:Uc2bGG1DTY2vA60K507", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440343, "uuid": "24f736ac-0a00-411a-ba73-e518f922db7d", "value": 47704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440343, "uuid": "0c7d4f03-d146-4b0b-9cc3-08bb57c867ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440343, "uuid": "440fead0-1bc1-4191-a25a-a82b671cb8b8", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fcac94-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440819, "uuid": "a4851e5b-2ac5-4617-8660-dfcda3fb77de", "comment": "Malware payload (Mirai)", "value": "d4e958b37f5db84d0707d0835aade0b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440819, "uuid": "d5cdc864-8785-439a-b9ab-9356b79327dc", "comment": "Malware payload (Mirai)", "value": "940d94f2bd13d63a69a783c28d96c6a1d07b9bc1d0f070885607d5ff25977b7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440819, "uuid": "c763dadb-f2e7-4e12-9324-61df922333a7", "comment": "Malware payload (Mirai)", "value": "bd3d5c3a3124cbcc856aaf1bc8271fe4c916c0cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440819, "uuid": "34fc1e39-3d8a-46ab-859a-093990cd3218", "comment": "Malware payload (Mirai)", "value": "f3a89659d6feac981d0ee6ba6e98b77a5bef8ca1b806dedb5cce656921031c5d199a7959d4a171992d4d52f24be200b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440819, "uuid": "d03ec484-3979-4b90-85d8-f79300dc06a7", "value": "T154739409BB600FB3DC6BCC3709AA2B01389D665721B97B36B934D918B94B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440819, "uuid": "fe1a8959-1df8-4d1e-98aa-3bf2eb12c368", "value": "1536:jJPENKWGFuNK6Mpn4kCDXpsIOtdZOLTCX:jJPENmoNK66VLtdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440819, "uuid": "4938adbf-66f2-4688-8060-54623bac7f5d", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440819, "uuid": "0f13b554-3a77-4c40-aad1-35bbb0141a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440819, "uuid": "4a67f1e1-211c-4b58-a07a-2872ca1802fd", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f9250e-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479705, "uuid": "e05d3125-cb1c-4869-a644-17d8f2fae695", "comment": "Malware payload", "value": "cfc22584e9823a942a1381c05078cabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479705, "uuid": "8a0eec0c-e1c4-4ea0-9cff-632685dbbeaa", "comment": "Malware payload", "value": "961e7bc96dc88b34b2a9eeee4744fcd762fb200b115346d6525a5438af2065d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479705, "uuid": "116f2654-5b4c-4702-9d3b-1c1a554bf3da", "comment": "Malware payload", "value": "87b02d84fd93a488dc9b57d294dc580ad21ccdfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479705, "uuid": "591d7198-002e-464b-a389-8204ebfcb0aa", "comment": "Malware payload", "value": "37c4fa6d65a7880b1b7c1cfc148442e9a257595aa2410f22b3dc710decff6758c24a2a86fde17c5753a854b943af451f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479705, "uuid": "8c8f42b9-100a-47eb-8f8e-83f15604eddd", "value": "T1EAD42ABD9C60E336F60CD0BAD287E7539F2138001236B99319BDA7241246572DB677EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479705, "uuid": "54ec07a4-4c46-4c24-8cee-11f8d1e0e456", "value": "12288:xq4DrYI6HlXEHDm86s9MrOXrzTPaM+W31CAG/JUQI1:E4DrY9lXEHD96wMrgrzQoG/JUT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479705, "uuid": "e3d4752c-e99c-4b0f-8e6e-1ac138e88c58", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479705, "uuid": "9b278a34-2969-4f08-97b2-8eb433540de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479705, "uuid": "9ab434f4-72d1-4831-894c-8f62cd8be288", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfba33b-43b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456878, "uuid": "0e4946c9-a740-47d2-bb17-9b65b9c11f1b", "comment": "Malware payload (ConnectWise)", "value": "6ad5b6ae270fd9d0cd3623e10aaf901b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456878, "uuid": "ee2b31a1-c412-43b7-b1c6-422cb63db6aa", "comment": "Malware payload (ConnectWise)", "value": "97a0ced643015844c334578a2bb607cb282a8d645306128e937c62758c6b5b84", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456878, "uuid": "a4c59486-c6ba-4b9d-8063-1b0f035e03e5", "comment": "Malware payload (ConnectWise)", "value": "7e014de8d602fb8b63c2c7b753dd817f544cc3f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456878, "uuid": "ac2e166c-b828-4cd2-9224-4225e89bdb29", "comment": "Malware payload (ConnectWise)", "value": "7b1561f1670b557d60fc2779c9f7d15378098fd77dc17447065776af678f13c9caaf293398c1cb240f32065f70361802", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456878, "uuid": "564d56b6-1630-4346-8033-0d55d3330a8d", "value": "T11156F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC04E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456878, "uuid": "3a7b9a37-34df-48ea-b815-ff0e7278d650", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456878, "uuid": "d49a0e10-fd54-4c20-9abf-d189e984419e", "value": "98304:rzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:rhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456878, "uuid": "3d76856f-0222-458e-b934-aecb7475c5af", "value": 5966680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456878, "uuid": "01b53aa1-51a5-40b5-85e8-30e0905edc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456878, "uuid": "aa856b17-102d-44dd-befb-17f7b7569aa0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35702c7-43eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777481476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481476, "uuid": "2e08eb5b-77f3-47bb-8f95-77078fd1484a", "comment": "Malware payload (Efimer)", "value": "29e51d8f5b6f388d5a5e986d8896335c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481476, "uuid": "ea7dee53-ca05-4f02-895c-af4677d1ed93", "comment": "Malware payload (Efimer)", "value": "97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481476, "uuid": "0900a0e6-9052-4e28-ac2f-b66a5b6e534f", "comment": "Malware payload (Efimer)", "value": "6bc60dc0202467b8a55a43fa98a3bc5dcc7a3306", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481476, "uuid": "e890bd8e-62eb-4f6e-a7d7-721750348cf7", "comment": "Malware payload (Efimer)", "value": "cb3a424eb8067927bfbd9a854d984eb609a0901a1745b287ac12b4ae8628c59b04f55004ffb928bcf728a8cf6fab8bdf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481476, "uuid": "7ef866d8-7ccb-4ef7-bd97-6e5e8f1940db", "value": "T119D6330EB0D270DED2B78178BFF469F0F824B86416B5987A6A8CD3F06C67474686D44B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481476, "uuid": "e94deb1a-2c8b-4053-b306-d27b965f65fa", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481476, "uuid": "19a65e9d-d768-46e0-a302-e0576dd7f8fc", "value": "393216:NwGeqy78OOyZs+eXMCHWUjXpcuI3/PGTAI:NPer7NdeXMb8XeH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481476, "uuid": "b049c52d-a296-41ef-ad30-a2536664edfb", "value": 12619852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481476, "uuid": "7687ee6f-572f-44c5-a541-b6ff309ee11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481476, "uuid": "493c835a-982d-439d-8c19-09088f680517", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb658f4-438d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440956, "uuid": "b16252a3-a323-4b42-8f8c-305f04c37132", "comment": "Malware payload (Mirai)", "value": "7ccb8a65d163bd85133a077fdf42b11b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440956, "uuid": "d8a9059f-95d0-4b43-9707-5376b36004fd", "comment": "Malware payload (Mirai)", "value": "988679b4ed14dd2e3d70183433d163f47d642c2f80bd6a652540cf1388fe8fe3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440956, "uuid": "f8358682-3c38-4e2d-9c76-e1e6ab81a355", "comment": "Malware payload (Mirai)", "value": "6cb1106394e66bab05037069bdf83900ab65b34f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440956, "uuid": "e6dfdf5c-a3a6-48cb-88ad-8468e09f0494", "comment": "Malware payload (Mirai)", "value": "29cb9302de7b06dbc54712e2d5aaadbbe5b43991828dd4165bd04537bd25978043d71a9f8d051920470c615e090935d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440956, "uuid": "42281086-dd60-447d-8e1c-231318fca212", "value": "T153C32A06B30C0947E1633EF43B3B27E193DFDA8121A4F640655FAA8991B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440956, "uuid": "cc8a25d6-0215-4de5-86b8-b8a396f99fee", "value": "1536:dyd65mdLLhJxDxI+bYqKA2OGxIkEcbI/MvAeJuOARGaJH8QqMibsao:dYS6LhJx2FrOGWkIpeCito", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440956, "uuid": "338bce5f-0d5e-46a9-a365-218d5d7672b8", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440956, "uuid": "99794489-cb00-43e4-b67d-a01af6f04023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440956, "uuid": "e8469afa-7d72-48db-9637-0917033e4342", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca16ffe0-43f6-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777486265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486265, "uuid": "c7936fc0-32e0-4623-8718-a2a851ab33b1", "comment": "Malware payload (RustyStealer)", "value": "9cd820aa0aad55bd59d38804b11a8033", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486265, "uuid": "8bbcba96-0cde-49b0-82ba-cc1fff279d1c", "comment": "Malware payload (RustyStealer)", "value": "9926ad390c95ced5f9e03864d393eb6fe60e4fe66db52b93ba411e6303620fca", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486265, "uuid": "47fdb73a-e9fb-4ea8-ba18-b59980bfb055", "comment": "Malware payload (RustyStealer)", "value": "6f044fe72d7781cea6619320895d36d61b097ed8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777486265, "uuid": "0b2b912f-6b0d-4801-b9db-477d2e1a7eb7", "comment": "Malware payload (RustyStealer)", "value": "01a3ac4bdd4a9f3e2e6ed6d907a6b2c01a3476f5f8c38e5120f3e28b0e9059256b5c1ef4e7fcb52e44ec27dbc726c50b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486265, "uuid": "95392c50-2bed-40a4-8725-48f3e4cd6d97", "value": "T12605F129B69C59FAE167C074C3055922AA72B4870B316AFF03A546393F2A6F14F3CB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486265, "uuid": "81409da8-9918-4b34-a13d-11b2a2e27a39", "value": "76c53218ed40e815a93e8710f23a3532", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486265, "uuid": "943e4f66-802c-4854-9137-4eb06798a095", "value": "12288:5zn7JokBalVqoiCOPhWFrkHVkStY7MSysyWdSB8nJt5r4yFTItp9L58:5z7JbyegFrkHVht6MflvBEd2tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777486265, "uuid": "76716593-c08a-4c30-8496-77cca8b73759", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777486265, "uuid": "125ba189-5ebb-41b9-a395-ca87fcb4826e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777486265, "uuid": "b075c153-ff2b-4f89-9b12-3424b160c3df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f71265-4370-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777428751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777428751, "uuid": "c10957e9-fa0b-4d2b-8b04-bc6432ab2d02", "comment": "Malware payload", "value": "829035a2f7045024b24c656f14989a17", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777428751, "uuid": "7f4f84da-573e-4726-9608-bcc0d8648e2a", "comment": "Malware payload", "value": "9a174944a8c9b7e468d507b6e627b32e7b7e3d7dc3a725d95701041af6dd4579", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777428751, "uuid": "f5b7ae21-4421-445e-9df7-6c249f41df04", "comment": "Malware payload", "value": "13b6c552fa147027fc9d7216d02141da3595c628", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777428751, "uuid": "a0551553-e570-49c7-90dc-67eebc85eb2b", "comment": "Malware payload", "value": "b3dbc0fe3857984d6e9d099c0845d39fb204c22fb724e8742e559aae211795a874d97d9bdf3cb059af13c2d5c840946c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777428751, "uuid": "b0ea1a23-5773-49cc-b360-f99fe01b780a", "value": "T12F136D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777428751, "uuid": "72380350-1b34-4819-918c-8a02c124ce32", "value": "768:bys9NyXsZztCr9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bnHusZ9cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777428751, "uuid": "a42bffc3-f7ec-42c0-b118-de512bcda7a8", "value": 45437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777428751, "uuid": "3e851102-172e-46c1-9213-27c903fc5a11", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777428751, "uuid": "a1cc8abb-c5f9-4cfe-89d7-fb834e1754d8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c885fd-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494977, "uuid": "8a31cb91-db6c-443a-9be3-640d02056901", "comment": "Malware payload (Mirai)", "value": "d5c463b66975fc5cd2111b2877e00a3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494977, "uuid": "bc785753-78b2-460d-8543-7a289060e969", "comment": "Malware payload (Mirai)", "value": "9a806a879ebf147fd16d6bd3e477dc77ce037a678a0bfd564bc94c3396855fa2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494977, "uuid": "7f037cc1-e2fe-4f11-a8ec-de04663a4c75", "comment": "Malware payload (Mirai)", "value": "fc62bfcb0b1c59d1f0de21c28e58e7e6333d6e81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494977, "uuid": "682e72e9-b0a8-4221-b245-fe9ebec1d2ba", "comment": "Malware payload (Mirai)", "value": "0d84936348df028d4ce2e69c594803a6c1f073ffb8a94b2bd05263dfc8dd68f124ac59930d2324f71de8abd1b1242371", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494977, "uuid": "2c39c62a-54e7-4c38-b5cb-99c5e14a0e3e", "value": "T14D93E842BD429F13C1C621F6FBAF059D3B166B79D6EB3202D921BF9023868DB0D66251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494977, "uuid": "9d98705e-ab4a-4c5b-b3a7-80241e5d9d9c", "value": "1536:IV4F+8wMvh/zTjmCon3rqMGbUCiqeivkQGvu8DgYcwdxMUBA9Ra:IVSUujmCon3rql4dgk7vu8/MZRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494977, "uuid": "c16918d5-a656-4bde-a35e-e3418f26bb75", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494977, "uuid": "e32237e7-0ff6-4019-ab74-f923cc4fe9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494977, "uuid": "42e49141-16a2-49fb-9980-cc4bac780425", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7958d6d8-43d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777471527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471527, "uuid": "bd93af20-89a6-4f97-b659-23631917afb2", "comment": "Malware payload", "value": "3f24afaf73bba30d6803f7bec9b01986", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471527, "uuid": "e461c996-fd08-4d90-8887-0b543c93a509", "comment": "Malware payload", "value": "9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471527, "uuid": "92f0e0d0-544a-454b-a63b-f64555683efa", "comment": "Malware payload", "value": "480b37eb42e434e916e0aa9e63c263206a0e7908", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471527, "uuid": "bc026780-0ae6-44d8-bb4b-cd194e5240d4", "comment": "Malware payload", "value": "fae662de09b157b356376d3e18d5dc22c528988523e2c330bc436014adf8d669a39bf3a77a75250457333f7265b6f914", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471527, "uuid": "37b6cb15-97ca-4fa8-a63f-1f21fe6bab06", "value": "T11084E14B7BD88B52C54845B9C0F7682407E391CB72B3E34A3D8453CA0E567E48E9AFC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471527, "uuid": "f1fcf6c7-946d-46d7-8e68-877608069e59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471527, "uuid": "e64f43ba-a0cd-4d22-8e80-02765a990dd5", "value": "6144:JPguTrIssqWBEIN2huTV56eCn/wAeoSbcL+rHK4iByhcLfa0nK7c:JP/fsBBEI7xGemLcK4iByWfdnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471527, "uuid": "3ebc4dda-a2c7-4935-acdf-c44b77acc2be", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471527, "uuid": "44a26428-5574-435b-a400-8563cae4c8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471527, "uuid": "6c92e3b9-2a12-4ce5-84cf-a032bc1c77d4", "value": "9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51729da3-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777479620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479620, "uuid": "88743d2a-bba7-4b21-85c6-d1c882300786", "comment": "Malware payload (ConnectWise)", "value": "b71193269d3478a7b02182ec438472da", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479620, "uuid": "dd0e657e-f24a-48c9-a2c6-9c47ccca86b1", "comment": "Malware payload (ConnectWise)", "value": "9d3a68a3bd616524ec2c1d83c5220f70b0d926bb38062dac9ad6aa2d3c336bfa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479620, "uuid": "1eb27a81-e4e9-42a3-a0c3-206c8a8d2c8c", "comment": "Malware payload (ConnectWise)", "value": "615d692259e863ae1df827702acf93109ed795a2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479620, "uuid": "6fa6eec1-50fd-45ba-a01c-5d10496d2f04", "comment": "Malware payload (ConnectWise)", "value": "43869d92a295a9ec55de53a80802a60dab4d5b348cae1cdf29e11ed603e83655dc6f4378fbb6acc3a09b76a89cda97eb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479620, "uuid": "0d26a77a-3443-4351-bc73-67db0ea49955", "value": "T13E56F101B3E685B6D07F1638D87A46A56B74BC049712DBBF5390BD692E33BC04E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479620, "uuid": "31c53514-e3de-4e41-b604-9e59d5a7b5a0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479620, "uuid": "967668a1-cb8f-4661-a083-b9f9c32cb0cb", "value": "98304:8zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:8hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479620, "uuid": "a4b3db3c-2760-440c-ac1c-01ddd8396805", "value": 5966440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479620, "uuid": "0d5530e6-f452-497c-af20-207efa4ef52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479620, "uuid": "737392a3-cdc3-42cb-9537-14ca58e9e020", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0267d457-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451570, "uuid": "3e0c05de-8039-43e3-aa0d-e0d200b7eabd", "comment": "Malware payload (Mirai)", "value": "64c290b184062db366265fd3cc6eda55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451570, "uuid": "943f7973-8f3f-4686-b6e8-e3c7b8708fd7", "comment": "Malware payload (Mirai)", "value": "9d7754dbf226ea3e5d5b602dedd5fb1d79cd0335bb86060478c08a967ccce656", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451570, "uuid": "c1eb6b2a-10e3-44b6-be3a-7786dcc1d5a7", "comment": "Malware payload (Mirai)", "value": "d0760442bcdbd3cd8c0d094aa59bc056aad3561d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451570, "uuid": "483f79c6-5378-4862-9336-213dbcc6f5f1", "comment": "Malware payload (Mirai)", "value": "17f507dbc17485abae816b09a8317eb6c16018549bef0b3fe637445c01b1bee12ca85d362857bbdc4dfc4ff0af69b97d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451570, "uuid": "4987bf66-1f09-40f5-b470-2d588aefab17", "value": "T129E2E0ADC20589C6DA6985F833FF5F40AFA62F23F043A80925A1F6469E902563D836C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451570, "uuid": "84f9672e-2371-4a57-a9cf-8f3f82ea3d2e", "value": "768:KjvtMQ/xlhmJTvEvCaQNP+EFKf/r7YRWrmzos4mUk+XHMxJgGlzDpbuR1JI:KTtMEJ2TcvtQMEFITEm4osp+3MDVJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451570, "uuid": "92f4e331-6e76-44e3-b443-7481fb4ba465", "value": 32632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451570, "uuid": "19907cab-a72c-45f2-9127-b6c9136044a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451570, "uuid": "20ff8ca5-f3a9-4285-a205-a837da71acd5", "value": "asuna.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0af8e15-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441555, "uuid": "efc687ea-9446-4810-9bb7-4c4b7a40482d", "comment": "Malware payload (Mirai)", "value": "e546ef0a79369667309d7378b14cf4b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441555, "uuid": "810e37e2-22b2-4572-bb9d-5b93a7a5c7d4", "comment": "Malware payload (Mirai)", "value": "9de2d49ee9678c6744e68c98f88f597499e185c3d524384a57f5f3bf9775e310", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441555, "uuid": "3a817421-201f-464d-bb74-19323dff55f2", "comment": "Malware payload (Mirai)", "value": "3eaa696d04f3c582b3fa2171272e33d082606931", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441555, "uuid": "8489c26c-bae2-4823-8143-47ed1c868396", "comment": "Malware payload (Mirai)", "value": "d680fb53bcdcb290f006f4c71d0cafd48fa5ae5cc468c8b2938e47a4a300ab3ef3865f56c960e0ce82322c9568a95319", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441555, "uuid": "7cbc4d61-87ff-4716-920a-95bf6c534ff6", "value": "T149158D2AB2B3F0BCE017C03407DBCBA25535F07522212DBB26C5DA353D6ADE51369B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441555, "uuid": "5c20bb60-02f9-41dc-91a3-56e2cd72f58e", "value": "12288:fWWB/qRNgNgarbEbqYDddH56u/SdHzM5IgCn4kKShkzcEzBL9UayEf0DHHX:fFB/q3gNgZqPdz4rXxzBL8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441555, "uuid": "63bdfddd-333c-48d1-9826-df4015e40518", "value": 890992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441555, "uuid": "f5d94652-ad1e-410c-8d72-7de6ca4070c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441555, "uuid": "e39cb217-b936-4430-9816-a37f03b58248", "value": "agent_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06de0076-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488944, "uuid": "de5c97b6-ca83-4031-a7ec-890f789aa0e1", "comment": "Malware payload", "value": "1a1b69a952a5ad77c213dd43071ff777", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488944, "uuid": "3e9a49b0-def0-4096-9012-0a4310286ee4", "comment": "Malware payload", "value": "9e246af36f2d6cec66ad543de66078a38d33cb95ace71ba9b191f6f8c3c2eac6", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488944, "uuid": "8c513dfa-30c2-4871-a97e-51febfa224ae", "comment": "Malware payload", "value": "77c7a55e2151784ca324f8276b04c0dd792b610c", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488944, "uuid": "358295d1-e444-4d2b-9568-aa6a20b03793", "comment": "Malware payload", "value": "0a877b3993f9531989865633b1b683799f6dfb91256474b17ed6e317a54f780f195eb41a8682ff3bc5cf2d2883716bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488944, "uuid": "029b03f2-1387-424f-b93d-f2ea6c92adc4", "value": "T154536C1AFAD66398138D467C34F70DD1A0D56D1A1EE0AE9BDE88C4626D298DDFC12C33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488944, "uuid": "9d1dcc67-ace8-4c9e-8e9c-53412757e1d1", "value": "1536:b2eO3rJ2nx+0aw+W/8HWnRDj0wM8pRACenBu0WS1P4w4MKvyuHgqoByc5g:bO3tex+0/+WkHWRcwM8HeBu3S1P4QKv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488944, "uuid": "816ec7c0-8339-4084-888a-d0a003d8f90e", "value": 63896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488944, "uuid": "ad8e2782-0d03-4ad3-bfd7-1549120b0ac2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488944, "uuid": "12a949cb-66ef-464f-b514-45cccf2c1f58", "value": "ecicu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9c6cc7-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479988, "uuid": "a8fdf00a-de25-4811-a35d-e011ad7a9358", "comment": "Malware payload", "value": "a566de29888a65f3068286baeea8e70f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479988, "uuid": "d9e3ae8b-69f1-4ab0-ab7c-7eb62bf634dc", "comment": "Malware payload", "value": "9e6230c0ce510686d92ce9b866c9448349bccdd20418a6b11e828fdb88de59f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479988, "uuid": "8e86cea8-4a48-4398-aea9-a67fbd4667b0", "comment": "Malware payload", "value": "3671163e5957abb5aff45ee232807e5910a0381a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479988, "uuid": "c83f295a-524a-470f-a0ac-e57893a99be6", "comment": "Malware payload", "value": "73a59aa7147e3e7fb27138c27647b7909078b83c3ac1c3b32c9db3c27806fbd2c96dae0a23c9accb280b6ea92090bb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479988, "uuid": "4892405e-bd39-435c-9344-52bec7e6b241", "value": "T1BF183343E8FCDD93D6EB6F309BF010A3919B64C6148819A9A25637F9F68C2DE125C731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479988, "uuid": "0bd10883-83c8-444b-aa8b-23c083057c85", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479988, "uuid": "491c6f13-eef8-4ef2-8005-55f3a2a6a9d2", "value": "1572864:1Y2YVUHpCCo6FALauLYbTWhEngG0PXJIfKd+T/bkRE:1Y2YVUJCCHWX6TWDIfKgrYRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479988, "uuid": "fd8761e6-1312-4210-8f71-a2a8e8666494", "value": 89205888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479988, "uuid": "2fad631b-36c8-4baf-8d69-e812a5442334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479988, "uuid": "77611df6-ed0e-4bc4-91d9-0fcb947620c2", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1124a2a2-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494974, "uuid": "e8a1efc2-7375-4e9a-85b5-9cd82691f18c", "comment": "Malware payload (Mirai)", "value": "b34527d4041b4a9d80bf90ee00eabe3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494974, "uuid": "85e598b4-ae86-4173-b8ba-f032d947c796", "comment": "Malware payload (Mirai)", "value": "9eb158d0cebc24330d71de979b80fe8b4fb0686449e30e4b522ebb7d0a4eb902", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494974, "uuid": "5433a78a-7ba1-4cb0-94c6-74d0a412fe7e", "comment": "Malware payload (Mirai)", "value": "e2a1f32eca882b2bd881cfce73c79bf3c8f6c951", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494974, "uuid": "1bcf743a-f9ef-44b4-a3cb-65364345d4c3", "comment": "Malware payload (Mirai)", "value": "43ecea07297623e42d31d0885cc3167c8b4e9d71542060c2615bc2afc6166952f8cebad652d691e2d34a1b0bfa2cba73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494974, "uuid": "319e41fb-67c6-4861-b947-c70b308444c9", "value": "T1B0A3F887B901DE7FF80BE6BA049309197520FB660E530B76A367FD93AD310D41966F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494974, "uuid": "abe10d2f-e396-4df1-a912-fbe0cf50aa21", "value": "1536:/y/7fKh7ZXNUAknQOUZgRs368Fd4nPG0kwFJ7ZYPDqNDA6wByt5F:/yjiPdUAknNigRs3T4FkE+Z6wB45F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494974, "uuid": "cfba5806-9014-4395-aef9-8ac7cf85b0c3", "value": 99664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494974, "uuid": "d43586eb-d672-4c0e-93d1-38880ae16c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494974, "uuid": "61c24571-3340-49e5-8c48-bfc1d699eae9", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9b319e-4389-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777439454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439454, "uuid": "4fc3cdc2-10ed-49d3-afab-d897aad86eca", "comment": "Malware payload (Mirai)", "value": "dca141a8f7291dde5de86eef4829fe48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439454, "uuid": "0795fb30-3210-4016-a425-8e37b18618a2", "comment": "Malware payload (Mirai)", "value": "9f3fafe28b26c88ce35e1c23c0296e14407495ebd478f5da1b92694986181115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439454, "uuid": "805ab74c-0aad-41c5-ba61-1f3c58b4c67a", "comment": "Malware payload (Mirai)", "value": "fec17d55633fe2644638db156d5136a37276d0a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439454, "uuid": "e3c88eb0-1e5c-49aa-b83c-b1a2214d3be9", "comment": "Malware payload (Mirai)", "value": "aa95c229d63af4be464fa3f88288dc7ef0315bd259daf79f2d9e30be8fc7d0b324f5c45de940c987ffad79e99a009232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439454, "uuid": "e76af379-d2ab-4578-b34e-e2bc34fc4c57", "value": "T1C523F791B8819A27C2D41379F5BE998E3361B3E8D2CB7227CD604F107AC552F0C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439454, "uuid": "69b4b325-3149-4a71-bb9e-b8dad8d6f194", "value": "768:0XUOqmP+9s1LXCXfWD1llDfBz4PHfmWzV1yEkF+lDpo61mA2EDEy0eYjW9THvlw7:0AmPKfWXlDZzKHfmWzVZcLbk44E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439454, "uuid": "a1711def-4e64-4127-ac3c-04928a9fd3e2", "value": 47012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439454, "uuid": "d9cddb24-7c9f-44cb-b8ec-fe06e8ee32e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439454, "uuid": "806d3d1c-53db-4dc1-8d6e-df061ced964f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097ec5fc-43d4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777471339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471339, "uuid": "33f5a012-eafb-4a67-aac5-b3f07635b5be", "comment": "Malware payload (AgentTesla)", "value": "c23f4d9ed6fde2fa92884762a004a547", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471339, "uuid": "9acd29ac-fe47-48f6-aa2b-a87ef76606c0", "comment": "Malware payload (AgentTesla)", "value": "9f8a5b64565e4bda5657882544ccf2b1e67e229e41f27a2c2867cc5a938f8414", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471339, "uuid": "e86c5a84-e0c7-4b11-a086-af26a0d9a361", "comment": "Malware payload (AgentTesla)", "value": "3c4f71630eb5d16232a1ba3503e542f596258c0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471339, "uuid": "f73de9fc-1056-4525-af34-074bb5901dfb", "comment": "Malware payload (AgentTesla)", "value": "0cbbbd7b2aa5fe32b31b7a9f36ee1745e47eb45c08113d88f207220367bf097e19e7c7684fc60b62db087e91a6eea34d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471339, "uuid": "dccc04a3-40a6-4e96-8fab-868fecd7246f", "value": "T1B915BF207E566F55D66F1BF88092080977F2DC069F47E75B6ED8BAB839B3781CA02503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471339, "uuid": "e3c021b4-98e8-4c25-bb81-53de151759f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471339, "uuid": "16f98436-06ae-46e7-803c-5d3edfb583b6", "value": "12288:F2MZOhg+zW/9bTL7cweMav5MyZ6bG3wDdKFneKMZs:Fd0hg+zWRTLnc57Z6bG3wDdEMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471339, "uuid": "ab18ee9b-c79f-479d-bb88-9271403c031f", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471339, "uuid": "5404cdef-5bf8-4c22-a3bd-faa137a543f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471339, "uuid": "5f506b58-45f1-46b0-a4c7-7304e9e19b62", "value": "New Order list_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275bc767-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451632, "uuid": "1f3569d7-df25-4bca-a2c4-d9bb647f2af9", "comment": "Malware payload (Mirai)", "value": "42a8c9f5af6c463c79b712b06aae2756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451632, "uuid": "95b46762-e840-461c-b0bf-a6bb9f6ca9c4", "comment": "Malware payload (Mirai)", "value": "a00fad2ab3de4c7325f658a9ef326b682908101baded16b89e1b9cd5491f64f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451632, "uuid": "8d1013b4-5de2-4f32-8561-e9d806860040", "comment": "Malware payload (Mirai)", "value": "61b238dc872340cafc8cb19dc43109c96953ba05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451632, "uuid": "7a88c4cb-2d47-4faa-86ea-ad18ee20f7f1", "comment": "Malware payload (Mirai)", "value": "fdbf0be583f84ea11b4806960372faa1592ac3d778cbcde853b88777b3dbcc54812156fc1ef14718c5894457ede36923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451632, "uuid": "88c62edb-3437-44dc-8438-fbdc936d2b94", "value": "T16D83D709BF910EB7D8AFCC3306991B4634CC565B22A93B65B530D928F65E60F19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451632, "uuid": "8256b3a5-f5a1-466d-9609-7f18398135c4", "value": "1536:pS3c8MNGx0ID1Fy8BnGn7MwyS/jCdWbZufmNKo0Uwn:MRMNGSID/yGS/jC0bdVwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451632, "uuid": "220162f6-1047-4377-bf26-874ab8422e82", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451632, "uuid": "738473d4-a413-4640-90b1-89dfd3f0b278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451632, "uuid": "6e8b5e60-22ef-458e-9e9a-1a5dd1c295a3", "value": "asuna.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afa077b-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470590, "uuid": "9287e72d-d9d1-4225-9370-b6fea696dad2", "comment": "Malware payload (Mirai)", "value": "190895b9fe7a71e2b657ab7da4f3ea8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470590, "uuid": "37d0c5ef-41ec-4417-9099-7df8ed5ddcb3", "comment": "Malware payload (Mirai)", "value": "a01cd179fe6f35033f1030ee2e283b2f635f49890b5e7ef439720d57dea67929", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470590, "uuid": "a5f1b0e4-bab7-47c3-81d9-b9b198c4c70f", "comment": "Malware payload (Mirai)", "value": "83b717a7d111716aa29c85f380d2ba955f671184", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470590, "uuid": "cf1f80ec-1ef5-4287-85db-c92fe10a457e", "comment": "Malware payload (Mirai)", "value": "16b4b425544ae37b26c0c50d5bce9cd858fb35405d77b78ed07bdd2c3ceb93af1425562ca5a443cd9d72260e9897be4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470590, "uuid": "a0b37aad-e3e7-4533-bb08-758ca2228f19", "value": "T1A7831A0377090F03C16329F0267B1BF097EABDA519B4B284755EBEC59271EF22186F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470590, "uuid": "f4c8f434-d4b1-4ab4-ac84-997210347ec9", "value": "1536:9L7tgTewtH/OoQQ9F4ZcNAHeS+/PqU+mmJKlhv2qMQXrzsp7l:9af2oBKf+DmXqral", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470590, "uuid": "4d4c68b4-585f-433d-9d47-2110f1ac876e", "value": 88724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470590, "uuid": "50b275bb-0c7b-45af-8ba9-accb25ca7619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470590, "uuid": "5770939f-c389-41ae-b900-655fb82f0284", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9facea12-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494784, "uuid": "31eac4e0-acca-4e8b-8c7e-a0f3c6c7b7d5", "comment": "Malware payload (Mirai)", "value": "b92240b0936f5396b907d2e659a0e5d7", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494784, "uuid": "4f4f7442-000e-4e9c-b32d-ef709013bc4c", "comment": "Malware payload (Mirai)", "value": "a08598688785ec8722f8507d4ea5c6aa497a28d507765a710dc8a80ae654661d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494784, "uuid": "9a3e511f-fea8-4684-86fe-2f334bdc5ab0", "comment": "Malware payload (Mirai)", "value": "aaca6e2ddca1858988674e5b852cd2d5f215f351", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494784, "uuid": "7e72ed4e-5a15-4efe-9ac0-ceec3e4e87e8", "comment": "Malware payload (Mirai)", "value": "870e774fe408a6c5c80e5e72d5ef74371f7ce2f3297552ae25ce4003fc703ef94b3e50bdbc9bf9424776c76d597916ac", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494784, "uuid": "8853d8b4-38db-4cd9-84a5-8daed6656911", "value": "T10C23F1E3162EDFFAD44ED0316A9488EFF9317284620B0E6F8B695E298DF8C353562550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494784, "uuid": "1b5a98e2-25e4-4a05-8927-cee54666cf4e", "value": "768:b5XG6SUoxHFfv1+dTvSp0eyWs+vi3heXcf2JnHgUG/J/siyBJN+eXomP4:pnSRf9+dr4PyWZgIJAUG/BsiyfNlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494784, "uuid": "b1b7e327-006b-4085-a054-10a5aa21f71b", "value": 47356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494784, "uuid": "f865d25e-7f76-437c-8a25-e2ca40d0430a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494784, "uuid": "4a74b5e9-5d2e-448c-94cc-91bdeeee6efe", "value": "rage.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c804d99-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455507, "uuid": "68b7469b-b13f-46f0-af0b-78439f51323c", "comment": "Malware payload", "value": "488c91b7475c80e998f3b1ffe2756c9e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455507, "uuid": "b07dca21-131a-45ab-823d-d250f2127c7f", "comment": "Malware payload", "value": "a08d54fe396286be05d80b5397c8d0104b60bf8c27afa04a44001c7968acbbad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455507, "uuid": "90feff84-c546-4920-9af9-da9136f6bcf8", "comment": "Malware payload", "value": "3887815468493cac5ab72a1f603b34417e462343", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455507, "uuid": "cb317abc-01cd-4d25-8418-6dbba261b466", "comment": "Malware payload", "value": "f1f741c29fa69dc6f110c62b5303af8e6a3ce34d77dfb4ef17c75021f1be74a98fa036218193cb9b73336d34b693d515", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455507, "uuid": "d5b337cd-2607-4f70-8703-d05da828aae0", "value": "T1C13723239E3A6DD5553812AD2CAA095FDDE9EC92818DC37653F9384EDE0F2084CB749C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455507, "uuid": "4c836641-e03f-4ad0-874c-a10f8bdf140b", "value": "49152:Mq++pq++Gq++pq++yq++Oq++qq++tq++Vq++4q++Mq++Wq++gq++zq++y:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455507, "uuid": "ecf92677-d1d9-43a1-a0db-be7a0d04c981", "value": 23164077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455507, "uuid": "7c4f9a40-bff4-4c9c-bcb9-6160de838474", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455507, "uuid": "c06248b0-0980-4ff5-a4c7-6c0cefe16330", "value": "invoice-1645080830.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fec102-43de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777475633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475633, "uuid": "b73cabca-fa36-49f6-a480-d7632af31b57", "comment": "Malware payload", "value": "16ab69cdd67075c8932c84196cc7e6a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475633, "uuid": "3390f3b0-2f31-4dfb-bb5c-442989b1373b", "comment": "Malware payload", "value": "a0bc3b9f43bb50b58577e7a03929e216eeb6d5e01e3418466ccb05bb1b4dfa74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475633, "uuid": "041bb783-9707-4d3f-b793-651d9ac63d56", "comment": "Malware payload", "value": "613601b75fbfef3c60d6a4592401a16cf032cb01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475633, "uuid": "0db91f6d-afaa-41c4-955c-251aa91be7b9", "comment": "Malware payload", "value": "d81e4ae36abc58fe56f009666b4d6c0ae5dc5739c43ef3da8e806664093c85bfb9f4b69e814194f01ef8d10f49f7d929", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475633, "uuid": "9e0c7cfa-ed4c-4763-a1d5-f09b5279abcd", "value": "T1D301B98272B5307034E694E646322C7C30A69065BDB76CBD78A5F0F6D7D6D04A0A24B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475633, "uuid": "8c6a46a5-e012-433e-a0fd-fe5e05e2ecd2", "value": "12:YkF1kcClZF70SiOWNHF4OWNHFvOWNHFW/ygFSSy/FM5gFlyK/ygFSIy/FMDgFly7:ZDkH/FbidHF4dHFvdHFW/bF4/FM5gFgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777475633, "uuid": "ff976827-bcb0-452e-a37c-41d3bdb11eaf", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777475633, "uuid": "f183f616-8868-4ac9-a33a-6e1485e2783f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475633, "uuid": "33f51614-2900-4789-ac91-9c53514244ac", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50313d1e-43dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777475323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475323, "uuid": "c68ca08a-5357-42fa-a0d3-61b5c5b3a0fc", "comment": "Malware payload", "value": "9221422a0aafc123d7cdcd74338d8b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475323, "uuid": "7107cf54-a766-474e-85c5-ab3d448e1820", "comment": "Malware payload", "value": "a1148799ae853e11f1b5779587adbe85bae917dc769c2a5712160075e00dd928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475323, "uuid": "f972ed07-7a0f-427b-95e8-f3ed8f11e3ec", "comment": "Malware payload", "value": "6b91b73102db2a13a8cf0d3c5acf857f5ca30ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777475323, "uuid": "02162ddd-b037-463b-adf0-37135686b6cc", "comment": "Malware payload", "value": "e6a8e6c9c93a371c498969f48ea1ac7ec8f47ddfc68237a715dce4beeb0b5cf56aa13a83854250e63120a4820cc81e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475323, "uuid": "bebcc6fc-721b-484e-870d-49f5f4361d5e", "value": "T198064B31724AC52FE96201B0192C9A9F512CAF760BB254CBB3DC2E7E1BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475323, "uuid": "80f942f0-371e-4b06-a2ad-1373d58ea996", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475323, "uuid": "91b73c38-7562-445e-9bd2-5a3b38687e96", "value": "49152:3WbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5xncPAELcpB2MpF8X:3r99u4kc8Hao8eRjYBU4UAir2Y5JcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777475323, "uuid": "f656645f-6f09-48af-b91d-77450ee7672c", "value": 3668980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777475323, "uuid": "3177e166-c3f8-4506-9ad2-06c8b61841f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777475323, "uuid": "42e91599-d79d-45c0-81d3-c5e90a9ab6bb", "value": "JUMP SuperStars SmashBros.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f351c0-4398-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445641, "uuid": "1b0c61f4-bcb9-4f98-bda9-4555379d8584", "comment": "Malware payload (Mirai)", "value": "6fb9d7f66025faf0d4d0469e80c29520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445641, "uuid": "e20476d8-e45a-49b5-8576-529716e4fc98", "comment": "Malware payload (Mirai)", "value": "a18c10366adf9aff571c94fde922a78855f85004501f32b9ae15642413b70a0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445641, "uuid": "2cffdf19-627d-4049-b436-44801ecd364d", "comment": "Malware payload (Mirai)", "value": "523239ca0a79be90f1b8be3c5f80bf918aa5f0a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445641, "uuid": "c8e952c6-6554-4787-85e7-f226b5846401", "comment": "Malware payload (Mirai)", "value": "72241ac75806b15ae518dcf26db5aa6e04f7f2289c9e2ffeb953c12c88dd0ff339ec8aebf8311a1e5f1b89716e55bfdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445641, "uuid": "922b71ef-ce96-4b38-862c-d78886a165f8", "value": "T176735D01B30C0A47D2631DF03A3F77E5D3AED58122F4EA892A0F9E4592B1D3656D6EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445641, "uuid": "9f0cc228-a732-4d54-a263-5f763b8b23a2", "value": "1536:sSXBV5/lI7vVvUm9luBRuI7P/F5bqErIqfeSuqAoyvpoHALJn:FBV5/lwp0/F5d14l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445641, "uuid": "d7deb169-e37d-43b2-ad81-ef03cd9b4e84", "value": 76392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445641, "uuid": "fe4222b7-227d-482c-b24e-bf0f817d1ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445641, "uuid": "88efc783-decd-4f44-b31e-ea6e79025e2e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be78ce5b-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495265, "uuid": "bfe021bb-406d-46ef-81a3-3774a5facf8e", "comment": "Malware payload (Mirai)", "value": "e5b2a90b5622a43628907ea43bbbf180", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495265, "uuid": "9e81743d-408a-4f98-b2c1-35fb15953c6b", "comment": "Malware payload (Mirai)", "value": "a254047bff18db6406b64f9b6c59a7dd894976849c7cfe89de45749e9707bce3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495265, "uuid": "7b77e042-d262-4d7b-b803-f015e733236e", "comment": "Malware payload (Mirai)", "value": "bf0af7c547ff3f3a45e386e4d79120b5d5c22398", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495265, "uuid": "b7f17cb9-c8d9-4bf8-b97a-87912c84d405", "comment": "Malware payload (Mirai)", "value": "3930fe9d2591dbbde0622387ea2067e63fa5961394552cc516da5ac86e99af304a8d26c0be0318bdbd8cd89bd7bf7b6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495265, "uuid": "4801ceb5-9a30-451b-96ba-c9d43b236dca", "value": "T12183E942BD429F13C5C221F6FBAF019C37266B79D6EB32429931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495265, "uuid": "976c5047-9548-4723-90bf-e79c3aa014e3", "value": "1536:XKDLhQ3BlLywjmConIxqPONj6uKBJw3o2zKPTfqtGgg8q+j0An+Hf9Pa:XKDqXjmConIxq2Z6uKGzoTfqWA+1Pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495265, "uuid": "f8b1c500-d9fd-4ef6-adbc-d2f194f9121c", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495265, "uuid": "5923a3d2-86af-4e86-b3c1-359ca44f571e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495265, "uuid": "474963b4-f9e2-406c-a88b-71e012453685", "value": "night.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ad018d-43bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777460755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777460755, "uuid": "50873ef0-8531-4d51-973d-339795f9ed35", "comment": "Malware payload", "value": "eaacf337572e2f1c614a22931bbc7317", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777460755, "uuid": "bfc3b1af-9af2-4f54-9b28-c9d5ce424284", "comment": "Malware payload", "value": "a2853e3bcb3c877dfecaa496504c8374bb759dcbe801a4a35deb7a7d30c52515", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777460755, "uuid": "b045539c-727d-4306-8e40-a5605951e318", "comment": "Malware payload", "value": "275b7879a917fd9eea4d9f1b530ed5e393862194", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777460755, "uuid": "f8d68613-c48b-4bdd-8951-0b5a79327d9a", "comment": "Malware payload", "value": "b31a3eba701e9c32a5538299b81c277b9e7dbb525aa02ea67c08c8b2cf77accbbfc70de35c73628b3bcb2225cc6833c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777460755, "uuid": "4434561c-af26-4fea-8fd6-471f9c9a2fff", "value": "T115B18D25304D4C38C9335FBA67E71C24150748A02B69289A0066AC4FF73D1E5EAC3DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777460755, "uuid": "d2f73455-9f17-4221-8c10-55dd04956a00", "value": "96:kGQWBfUMAMMRh0HuU8JS00qiVaf0FRHhrDxewqgJrPsdNg7/+K+jk3g53JPe96ZG:kic/ldP0qiFLHxU3gJjz+HI3+JPEy50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777460755, "uuid": "c9bdf97f-be52-48ba-af16-fdf30c965fd1", "value": 5186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777460755, "uuid": "09cbd033-cdec-4c9d-b58a-f461c6cbc48a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777460755, "uuid": "15829af8-5b91-4370-8745-163bb6961d00", "value": "photo-333227709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16aee3b-43ee-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777482815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482815, "uuid": "24588462-e3c5-4039-a70d-1a2e1efb4055", "comment": "Malware payload (CountLoader)", "value": "5ac1f7bb6b5280f344bd10d1be424a94", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482815, "uuid": "5cbe643e-91ea-4cf6-a482-69bce1c104fa", "comment": "Malware payload (CountLoader)", "value": "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482815, "uuid": "e801f01d-8956-4cb1-adbe-171cbc8b1833", "comment": "Malware payload (CountLoader)", "value": "999efe2b1a3f7d15e38395387cc13d2ebd5718a7", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482815, "uuid": "9bdec2f2-bc78-4e9d-a4bd-a3d13d19f3ed", "comment": "Malware payload (CountLoader)", "value": "9560b0647244df61b72d65d4ed2204530325bb982dbff2111c6c0d38a08eb9b7ec013d00b12f9bb0ad649c1872e8bb05", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482815, "uuid": "90d5e067-0f1c-4e5c-8e89-0770d443ca60", "value": "T10AB56C80A9D340B2D646223290B673AB67305C0D0F3DDB53DAA5BDF9BA7F7821837645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482815, "uuid": "c0fe6e5b-29cf-4666-ab39-7d89010431dc", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482815, "uuid": "4866b810-3652-4c6a-a882-14e113b74b41", "value": "24576:V5uJ/YW5d6NwLb3ezR/a4qkYDYhDEneNUUKlIA5+OQRvXGiDvIhAOPGvKlyMCfdO:V2zoh9JSqXfKyKHJvnoE7okxlEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482815, "uuid": "b0ee4255-cb7c-4afa-adc6-43f5acdf3541", "value": 2335232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482815, "uuid": "2b0e0dd1-5bec-40cc-bc12-c2947a807a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482815, "uuid": "efb8ec71-dd4e-4d3e-80c0-c042ebb1e8ee", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cded5c-4402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777491338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491338, "uuid": "8c62ce80-77a6-4e41-b1e1-50abc8be2557", "comment": "Malware payload", "value": "95a499ee388eeb69fe185f7bc9c0942a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491338, "uuid": "19745276-13f3-4b61-892c-561520c6822e", "comment": "Malware payload", "value": "a47ea89b9fae985a509ced805e28688a555ce57e4c9d1f8466de0f2f84fd9fb1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491338, "uuid": "cc1b4597-61c5-4490-8e39-a2a90d4ce96e", "comment": "Malware payload", "value": "990a7b8ce4c7fa6a321d80225f4ac7d30971773f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491338, "uuid": "06b410e0-ed58-456a-859a-86649a4c6492", "comment": "Malware payload", "value": "192cc7b8d96e065b08736b4a110c59b5fac5230969fc0dff045d8adb2edac48459102fd2960cf636c4603342e96ffab9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491338, "uuid": "4a5fa7b1-84fa-480f-80dd-3578560222bc", "value": "T17765F2118EC8AFB9CFE86A2952FD171AB7D04B494416748AEF277D0E9FAE500470F0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491338, "uuid": "d6209482-c789-49c2-86aa-5457280dc40c", "value": "24576:lFyg7Uy79voXsmAwnUTNKhYqvc2z0rYOiZZlN3Y0iTz2/0j65N3ssSS5:mhpvc+ZZw0wx2r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491338, "uuid": "a45e1816-964a-4c4e-bf4d-e6791f260553", "value": 1422492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491338, "uuid": "56e2f986-782c-43fe-94b8-ce7c5b33fc03", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491338, "uuid": "30c1496a-abe7-4271-8db1-fe8ac8b723a6", "value": "PO_P239835_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f054cd-4396-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777445030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445030, "uuid": "de07f9dc-2243-4f88-a06a-c379312f69fe", "comment": "Malware payload", "value": "9dc4630974612d66b5347d2bec57b328", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445030, "uuid": "a7072e67-fbfb-4079-ba36-a9a356d52923", "comment": "Malware payload", "value": "a571f0f0ce5b4afc7e58bf8f4ce6f09304af40472f371c21bbf25a1a886790bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445030, "uuid": "0002c72f-da11-481e-8369-06984bbffb77", "comment": "Malware payload", "value": "1714298aa870bc4e21d5a93299bddafa1be352b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445030, "uuid": "62ff8eda-ebf4-4cc3-bc7f-bd261257ba5b", "comment": "Malware payload", "value": "aa5fc5e6caf00fdd041cc0a74266e7cd28d23dd8419d6b13afc23827adaac12004b1c48922d0ad8f855a7762369596fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445030, "uuid": "47c1dec5-4a76-4033-a45c-5388d3d1b23b", "value": "T166920992FD03466FCAC043B7676ADB583393D27DD2DA3217DA44DB1425AAB4D0F22B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445030, "uuid": "cd2cea74-b93f-433c-8723-9edf304cd0bd", "value": "384:5Fr0H11mCzUl95RZtMFgd8la0uZxSOovU/tkbG52Y4:brO7mCYl95ntMvlcZos/tKGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445030, "uuid": "ffa1cb7d-ea46-4062-a22e-164734824e5f", "value": 19972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445030, "uuid": "fd519738-cab4-4c88-8bde-03f979034d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445030, "uuid": "5f11886e-e2a9-464e-90e1-a5f52090ce70", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844fc060-43cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777467680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467680, "uuid": "25f57859-6a94-4395-a5d3-48c460816d82", "comment": "Malware payload", "value": "18b3a584d8353187f26c4c17cb32e6a0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467680, "uuid": "44c9cb43-a4e2-4db4-9b3b-71b20aa07e48", "comment": "Malware payload", "value": "a585780b444426eeda0064fae7f5d0cae0c2c68e1e0e4162d327022279929ada", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467680, "uuid": "3d3b8df0-f582-493d-8ac8-2e2f82983c60", "comment": "Malware payload", "value": "b649e3427e4da52d0d3becef78cec1cfcc26e65a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467680, "uuid": "1aae34dc-5779-49a5-a868-ccdea9b76770", "comment": "Malware payload", "value": "4780f62696a3825a5f324149b5adbb61e13c76e7cd2a5f858cb1ec9006bab1e47003a14321c5cf634df597e9698038ba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467680, "uuid": "cec21044-2d60-4728-b22d-46fdbfc43e3a", "value": "T1AAB5FED783D4DCBC9B2170F04876FC56BE0840BA619445EE14BA29A18DC01DAE7EAF7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467680, "uuid": "988570cb-dc83-4ac3-a2a2-ad2520e61cc1", "value": "96:5TpsuQLb0F/kfKc/++QtcAwi8cccRDLgRwLBjEG8gjeETm6fwpo52HBcccs/mngn:5pAITs0/dD5cyGZjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777467680, "uuid": "98a61816-e0fa-4acd-a04d-755f8dd75c12", "value": 2311371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777467680, "uuid": "89994b68-5415-4fdd-b968-3f976b4ee7e2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467680, "uuid": "ea11a1a4-bfb5-4075-98f9-1fe0e5fd778e", "value": "rrckk4902771.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8073fe6a-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777479699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479699, "uuid": "fb673838-32b3-4614-8aa6-df2d6b3e2d86", "comment": "Malware payload (Vidar)", "value": "744c0cb7b4a3a981f052f628a047dbc1", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479699, "uuid": "599e4d65-c538-4dae-bffb-3f11fc43613b", "comment": "Malware payload (Vidar)", "value": "a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479699, "uuid": "612c7197-95ac-472d-8bcd-00a6a9cc4954", "comment": "Malware payload (Vidar)", "value": "88633d3981c671b726428c552ca0d456aab08987", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479699, "uuid": "9773f790-10c3-4da7-bf2b-43cd97e4d62a", "comment": "Malware payload (Vidar)", "value": "d8abbb6d90454c33078f7c369df73bb45b8a2fe3cee78e831375160f68cd673f586658b232512e92deb6719e449f32c1", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479699, "uuid": "ee5d993d-5c0d-4430-8e37-23f1100ea399", "value": "T11934126B41E5DA23D0E8E0F6037C2994A2DE35131B55ABCBF82956C145F34E9C81D8AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479699, "uuid": "03864c65-58d6-49e1-bb01-14619ed13871", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479699, "uuid": "6816cd0f-364c-4a70-913c-baf8c9068cfb", "value": "3072:PPEr14JQfpUFueVxJOhOE4STfxab+dBoOjnwKOq0fSB3sA/b3qDpcLDXGo2g+Uc:XER12VxJOV1TM+BowOq06b/ba8Ko/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479699, "uuid": "e9159ca1-09b1-4889-bc9d-a8d8b709b6f1", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479699, "uuid": "37adc6a6-1398-49df-b943-95524aba17b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479699, "uuid": "af399aa8-90b5-46a2-b046-18735f9e2969", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b99161c-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777484899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484899, "uuid": "6cf60b60-8c5c-4f9b-922c-b85cb15bb586", "comment": "Malware payload (CountLoader)", "value": "3448aec35cb29dda5a3ea9e93e9e069c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484899, "uuid": "b7981991-72f1-4819-a5e5-df434b05a1a7", "comment": "Malware payload (CountLoader)", "value": "a5d11491bb3975c7ff56a13f82bb7ce7d2406f400e7ce0f338bb3730351ae3c6", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484899, "uuid": "201ee483-38af-4099-94bf-0c66ee91eccb", "comment": "Malware payload (CountLoader)", "value": "41a4823ed266ed26079701e6ac2eb0f2dcd79ddf", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484899, "uuid": "8f457fcf-e3e0-48af-9eab-379cde8f2289", "comment": "Malware payload (CountLoader)", "value": "3ec8e9d93471bbf168b6865c45d063c7b041adc7651625df9f55dec1dbdc15ce6d9ab0d221d0ae8f3352195dbd6d75ed", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484899, "uuid": "397d2b90-47a6-4fd7-9afa-6d3ae01f9daa", "value": "T1B9A55C60FDD34472D142363255B6726B7B35894D0F3EE6A3DAA1ADB8FA7F1820827704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484899, "uuid": "671974ee-3601-4c3b-9755-24d3050dd1b6", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484899, "uuid": "e407304c-95fa-4e0a-89ba-770765851c8b", "value": "24576:YF8tOT9VnXDHde52M0Nw78wSC31fWoZTxhY4vQvJs7oDiI3LkupLIIUezMh:2Ntu+GfWYLfQxg/sIIUek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484899, "uuid": "c558e9be-fb53-4d93-805a-318fa38f7938", "value": 2231480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484899, "uuid": "615ab8d3-6a50-4f6f-86ea-12269897b37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484899, "uuid": "c5de360b-2508-49a1-948b-1d2aa1268c9f", "value": "UVALnVYm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d649b051-43a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777449349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449349, "uuid": "803ffcec-b9f2-4732-b410-67923f75a1f3", "comment": "Malware payload (Mirai)", "value": "25656a2aa7c31180e1d41ac510ba5caf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449349, "uuid": "12d32edf-92fe-4544-8d5f-55b9871258f1", "comment": "Malware payload (Mirai)", "value": "a5fc9ce0ccbde8f334681cdd2de91405a4e2f3d5a28f9353a6f41e9cbcb1d977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449349, "uuid": "c3fcc3e4-615e-4701-9bde-adc7b7f9a516", "comment": "Malware payload (Mirai)", "value": "2cc0fc26986c6afc16a87dcce677c37b5023771f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449349, "uuid": "b6be4b97-a7ba-4ae9-9bb7-110f52cc40ef", "comment": "Malware payload (Mirai)", "value": "e1523b5c0c1c054bfe2b510f96c9d7e0b08dd480ac28cdd85b4970ad3a9d2fbd4e024ecaf1a3bea29f44ea9fe028d112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449349, "uuid": "7b6d9f8b-0a1d-46c7-b8df-ae0a13b86646", "value": "T1CF836C49F743E0F0D91606B2116BF77E86309E117020CE6ADF95BEA2DD72A12612B72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449349, "uuid": "2780e684-5e0f-46c9-a563-34be25fba7fe", "value": "1536:hRqOmXtLv9lqpOPUP31sMTJkNtgxyc4ynweqL18jt2o7r:hRb8v9lqRqLNUnweGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777449349, "uuid": "2993ea74-22aa-4ce1-ab5e-6e04b78dbabe", "value": 82640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777449349, "uuid": "2e86f31c-287d-4317-b5d8-3138477fee9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449349, "uuid": "78b41e2d-7f8b-46f3-8106-aa200439fa86", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a201a46-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479984, "uuid": "fbe73fe5-6436-4d56-bc0f-f808021ab52f", "comment": "Malware payload", "value": "faba6743d315722a7041f06b5b06eacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479984, "uuid": "cdf2139f-d25f-4d99-8bce-f1c4d35b40c0", "comment": "Malware payload", "value": "a74cbcfdadc1bcef61373536e4139d8221e6d3da57a3dd8960113263c57c97ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479984, "uuid": "26ecd813-4636-4fb7-beb6-ecfe91fd4e67", "comment": "Malware payload", "value": "524719172dc38ac3f396a5b4958d00691eb87f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479984, "uuid": "c8ed4f04-2eb6-4a0b-8967-2847a0d4f810", "comment": "Malware payload", "value": "035ced132a827e67e3921010761aa4e3133278a39b564356f7135ef5e7570f772355f7c4e57c88ded64c42ee6047d48c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479984, "uuid": "2ae00a6d-d75e-47a6-a813-9978bae82e54", "value": "T15A183392E9FCAD23D5EBAF3197F00093418F55D7148818AA949627FAFACC1DE165C332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479984, "uuid": "6a7e5b04-1a74-4ba8-ab6d-416416149626", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479984, "uuid": "e6a61b1a-3276-4433-9b97-025bd523b223", "value": "1572864:0y2YVEZHyCo6FALauLYbTWhEngG0PXJIfK/T/bkR+:0y2YVMSCHWX6TWDIfK/rYR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479984, "uuid": "68fff8eb-ce4d-4da4-bdaf-1747f02ecf83", "value": 89167448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479984, "uuid": "50ccfec4-b5a3-40b5-87bb-a119e4240f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479984, "uuid": "491cbbfb-1d92-4941-b071-30f4ef5b5bc1", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea7212a-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455376, "uuid": "76da9643-aca0-4611-86e9-93dcceaa0298", "comment": "Malware payload", "value": "2e38eb7796f414f1135cdd440fd6cdcf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455376, "uuid": "af55b5e4-2794-42d8-9486-973a7fc9e687", "comment": "Malware payload", "value": "a761d30c79ec6f9df9723567c0e5174828e28d1319a576732ee3e162f4d0d81b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455376, "uuid": "b38e9efb-323b-45a5-8bd9-ce47298fb036", "comment": "Malware payload", "value": "e03a4f7edeabef5c6a667aebd3593bfe7403ecfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455376, "uuid": "f7b676a7-91fe-4619-bb87-2814e6e84eae", "comment": "Malware payload", "value": "48e5ca8bfb304603d18bd5a1c07fce0a015c3d4edcc398824410f819af55402c6afb7039065c9a6d7550e674166a18a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455376, "uuid": "2bee0741-2ba8-40bb-87ab-0d94546c1187", "value": "T16C3723437B264EB58A74330A187F5E4D7EDADF240C2058E961C239AA53AD53CA3D93DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455376, "uuid": "2a3c1e96-f98a-45a5-9e1d-ff9d6dc7acf1", "value": "49152:FuJulu/uNuuugueuMu1uIumuVrUuBueuouAukrbu3uqufu6u6uFu5uXuwuQuOukO:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455376, "uuid": "29c79816-c711-459e-830b-cf03c402c759", "value": 23944467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455376, "uuid": "b90555af-5eab-48b5-b5f8-c203d620c7ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455376, "uuid": "890465b9-b745-4537-8304-89d04dab67fc", "value": "invoice-1645080830.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3420b5b6-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777480001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480001, "uuid": "e058fd69-239d-4bd2-8232-6c91e55d7da3", "comment": "Malware payload", "value": "c111906f5f32ed37a44a5aa443c3ef9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480001, "uuid": "6d4847c5-d273-4235-95f1-2332af4a57c0", "comment": "Malware payload", "value": "a7871d21014e279fe6232c744227b2112a52ec7e829c45001122e85715f6d436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480001, "uuid": "d1c28fc4-d24b-49b1-8f33-4d6a35d90d14", "comment": "Malware payload", "value": "14915e0d885eb131f7a67772ed6c4a9d1b856734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480001, "uuid": "4104dae5-9921-4278-a295-3e4c9ca2fbf4", "comment": "Malware payload", "value": "aca23f80cd57a4d83867c077cab05f2a572f6c87685a139c8b4cf12f8d06b5c17d1dc61073264d8d3d3f888aa65fe72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480001, "uuid": "b8193392-f77a-45dd-b9f6-c4f643b22c75", "value": "T1E7E733639F88EC84DAC71D7503E9EF12669A6D5248321617DD8CF6C376BF8C90A0B60D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480001, "uuid": "1342f66c-0fa9-4eae-bd6e-c9c06de317be", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480001, "uuid": "deeb5c0c-1c7e-4b07-bea0-4456d2a81185", "value": "1572864:J25kJoO+13SQcTe/FEd67As/ph6QSoXUwNSyaGHsfYHldqO:J+O+1CQcTeOd60shNVXUwNbae6YHeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480001, "uuid": "3f872732-fb86-4fb1-8738-95d057b3353a", "value": 69955744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480001, "uuid": "f018b96d-2b8b-4679-b952-84ef32d70f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480001, "uuid": "57ab3573-dbcb-438c-a5cc-c4f039c5afcf", "value": "Installer_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72bda84-43ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483227, "uuid": "a8624046-69da-4ae3-8856-67086104019c", "comment": "Malware payload", "value": "c70451bbddb8d4a18a7f52ec40ea46c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483227, "uuid": "35bb0732-9aa0-4f7e-84e9-e5e9fa64675a", "comment": "Malware payload", "value": "a7949ce82225d83acf961ec8d4bc085758660600e4c4f965d265cc32cc6b31b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483227, "uuid": "f83d7dc1-0b3c-46ee-bdfa-68e6ee9a7d80", "comment": "Malware payload", "value": "a06fe372514b3c8c29d9e8263a859e6e8be347c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483227, "uuid": "9a7eedaf-9050-4d46-8165-345c0115d395", "comment": "Malware payload", "value": "0afde812324f9bf4dfdd6237063e7be8c1cfeed98b123b9d91ccfe84963d5f70f81a162f9425eaf58be4eeff9897e98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483227, "uuid": "ea477248-0650-4abb-8710-afa73b34fae4", "value": "T1E60633DB13F37FBDE306CEB665A3584CE6EA32081287527EA52932E15A1795FE75000C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483227, "uuid": "7bc6506b-7c7f-4b3b-8106-2744d24d81e2", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483227, "uuid": "38903923-36be-4308-845f-4cea90590f95", "value": "98304:74JYyrPm755j3WF6B2b0hZItalGd8fMAu:7hFWJaItDOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483227, "uuid": "24636651-dcfa-4cbc-be44-475c4ca9a7a1", "value": 3659776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483227, "uuid": "1dc8a1f3-d8da-4543-888b-dec1f3a45db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483227, "uuid": "9848755e-5607-4868-a940-b827baced307", "value": "GitHubDesktopHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31c0ac2-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777489340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489340, "uuid": "c4135740-7bf8-46e5-9ea5-9b93bbf6e57f", "comment": "Malware payload (a310Logger)", "value": "3d9e6a67553ece669ac6d098222df841", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489340, "uuid": "45e27e8f-0439-4791-9b79-dec9643d013e", "comment": "Malware payload (a310Logger)", "value": "a8594a2ce18214ab8880f75571071e1dd490c0f2fb0a9b7a83a3a5b17b164f5d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489340, "uuid": "c95cae5f-9c3f-4785-9661-a75163dfc094", "comment": "Malware payload (a310Logger)", "value": "89e96d5cf044fb7c103758da82f5d3e906090953", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489340, "uuid": "ab3995a8-6cc6-46d7-98b6-226d31eec92c", "comment": "Malware payload (a310Logger)", "value": "aca91c8f754ed6b35dfed57a38bd3b66d065f2a3e945596662df4868930e0fbdb38baccdd4f220a07cdbbe71159d61c7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489340, "uuid": "4f1bb2ce-2269-4f3d-9e47-842aed26f4f1", "value": "T10745D01A6DC35F70C7284B79C2AA02B453F0C61B2316E7AB3ED902E4DD5174EB91B1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489340, "uuid": "5d984b26-a2a0-4261-add3-566b77c10e02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489340, "uuid": "08d442a0-6007-4a19-b332-d7935f690261", "value": "24576:IivJ6mvjJZoQGE+JiCEdL4DHJ0UOuauvMxH84Fk18c:IivJ7tZZYgWJ9Halxca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777489340, "uuid": "4d40797f-7e3f-475f-97c4-93bcc6f2fede", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777489340, "uuid": "ca809b5f-94c8-4fac-ac67-8be99c9fae2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489340, "uuid": "ad907f9f-d0cd-434e-8f5f-0c6876071140", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3d28ab-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493218, "uuid": "e9db0f09-630c-4a1a-aa2b-402c286aabbb", "comment": "Malware payload (Mirai)", "value": "1ffebe0d61c7ed498d9044a2df3af3a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493218, "uuid": "5393854b-8cb7-48c8-82dc-62b98e1f6628", "comment": "Malware payload (Mirai)", "value": "a8c3d6314e658a2c0f0604474d70091889c881610a13114a060cec0c62610154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493218, "uuid": "6eb63bfd-9e9b-4798-b33a-53da66be07fd", "comment": "Malware payload (Mirai)", "value": "adee785ad58bdeff3f614fa57ace19653a4601b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493218, "uuid": "5e3bf353-8e8d-4f58-8162-1e51e02a5dc5", "comment": "Malware payload (Mirai)", "value": "c8413f13ec58c51f4b9f9fe09938f3e9e36ae793ad8b28c94f26a01f6254458189662b9e02cc295557b3a2cea40a4817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493218, "uuid": "50b5e13e-bdca-4abb-b414-5002c74d0107", "value": "T1D7631B95B8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493218, "uuid": "2569fabd-2d17-4873-b2bf-ba21b57d52eb", "value": "1536:hgnAkIP7B9stYVenVQmSct8URqOSQHMgimu2aa7LLJa10at:ZP19st6en6mScEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493218, "uuid": "0abd9047-5d40-4401-aadd-451ee7e257ad", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493218, "uuid": "aec15949-516e-4dc4-88a6-865a8796ef44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493218, "uuid": "44655815-b272-4070-b958-03b1b021ffc6", "value": "RpcSecurity.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7469ab4b-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455627, "uuid": "b4501066-f4c2-4e27-9276-156609679c9e", "comment": "Malware payload", "value": "f14a7e858261110718260dab73787d15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455627, "uuid": "04462ab9-1d23-4946-9fe8-d5c5f9dd3578", "comment": "Malware payload", "value": "a937537e8e88b857d7b6208d173d7cc976454acf2ca47e2a86e7c819dc118abb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455627, "uuid": "e6fce000-fe00-4d8e-83c6-ddc6efc022a2", "comment": "Malware payload", "value": "37e081c4cd4a4f8cc16038c82ace0d9f503574e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455627, "uuid": "45ba423a-2fc0-4525-9486-785fe15b81ba", "comment": "Malware payload", "value": "38f2893bacdd78e28a6b24097e6168ff349c5ae3c51092fa2fe20cfe0771c4c690c819ec0290c37bd583a85ff5224d1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455627, "uuid": "d5285471-ce7e-4393-84a1-7fbf06fde9a4", "value": "T1D93723463DA6846E0B78A92824FC0E9E4AD06DD64040D8F477F6F9BC478FFA435D7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455627, "uuid": "bf1f2556-9cdb-4c74-8cbc-2be82d2f2855", "value": "49152:0tE/BxtE/B3tE/BLtE/BftE/B+tE/BwtE/BbtE/BPtE/BttE/BVtE/B1tE/BLhNn:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455627, "uuid": "d1b5642a-cca0-4988-9875-7f37b857d9bb", "value": 22383682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455627, "uuid": "3bc9a63c-ff00-4eab-a62c-86a0f530bfbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455627, "uuid": "a635da10-4808-47de-bac4-0b07dfcc04db", "value": "invoice-1645080830.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa149fb-4391-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442833, "uuid": "043d3550-2ce9-4f4a-86dc-899cbc6ff35f", "comment": "Malware payload (Mirai)", "value": "044ea5906ac3bafd1adc679b869b3ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442833, "uuid": "d4151660-c85c-463f-aeca-be28d404aeaf", "comment": "Malware payload (Mirai)", "value": "aa1dc740dfef37fb982a67a349b5c38374050b1f081f022de5e354e3543089fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442833, "uuid": "ff1d1936-5b9d-4926-ac6b-e6f195a01baa", "comment": "Malware payload (Mirai)", "value": "5e1bddfff68c5e828724204a2b873d4a631dba70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442833, "uuid": "c03d24a2-6ca3-4bf4-be05-60721e1ceecc", "comment": "Malware payload (Mirai)", "value": "0827dc25d1da2462366c31679168b90ee02d32054aa443cb91876455301e909a74206e6aa43f713d18dea845223ea96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442833, "uuid": "e20f92b0-2435-4b28-b5ba-43d51d324972", "value": "T193A2E01B10CD5CAEE66B3DB722FF5DD92054CD5497C71A8DEA3A81D6C1950A1002CCBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442833, "uuid": "21d3fe83-4ace-4f58-b8ec-e8dadd85d8d9", "value": "384:MkZNvQfTdCksYUpxfj9CD3OTOgSW07iiIXcXXEeDtNDD7h09sA+v1Rma:Z10TdtiUD3OqgSWfVsnEeDtNzhlTma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442833, "uuid": "2f4c5f01-d9f5-4b9d-ad88-4f82c64297e2", "value": 21620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442833, "uuid": "a2199a20-7673-400b-ab87-11732fa2f4b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442833, "uuid": "edd19c1f-da11-4768-8494-19f2fafba81e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092e4b0e-43ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777480788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480788, "uuid": "c6a890ff-dce4-43af-9a6e-355bcb91ced1", "comment": "Malware payload", "value": "c46f9e11d1822c0a0a2c9e45c2d0602e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480788, "uuid": "6a42ac47-6d2c-46be-9a73-e2c40c05b2fa", "comment": "Malware payload", "value": "aaa3db9a1cf3c6258a61ece58be1a8dd0c6e3c24d9b70e36d6be9d461ecc52fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480788, "uuid": "5f23dbac-678c-4d29-8753-0e58a24c9d75", "comment": "Malware payload", "value": "fa374b2f1d1c7fdde4844a5c55ad9b2144894c7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777480788, "uuid": "66ffefcf-12dc-4126-a9cf-d179b71bbf75", "comment": "Malware payload", "value": "0610de14d03c23102d00b7d4bea8d5b7a899fd0464d7aca070c16892c5c5431263d5e1fd426b3b213122c028b26362a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480788, "uuid": "104f62f7-4b8d-4cc4-aa20-abff8060bac0", "value": "T105F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480788, "uuid": "0e01941f-a023-4e52-8731-5b329e9cb02d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777480788, "uuid": "a4a2a773-edf2-4cde-8d5c-fe610936c435", "value": 15302656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777480788, "uuid": "926218a9-dceb-4857-8f92-376338f1fee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777480788, "uuid": "6f7bf116-1af5-4216-a011-ac1a499b4b3b", "value": "aaa3db9a1cf3c6258a61ece58be1a8dd0c6e3c24d9b70e36d6be9d461ecc52fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d958c04-43bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777461145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461145, "uuid": "e7325d78-213e-481b-bd2c-ee9e4dcacdbd", "comment": "Malware payload (Mirai)", "value": "ff54842c48e6700faf5eae5218a58bf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461145, "uuid": "7558f4ae-87af-4148-bfff-bbd682f25030", "comment": "Malware payload (Mirai)", "value": "ab6b1055c5cdb9dd1a0b845d4264a0cba8bcf23220d552e4551ffdc8fc9fb358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461145, "uuid": "dce5fe1c-0bea-4845-8824-138c8f185c24", "comment": "Malware payload (Mirai)", "value": "c3af746553f26d3a47ee2b29bf23cf65c5b290c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461145, "uuid": "62704928-de12-444b-9512-7a00639a757d", "comment": "Malware payload (Mirai)", "value": "a246e84240757901ad9b2281093ddbaa3cecdc2407a099703929ef7701d5b6aedaccaac1ecc93f257d08fe664b9e19d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461145, "uuid": "15a461d0-4100-4274-9ac4-c4b0f1fbff43", "value": "T17B636D82FB83C4F6D86304B0543BB36FCA31D4159031C766EF69AE26DA27956472B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461145, "uuid": "7bbbc9ad-3c63-49d4-99d7-72286bff9086", "value": "1536:lEKko9pMx6146IVhWH4EkCVptlscks3AxodeCeewUHoHALtgc:m6py614kYEP7scksQdCeiac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461145, "uuid": "5762f728-bd5c-4b9b-aeae-e2266db28e6f", "value": 66728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461145, "uuid": "9326c924-1ed4-4daf-8440-1948cde19ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461145, "uuid": "c89e833a-1df2-4cdc-9c9a-62f0ed20bcce", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd9ad2d-4396-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777444989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444989, "uuid": "9e2062e5-bd82-4fce-8ca3-4011aa8536b5", "comment": "Malware payload (Mirai)", "value": "c04d3e65a5d6cac31ccd3900bbd8cafd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444989, "uuid": "3fb0a0fd-dca5-4d39-ba4d-de26121f1741", "comment": "Malware payload (Mirai)", "value": "abe9fc9ee9bf8c9b1a00e50b16e974982365dae43ed188339e36dbe6aea853b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444989, "uuid": "58d7feb4-e236-4317-b40f-5ff40d018da6", "comment": "Malware payload (Mirai)", "value": "d013173a76e2bb536316f0e34de9e35255e9e89d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777444989, "uuid": "7de84279-e403-44aa-a9e3-9eda4147a310", "comment": "Malware payload (Mirai)", "value": "6ba8c1fdf8e72b77bbe0ae427a683c5a33d0ecf54990f3d5c06eac1f35515255e5994517308744db6603432898241f09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444989, "uuid": "1104c6c5-3efa-47dc-827d-3fd37b7fb7d5", "value": "T1229319D7FC00EABAF809D73B4493490AB231E3A10A921B767347352BED792951477F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444989, "uuid": "cd9aeb78-d652-4209-9c5b-0c5240966541", "value": "1536:vl70bNcfIbZJYj8FUv1s6myud1K13HC5qOkMKGwP/MdC2ua/75mrK8iSxge:vl72IKZJYF1Fmyu3K138qOzKLmua/75K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777444989, "uuid": "ca83346d-f433-4871-9820-8a1e1ee0f528", "value": 93104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777444989, "uuid": "3214be05-8c03-4114-9288-471cc2b2e2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777444989, "uuid": "6a3a15f6-fae4-45b1-af42-9c95d8386c9b", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637bba6c-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777448727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448727, "uuid": "b6fbac25-c962-425c-acf6-ffb9c4064241", "comment": "Malware payload (njrat)", "value": "244c64cdae411812cebebcc8fe0fe5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448727, "uuid": "627df382-c01e-4bcb-ac23-eca36c086733", "comment": "Malware payload (njrat)", "value": "ad24229ae1da09073c9d9f3c3d12b169404540445e41802de4783e219ade77f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448727, "uuid": "1614e01e-2339-4d76-85dd-c785ea69954c", "comment": "Malware payload (njrat)", "value": "ce0c0a9ddb913b40d42dff9f1b3177218be85734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448727, "uuid": "c5e03d14-8638-4cd7-bc9c-cf825faccded", "comment": "Malware payload (njrat)", "value": "ca16491f286d69c930c78af5d0a5633e9e2a598e8f2b2ddd6cec33a96695bd1d7c36321f10d181074f354bebd0e3928f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448727, "uuid": "6c69216a-cf80-4d6a-bccb-85a0103ce3c8", "value": "T164033C4D7FE18168C5FD057705B2D01207BAE04B6E23D91E8EF164AA37636C58F54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448727, "uuid": "bd68983f-dd6e-4a88-b466-70cd5d30bd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448727, "uuid": "1c8cac2f-ce32-4f74-b1e3-12ac08280b65", "value": "384:74uIiuXjtD+P3V+y0btIZMtfTusGE8nrAF+rMRTyN/0L+EcoinblneHQM3epzXRx:UvmV10btIZMtqFEirM+rMRa8NuPSGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448727, "uuid": "7fcf4d0e-2da9-426f-8a31-9db253a14402", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448727, "uuid": "486af6f5-7ce9-4355-9f4e-ffdb543e89de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448727, "uuid": "4740b4cc-eaa1-49d8-b1ec-aa7deeb263a0", "value": "phishing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c16c9b-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777470586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470586, "uuid": "11d20055-7db2-4faa-8fb7-b8f302f3d9f7", "comment": "Malware payload (Gafgyt)", "value": "f5d5feeac87da6b4e95bedbddd2b5a9c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470586, "uuid": "87df2b8a-bd48-4aca-a426-45fe592b11ce", "comment": "Malware payload (Gafgyt)", "value": "adff8214814a8a63bf69753842993bef367d033196c3b9ac5a1f6b4a6cc91809", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470586, "uuid": "1da375b2-e919-460b-8bf1-8125d527e125", "comment": "Malware payload (Gafgyt)", "value": "fdd0ab4f53b1aa86ec88965179eb3eef3c67aa0a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470586, "uuid": "1115ff6f-0444-4f89-be2b-3855797dbe87", "comment": "Malware payload (Gafgyt)", "value": "9028b6a3b084d436d0de71de6a215b65e3cad01acc208b35f5fea7e036506783fd70bc68c0b5066a76e259983f4a1bfc", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470586, "uuid": "61c285bd-579a-4029-8e3b-f3aa56bec846", "value": "T11FC3D506BF114FF7D89BCD7346FA0B05258CB82B16B92B757534EC58B24A1CA1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470586, "uuid": "338daa3d-c48d-433e-8105-fdb1b94dd7f2", "value": "1536:j4w4zW/h4SZsqEznAfgiDSAPzfO4jaXbzjZjCfPNXm/iRK0UgSSWX:0xW/rZsq8A3fHjarzjD+XWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470586, "uuid": "01a25192-802d-40be-9e55-f520781e68ba", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470586, "uuid": "38a3ce65-3c4a-4962-b3f4-1fd7b9b4fe51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470586, "uuid": "1823fa4e-3b15-41c5-ae8a-2c7377da80e9", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc912cd7-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440313, "uuid": "f8de4c31-e210-44c0-b49c-ebb534f554a8", "comment": "Malware payload (Mirai)", "value": "5fd84b7c674be83859e95a22d46ab446", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440313, "uuid": "73502eb6-8427-430b-a88f-e6ead917ea36", "comment": "Malware payload (Mirai)", "value": "ae14eb453522970486c3f3d02b73d598098b3849d0537b4482a61f44ab7a96b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440313, "uuid": "ff38021a-14fa-4759-bcbf-f6955f8cccce", "comment": "Malware payload (Mirai)", "value": "8e6a7cd5080328adfa7ac2f0dbe2a1b58235e0b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440313, "uuid": "97925ce1-5a7d-4b92-8d4f-f4bb662200b7", "comment": "Malware payload (Mirai)", "value": "fb05ae1862d58232568d43f5fb3d67839fe9a30511edce401a704b7a5e4831091297b776a6a4f5f81add686fb78197a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440313, "uuid": "392d7b98-ece5-44ca-aa40-98aa51a2088e", "value": "T1A6C39CABB24F1450C42647F51BCB5B9C2E2324019E2B9AE77C6E373E2B365DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440313, "uuid": "de2b727c-ede0-44b7-ae6a-9219a23a1043", "value": "3072:i/oB12LNEBITJPScwKJSIqgI85glCzfQffHX5qz:i/+1FBIxS5b7gVCCzfQfhqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440313, "uuid": "c517e472-f923-4a62-a926-3365325388ff", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440313, "uuid": "3e373d45-81ec-4641-b7c8-cb8042dfc5b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440313, "uuid": "baee4541-9f62-4ef2-9304-2d9ea406f80a", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4810ba9b-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777470585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470585, "uuid": "3d7cb7e7-f3ca-4512-a9e8-6e392bf1ebde", "comment": "Malware payload (Gafgyt)", "value": "b40400e95af8efc9456602511a468e48", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470585, "uuid": "867e636e-6e5b-4d0a-b224-e64b69e4e418", "comment": "Malware payload (Gafgyt)", "value": "ae60b4caa5ed62f848323edd38728375b40e74ce095638eef00a2beb146ba396", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470585, "uuid": "9150f498-9e2d-43ca-8156-a880cd5cf476", "comment": "Malware payload (Gafgyt)", "value": "f6cc705ecc1f925328b29a6a6abcbcc5a6d6ec60", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470585, "uuid": "7bff2130-b0b3-472b-a062-a857989bf754", "comment": "Malware payload (Gafgyt)", "value": "b523de42945628dc79478b8e70bdeb4a3273b690cc6c785b7d8f0f25fdce8158ef08b9fca86c12de8de53366ecedaba6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470585, "uuid": "e9f5eebf-2d63-4b28-b8a2-6b2c0aa104e8", "value": "T1CFC3B91E6E21CFBEF65A827407F78E31965877D62AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470585, "uuid": "7fc76a60-f9e8-4499-aa0b-a7636c7769de", "value": "1536:tw4lPfv7d7Y/YLpdYo1fpNeHvztsi8ZPDoM1ISWlKnKevNeThLF:7lPfDdMKdYo3wHvzt2ZPDoMCsnShLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470585, "uuid": "c784772e-9f4d-4095-949e-4b0914cdde8f", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470585, "uuid": "a47e8523-a701-469f-8cae-8ea19d7c52e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470585, "uuid": "9a010a5c-068c-4681-81e0-657bd0399c68", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873a3d20-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479711, "uuid": "786e5ef1-34fa-49ab-a6bf-1e04eae5e4d4", "comment": "Malware payload", "value": "e7f25334557454583eaec85504eea48a", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479711, "uuid": "2074659b-a190-471c-8f25-7210acf30ad4", "comment": "Malware payload", "value": "ae9ee39aa2538a89eff91bf6d1ce6751a6740d1f6cfed9bac397c30fcce45f48", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479711, "uuid": "7e5e96fb-0805-4d01-b255-c20b2ec1a016", "comment": "Malware payload", "value": "dbf21e13189071eccff7cf577a96617367d03890", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479711, "uuid": "ee6a6319-535c-4ba1-8c08-2db444e82631", "comment": "Malware payload", "value": "19e0a0436ef0cf4264350b38612710ccb7dd46ea5bb2329319f6727b039e1fdeebb84306ca5575f53af9bb18273b8858", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479711, "uuid": "f0688570-07be-4a51-9494-f110384a310e", "value": "T137C57A4178D000EDC09D763288F276967B35BC580B3667D32EA1AA783E37BD11D76B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479711, "uuid": "8ca42411-5b48-4369-a853-8174b86a1bf3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479711, "uuid": "8c60b7de-9a83-42a9-8d5e-3f4b422acfb1", "value": "49152:exIwLtz5qTItctrL0DnAW8rtEKH8/Df4DT/FW/Cc0nQh3u:exD5zi9Ync6KHn7Fwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479711, "uuid": "a82375e8-b96e-4645-ab8d-b59a29f5b3ed", "value": 2622664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479711, "uuid": "2acb001a-4a55-4126-9954-176bae606e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479711, "uuid": "622df145-af18-4bb0-a1ec-6c49b515a964", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d6cb93-438f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777441941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441941, "uuid": "28abd873-2f68-4580-9c45-1a510693d833", "comment": "Malware payload", "value": "b3698b26eaece4a204d2b34d26244e9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441941, "uuid": "7a61bb2e-daef-414a-b3c3-028e83c195b2", "comment": "Malware payload", "value": "af8162522477e4d382acd977e8c59e804a79beff5ee344a7abaff75550883de8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441941, "uuid": "2c33e846-8124-45c5-af5b-79ce1840831c", "comment": "Malware payload", "value": "922da22929109cae51449acc0da9352735e1e99a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441941, "uuid": "96a1d362-bbcf-4e42-af25-0da78a2f256a", "comment": "Malware payload", "value": "da9a93be4c646b58a04c5e321b9d84b9234c5d96121a22ed63b995a5e98cefff323ea7f76fc2532f794e61845ea26483", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441941, "uuid": "b377fb1e-2035-49ae-bc63-6e34d182954b", "value": "T1349273B1FC62E8343A8AC06C96DE5042B85F742B35193809745EB434AFEC554B2BD6BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441941, "uuid": "ceb55d8f-c87a-4c58-b1c1-f018367d2fb6", "value": "384:HLiMRioAw7GT1qR++Gi+GVgB7EcLYzmJw5FdBCC4EyLP8LqRHaMH8kOlmX:ri8io8Lsn174EyquckOlmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441941, "uuid": "6ba48b05-0377-482b-b087-e776793a4aca", "value": 19617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441941, "uuid": "9fd7e138-186e-46b8-b87e-316ed51e0025", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441941, "uuid": "8f6a0372-fc8c-48d9-a697-0587c6f094b1", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8962cc5d-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490022, "uuid": "79acc6e7-03b6-4c9b-a3b3-ccbb2b22fdd2", "comment": "Malware payload", "value": "226667e1a2750ba4ef8ba7912c88fdb2", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490022, "uuid": "8adf7e18-c6d4-4497-b1e3-15fa6914a460", "comment": "Malware payload", "value": "b24f603da74a5fa7b9db7f8e68b2350ae1c35cb396bb5dd3a69b0da316a36def", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490022, "uuid": "00e9a764-3d14-4625-a277-b075ddf14ae3", "comment": "Malware payload", "value": "fe2cf3ca65f9d1df3f74dd36657a0a829fd94170", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490022, "uuid": "a8028aa4-eff6-437f-ad86-912473ee5c68", "comment": "Malware payload", "value": "badba8d6e7cb7f64552956ce1ddadfa532d1ccf94e79a2444f6d796bceb08dccc029760c7005b8b7d6d6dc62eb6247ad", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490022, "uuid": "fca2e51b-4f9e-42b9-a8cd-c299e3663d8d", "value": "T119B26DC3921394F18BD6EB53253741C0DD99AE9F68C266EAD64871623C8D8CEE8E41B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490022, "uuid": "fbddaa2e-34cc-4ba0-8e9f-21306cebcab2", "value": "384:uIsFMozCAgJ5Ie8JzjXEWX+/CdSE9y5BeSpdd8Wpbv8zMlDzjVdpBf2ikA4dkWN1:uIsFMoWV0Fz4b/1EQFhdZ8IzjVdpBOiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490022, "uuid": "7cb1d26d-1f46-4316-aae0-6a02a217305e", "value": 23512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490022, "uuid": "2cf70361-2e31-4229-ac93-a8a88610fb65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490022, "uuid": "9cd0fe78-d4b2-4f33-a2ff-a69fa56fb197", "value": "axiwu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b82895f-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479691, "uuid": "aac0bf4a-5fc8-4261-92bf-2bb418996b3a", "comment": "Malware payload", "value": "bf281085adea46dfb1403a53cbb6ed3d", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479691, "uuid": "08c77f56-eeaf-402c-ac6b-0b487757cb80", "comment": "Malware payload", "value": "b2c0340be675e2c65e64820562db4a05831ceaf6574e3f173bee9b8edad1261d", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479691, "uuid": "47c9d1b2-8768-4b52-9e37-e71b2c7b77f8", "comment": "Malware payload", "value": "f6388cfc99ae2a82048e595a94c9d19d22e5df0f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479691, "uuid": "9ea52458-7d20-4b54-8c06-f994e36a92e1", "comment": "Malware payload", "value": "ae52a2a2a2d2a38d840858282aa2525448b70d76353048269af397cf81f91d43b5d21942c2d418c65e1bc4bf725f71c0", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479691, "uuid": "f941700a-7af5-4cbf-8934-710a524dd381", "value": "T181B533F96BC61939CEDF8B3264D5311FB3F77F5426A286C30BC4924C4661413AA913AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479691, "uuid": "5642252d-f01a-432b-8cca-c7064f318bf4", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479691, "uuid": "5a63e6cf-d9e3-4086-b52e-ea0698886ab2", "value": "49152:itK/cs9EGmuXNr1obcWBQEHCXnQNY6CLxxPlMZmqXZlpu:itK/WyUkEiXnMYB7PlimEZlpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479691, "uuid": "498a4f4e-c4f1-4d3d-a247-b5b8088b341f", "value": 2358272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479691, "uuid": "4533c47e-c0f5-47e0-a4ad-7bc07a8ad0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479691, "uuid": "79d6de4a-939d-4f8b-9f1e-d48dea369f73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf19341-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493219, "uuid": "f899f034-10c2-467a-b083-dbf0cafa8d90", "comment": "Malware payload (Mirai)", "value": "5ca550c825c1e0a8333ba4d3b3e3616c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493219, "uuid": "6c0aade8-0987-418e-b895-778f29c621fc", "comment": "Malware payload (Mirai)", "value": "b324641454cd2e7bbf7a98515db52384fee3915a2fd9feb457027dcdf5cc61a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493219, "uuid": "6342cb5b-9909-4cef-a68a-033ec24daf1b", "comment": "Malware payload (Mirai)", "value": "ac24d810e4574fa878565ed454d3519101b0458c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493219, "uuid": "aefe6e03-116b-46d8-a4ef-a90c7daf10d3", "comment": "Malware payload (Mirai)", "value": "1c9cd0fbaa595d4bd6082963e7ba2e3b60d40bf493a55951d4a96241f6c9a5ac2c9462b235759e6704760d72742ea8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493219, "uuid": "ffe4a0f1-aa48-49ad-a645-9194aa89362e", "value": "T1A9434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493219, "uuid": "2599a94d-b504-47d8-9d8e-a9ea27b59ec5", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmc/Dj5gk9vWnTI4eBH+4sToQLDIFv:Yn/EsW5qhSh6amYlWnU4GH+dNL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493219, "uuid": "fa170160-b337-4393-af98-746a2f320786", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493219, "uuid": "f9764738-be42-4470-91cb-40a3e413b3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493219, "uuid": "b713f7ac-649f-46c3-b79a-ebd1041e4e25", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631a99da-43f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483945, "uuid": "f87ed646-ecb7-4a19-8ecd-445194d6b3f3", "comment": "Malware payload", "value": "1404c85b97dfbbbaed21e621f83ceb0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483945, "uuid": "ba11ab91-842e-41d2-ae90-e044d031ad73", "comment": "Malware payload", "value": "b32cd83a518ea3ca553f801526da399f65baf1ae3bc653420988c3634372f380", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483945, "uuid": "19b7e72d-184c-47e5-ab41-0613623e8b32", "comment": "Malware payload", "value": "f977b6f5069c459afa3a9fbd162383bdbaa5448a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483945, "uuid": "7051fb49-a9de-4641-977e-ee38fc41eb37", "comment": "Malware payload", "value": "00113fff7e7ab007a5522e397f9f0535a5f243bf6dfc06bf3b1dce9b5fc8c03b8d97f315e2fbc5419af76be85f921bac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483945, "uuid": "cba85e46-e71a-4082-aa5e-c19d05472c29", "value": "T14F136D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483945, "uuid": "8ddc50e1-374f-4907-a09a-0a9a1a8ff27d", "value": "768:bGs9NyXsZztCzV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:brHusZPcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483945, "uuid": "106a3e5b-3658-4670-b45f-7aff3c035d38", "value": 45409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483945, "uuid": "211febeb-830f-410a-b3e7-f291994b1487", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483945, "uuid": "2df98b50-ad54-4d35-ad69-afb53d011608", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca1bf8-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478738, "uuid": "3c100e3a-6cdd-472f-be47-d9786014c50d", "comment": "Malware payload (Gafgyt)", "value": "afb8f780e36e5f240aa0d91bb21e7e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478738, "uuid": "89a65578-28ee-403b-bbea-7991f391c738", "comment": "Malware payload (Gafgyt)", "value": "b36ba9a8fd989e2a6d02b11e2ba872019a6591b72d654f252f19066d9e12d5de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478738, "uuid": "12c354b9-a050-4aa8-a45c-6cf87cd071bb", "comment": "Malware payload (Gafgyt)", "value": "386bf2eb017b49af5493360d6285e4336ec9cb2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478738, "uuid": "57e6a312-9c80-4734-838c-97b760f2439e", "comment": "Malware payload (Gafgyt)", "value": "bf399e47c8462324a00600a203a34a3e9ad4ea28f108a52473adf94170ae2c846eab6be1198633ba67261027280861ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478738, "uuid": "1778d2eb-d8c0-496f-a607-b7fd4af7452b", "value": "T151B3D707AF61DFBBD85FCE3306EA8A11108EA45612A97F2B3274D96CA74754F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478738, "uuid": "c522284a-d137-4781-94e9-ccd76854c5a4", "value": "1536:zqqOzrdYZgWSwaJEfUAAXZrErMaYR545ltlmxt/FLflEi8C7e:ErdY5aJri2+hlmxt/FLf6i8C7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478738, "uuid": "97f2f1f9-2d00-43d1-a30a-94ba0a5efb24", "value": 109346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478738, "uuid": "254c35a1-2af3-4070-8c71-896e77915470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478738, "uuid": "e0f41918-f800-4f48-bd53-11fae5d02f23", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c4d700-43c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777466285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466285, "uuid": "d7d22a6a-c113-4563-8d33-4a9f8520d0f3", "comment": "Malware payload (Mirai)", "value": "0eb9d7be572752b2978458a54c9e2222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466285, "uuid": "e06c2eb8-d10c-4b9f-bf9c-a47c4033ebc3", "comment": "Malware payload (Mirai)", "value": "b55bd5db1e23f5f8da29de762624a69fda49e4c12030adb1bd5907e5c62d150e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466285, "uuid": "fdc420ed-65e1-462a-a65d-1a6acce2fa80", "comment": "Malware payload (Mirai)", "value": "73651c02b29f1c07e3177e86c967fc45e9f30f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777466285, "uuid": "a3aa82e6-1080-4d93-8548-8d5afa284707", "comment": "Malware payload (Mirai)", "value": "d2133b748bc6e3a28743e3db99de0fa86274230a103abd169f370857890ff7c3c640949cd9ec342004c077d49b45552b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466285, "uuid": "0eca3330-aaf1-44c9-8aea-40aa54912b5c", "value": "T13C5423DEC41B8DFE89DBBD984E6FFD4CD24408B70131B0536A93BB0165BB86A81907D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466285, "uuid": "51080c22-b92c-4fd7-b83a-ed9f892a1539", "value": "6144:Kwi7zLgsj+DWAnFm3wL8OjKNrR77XAbJtVnELdnC9Ch:KnzLN/AJLNjKNrR/MVELdC9Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777466285, "uuid": "26d5c305-48fd-4e52-9e14-9876e5f9e9d6", "value": 294484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777466285, "uuid": "1007887c-c131-4eff-91a7-981f411ec3f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777466285, "uuid": "ae0cae11-14f9-4f21-ab0e-c2fe82b78832", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8349a042-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485717, "uuid": "f1a8a9e1-9108-410a-bce8-84d447e34e54", "comment": "Malware payload", "value": "2e3fdcc9ea35a0690a007cb1c18c1b92", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485717, "uuid": "07e6f2cb-5f9c-44ce-8114-a733f77bb392", "comment": "Malware payload", "value": "b5b49822e683091afa2fcddded1ed39c9ad88b02d0d35a2f392f856c1e90e746", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485717, "uuid": "306fa886-8b7d-4f76-bcb1-e37a6c0fef3f", "comment": "Malware payload", "value": "c4631ad74b5b4ccb26eb73373db298c0e6d27946", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485717, "uuid": "ec711c11-765b-4b5a-8678-7f1dbe27c618", "comment": "Malware payload", "value": "8be7c4b82de5b08e2209abe79f266d97f729d21aedba1af61e75429831cabc076a70c1ddaff77274d6726fa90180ca19", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485717, "uuid": "8f4910ac-d568-4b63-b6b5-29da406391b7", "value": "T140A28E398B344AE20E052D63589B02C4EA79ADE7258417CBE710366725CF831FDF93B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485717, "uuid": "7e67c246-6ec5-4d96-a47d-7f39a57b329b", "value": "384:uIs/b5cru/EitGBqqoVIaf8NPHekL2gm/fqWib4UabCDodmVvYT16egZsi9k2NOi:uIs/b6r2EoG8dHENP+kL2gm/fqWE4LCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485717, "uuid": "1bef7a26-f461-4e99-8fb8-21674b4372af", "value": 23268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485717, "uuid": "b6398a2e-9fda-4ac1-8010-4602510870d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485717, "uuid": "b0cd75aa-fbec-48a6-a503-f53eaa6d4c40", "value": "urasu(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57303e93-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777448706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448706, "uuid": "07f20183-bc49-4031-b496-8d456534b875", "comment": "Malware payload (NanoCore)", "value": "3486ffd7681b91a450611730e2ddbffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448706, "uuid": "9d544657-ecd9-4326-8d17-ff136b0cbca2", "comment": "Malware payload (NanoCore)", "value": "b6075eb4e1e4d18fa005ee012e9fed34fc236a9ad324fe5161060ea3dcae2613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448706, "uuid": "a1503e86-bed3-42b2-9c46-eb9356c8d23b", "comment": "Malware payload (NanoCore)", "value": "33f24080ffe0937b69acec08dd27ee4832da61ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448706, "uuid": "1eed725f-9d02-4678-905c-f1c5d286ada7", "comment": "Malware payload (NanoCore)", "value": "c88e7d22bdf0f0cb45da3224fd525a748bfc176313ea942b2626b83fcd751c8d608caec8c96aac4f2bea34a0490c648e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448706, "uuid": "43789e5e-6007-4642-837e-add09a86dce6", "value": "T19214CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D464B78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448706, "uuid": "e99d8244-29e9-4f8d-a8c4-f312261b93a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448706, "uuid": "5c2adca6-98c8-43d1-bde6-c27bc36d0313", "value": "6144:MLV6Bta6dtJmakIM5+0cFHkf8wa3PNMGd1:MLV6BtpmkxrH3wKlMGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448706, "uuid": "55ad8614-d4e3-42af-8455-416b6745557a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448706, "uuid": "9e95cd4d-115c-4c6d-a2ea-f687222330a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448706, "uuid": "c6dd6146-079e-4e9e-9100-e8f003ea6431", "value": "m88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892f5357-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494746, "uuid": "ff31c945-3944-4750-b424-95e79fbed134", "comment": "Malware payload (Mirai)", "value": "86bc31766ffad3889e4ed04cf8fa06da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494746, "uuid": "016a5b27-41fe-4ec4-8328-8ee37a1a280d", "comment": "Malware payload (Mirai)", "value": "b648fe8386c49b77984d2a469ef19c204efc6785ffc57417f648583313378fc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494746, "uuid": "1442ca6c-b0ea-4636-9c4e-e6fde99ec44e", "comment": "Malware payload (Mirai)", "value": "eb5d54720f67cf4eeb50a34077c8bad2e141c241", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494746, "uuid": "cf2fb549-adf1-4f5f-9176-5f60d2e4c1b1", "comment": "Malware payload (Mirai)", "value": "e1e2f8b5d900f63aa531edc90fe2db539e621e4a5faaf0e2a7ca7d5b2e75e95f5ff5fabbda3a0c95a4f07a6d53880618", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494746, "uuid": "2105e291-386c-4602-855f-7d5d4f0c20bc", "value": "T15B23F1AD241D9B9AD809E43B35EB0BE022BC07F21192FC4BB02BBD47D54E5D9B094EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494746, "uuid": "b05e0fbb-6c3a-44a0-9003-76c229e0096f", "value": "768:2oFi/p7Um9ZItamy1E/owWZnv5iNhOSbIl4VE5Cm8tHfuAV8RTrZmJgGlzDppMgI:jFq7lCty1EFWJU2SbIJ5E1uAV8R4V8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494746, "uuid": "ab200c10-f73a-4c18-b687-1d8b4d27b19d", "value": 48840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494746, "uuid": "00c818c2-e707-4f4d-ad01-5d5a04ad1a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494746, "uuid": "f90ee69a-fa4a-4e76-8901-03052bc7ba4d", "value": "rage.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d225d400-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440323, "uuid": "2d35f571-35ab-4d3c-b1ac-b8a28ce830fe", "comment": "Malware payload (Mirai)", "value": "f80efbbb246562b8cf2ef975c69d627d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440323, "uuid": "316b9813-e11e-4b85-ba74-ba03fb928226", "comment": "Malware payload (Mirai)", "value": "b6786ea2d7f06b30ccedca452b1e1b9968238ecbc637665014a5572078ff6443", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440323, "uuid": "6c002250-9cfa-4c42-bd0b-eca9d476b863", "comment": "Malware payload (Mirai)", "value": "ef3f622cdfe1ab568d4fced43b051cab7449334d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440323, "uuid": "7b7ddf85-0cd5-4f25-967c-f8fb7479eba0", "comment": "Malware payload (Mirai)", "value": "0d5786cdb62d2a758c07d65bb015d74e78f132376d2d6db3d289aef2d029926929b5439e5fbca01ea0154b8080efe875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440323, "uuid": "ef381d8e-4df5-44d8-b43d-015694b827a2", "value": "T191D307C7F900D9FAF80AE3374853080AB230B7A649525A377257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440323, "uuid": "ffeb5925-e9be-444e-a831-6e8852615d06", "value": "3072:XvW4mq3PrmMIyLLvTvsyw2j9ho8s7ORV1jbixLX+XKBP:yxyLzjsd24H7OwLX+GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440323, "uuid": "91645866-8c24-4235-9a79-71d8b5f397b2", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440323, "uuid": "ea29daaf-b1c3-4bec-b051-84504e16551e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440323, "uuid": "ccd7bc54-0f74-44ad-9031-11d654c66113", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e8a80-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494984, "uuid": "e39f55d3-546f-48d6-ac6c-49f11685cc4a", "comment": "Malware payload (Mirai)", "value": "c73be0134c5c67014016b7586973b884", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494984, "uuid": "0612015c-0391-4de5-ba38-424183444b97", "comment": "Malware payload (Mirai)", "value": "b688f5748ca00b23c0ccbc2e2723f9248b32a0f94b51a9ec26e8dbb8632e4efe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494984, "uuid": "8bdcba1e-8b7b-400c-8d4a-6434e8765814", "comment": "Malware payload (Mirai)", "value": "28649f06fcb279d40e7102421b9febca221691fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494984, "uuid": "33107685-bfb0-4517-88a6-16900120cdea", "comment": "Malware payload (Mirai)", "value": "b63992668ad973a1423558d9226a4fc576a126a58e93008a49bfed014c50cbf72c8ad51b8aa64256383b9b741e54dd99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494984, "uuid": "01f54961-04ff-4196-a600-9427a32e746d", "value": "T116A30887F902DE7FF80BE6BA049309197520FA660E530B76B367BD93AD311D41962F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494984, "uuid": "f3c9223b-ab87-4bc2-9cd1-f2f35dea7b8c", "value": "1536:3yT7fahnR2md8hXZto5P1068Fx4/9W0aU5f9ZYjrAldWG8lQTLx:3yXyL58hXZtmP10H4DaQ+jG8lYLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494984, "uuid": "860bcdaf-e07b-41e3-8e3d-13436123fab6", "value": 99676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494984, "uuid": "6d4631dd-fa52-4150-b2c1-35b95d158349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494984, "uuid": "c876fc2c-0647-4877-917b-e4284fd5b1dc", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcef441e-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495316, "uuid": "c8e429f4-a275-4616-8770-05955756c091", "comment": "Malware payload (Mirai)", "value": "e0d4482fbb006c9d1c398275579f29d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495316, "uuid": "fbc3b452-c1df-4298-a144-d5b869e41b58", "comment": "Malware payload (Mirai)", "value": "b6b62d6589c1ba26e46ad51188654d6bcc37ab389adcc5959dd907271f4c3e64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495316, "uuid": "bf948e0c-dbe0-4cb7-8578-5fcd4f93f4a6", "comment": "Malware payload (Mirai)", "value": "3b9097b5bc307688f0c742c7075958a18611bf7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495316, "uuid": "db80222f-98d2-47f6-9e80-f5129e5a1b95", "comment": "Malware payload (Mirai)", "value": "e314943208e5cc2e99fb8b796c9f8b7acbc5dbf921e495800f8a4705caf81c391d127bea88f6bd1a1de7738a1d832462", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495316, "uuid": "ea832b93-3b45-4f63-871d-5842cc57264e", "value": "T183733923EA16AF46D14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495316, "uuid": "1952f0af-8599-4bba-b13c-fa66841c8c26", "value": "1536:epwtq/0FORx0SFXSRAJjnixAXNMffKM2HX7c+Gr0IKCSWUf1QK+:epv0QRxJsq/XSfCMKjGr0IKU8qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495316, "uuid": "a6399732-2887-4e12-9826-5417f1a5da66", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495316, "uuid": "0e219d0b-8868-4581-be13-aea8cccb468e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495316, "uuid": "15bc2897-b2c0-4cf4-9781-8901fad3beca", "value": "night.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7dba2d-438d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440957, "uuid": "8e515888-6d76-4374-9737-21d77bb393fa", "comment": "Malware payload (Mirai)", "value": "4f71a18f7e1f351709d109237c5b8617", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440957, "uuid": "46901e5e-9d17-46f1-a315-18fdc59ba102", "comment": "Malware payload (Mirai)", "value": "b6ba6799b2814ff46a79b0b3554b2ae6e755fa215807ca120d6ad6453f9ae313", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440957, "uuid": "d8e5bd96-fcb3-476c-a785-d5064e063213", "comment": "Malware payload (Mirai)", "value": "7cf293b880fa88780c12420e215ecd74c5f52b39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440957, "uuid": "c444215c-0800-406e-af81-2dc1069036ea", "comment": "Malware payload (Mirai)", "value": "5ed0b00b0d7262ff3f2bffb9a2ff613e2270263858ee3f21748e249231430b9ad6c8fc0fbb5e82cb25a24b2bb142e9e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440957, "uuid": "9c7feb06-4e7f-4721-b209-85f0ce37a4e0", "value": "T1F742D60B57FABE07C1D0E37301E3072266EA4F556124872F7E192C995E9934B2D3ABD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440957, "uuid": "36bb224e-cffc-4c2b-be18-51125ab67297", "value": "192:dmLjGr1/WTohTAjo7usPuEfHsCi0UZNDstqYM1Dq3mjeZ:AuaauDEfMC7Uphq3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440957, "uuid": "4d3b947d-8a98-49fd-863d-70b4a45e3d60", "value": 12292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440957, "uuid": "35352272-d806-4e8e-8ad7-a19e6c05a2c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440957, "uuid": "df50501e-1b93-4a6a-ae2c-d8bfbff59f1d", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533214d8-43e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777477905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477905, "uuid": "6e60bd44-a687-4867-8750-07221db7ad3b", "comment": "Malware payload", "value": "599485a3f1d8ad9646c119d39a58b4ac", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477905, "uuid": "e05293c5-5d27-42bc-ba95-5f2a11a33dbe", "comment": "Malware payload", "value": "b6ea1516c2a5096c53a6fc7e65de86aa38b863441d3d4c3a6616dac5624d90c6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477905, "uuid": "00c051fc-a2ed-4a72-a960-7f1e0ab0f576", "comment": "Malware payload", "value": "d61832b85066976dc85a6b314e5a3578fa005679", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777477905, "uuid": "6d7ebbf4-0f5f-4056-afa6-bfb1c800539b", "comment": "Malware payload", "value": "aa63a2e2b9a92e565835b467ee2c4fe695e02d949930602b8a268530947601f3f8b3ba6bd546b35c54aabd3fe1a429c9", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477905, "uuid": "645787b6-1789-45b3-ad7c-9835a981f780", "value": "T1C8C6F1236A492139E29917353A76DFE0A73B6F506C1F880F96F4347ECB351E029366C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477905, "uuid": "f6459a9c-db01-4f9b-ae8f-6f4dafd19d8d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477905, "uuid": "52190ca8-d49a-48e5-b777-326038db8b48", "value": "98304:yL8NcXluuX+/d/J/MAcqLAqWNDXE1VMLn2Y9ZN6hSMn:l+l72/OAnAqWND01V7Y9ZEA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777477905, "uuid": "b29829ae-0f70-460a-b2ed-781b5fa2d32a", "value": 11907054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777477905, "uuid": "e76d7af5-b630-43d5-8547-740a3115b7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777477905, "uuid": "1b3a521d-6bb0-4cde-806c-37cf72dfb762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43355a6d-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441371, "uuid": "a6c4ad5f-4878-46d2-9856-165e36b64eab", "comment": "Malware payload (Gafgyt)", "value": "7e34dc25a074f67dd4de7c264b50d27a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441371, "uuid": "2e16d351-f189-48ba-88bf-5cb75b440d52", "comment": "Malware payload (Gafgyt)", "value": "b7f6896562f3c89cd858a3a37baa83ae478c5b228d62d1395630d829b054e758", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441371, "uuid": "0d0346be-5d31-4941-bcd7-05eac45dc572", "comment": "Malware payload (Gafgyt)", "value": "41ecd85f8fb1350bb7c14bbc51fe0533acd2ca34", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441371, "uuid": "5e1b1a94-9c92-4e08-a483-02b41996e40d", "comment": "Malware payload (Gafgyt)", "value": "e8ed683b8bb899e75a7ab3c6f06ab7cc1cc9311bb73b6d54430bc34f89c3ff0874f2cbc1db2277060aa8ee1ad329b364", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441371, "uuid": "7729ac6c-4c23-48b9-90ad-ebb06bab6634", "value": "T11EB37D1B6292C6FAC08356B527DFA2618423F67A0B36721B73D4BDA43F15CC95D2D381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441371, "uuid": "6962e453-2270-4b54-8773-5ff461e47372", "value": "3072:Pl2n/WelPFo8NezN3/S2VvXnpha0fZPCZVOXinYuM8R:FIy4QN3KWphaQZPCZVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441371, "uuid": "3f50cb05-c684-4760-af56-315e4fe48399", "value": 112832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441371, "uuid": "92aecf68-279b-4c07-97e7-ae9deaa96605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441371, "uuid": "adf7d557-0f84-4989-a8a6-3413aacf016e", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f02b04-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1777479682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479682, "uuid": "5d96103f-3bdd-407d-8c41-f422a8c1895c", "comment": "Malware payload (njrat)", "value": "8b0bf9f8d08195a80f40378f1b3bab83", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479682, "uuid": "6f46972b-b0d7-430e-8756-9b5c08f105f6", "comment": "Malware payload (njrat)", "value": "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479682, "uuid": "f82fb905-ab95-46ee-86d0-570bf6650838", "comment": "Malware payload (njrat)", "value": "068c8472d503d31710151e638806e9d246466e5e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479682, "uuid": "19fc7903-c68d-4e92-b450-2a234a4c2727", "comment": "Malware payload (njrat)", "value": "f88bc8f5dedab41c3034d23a843b8c95882e70e30a0484b08633ccae8534142a1532c5f5d01b0a6a288e65954d089463", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479682, "uuid": "4665067c-7962-4512-a62b-7d36951b30ba", "value": "T16C0512ABB3B524E6E672813AC6114506EBB3787143A556EF179883B23F135D09F3B321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479682, "uuid": "be36fe45-7e77-450e-aa2d-b19db7001d39", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479682, "uuid": "4e5e302f-1368-488e-acf0-857916b34db0", "value": "24576:/eJH6RQwyozdwdIzkZslouHTWvaG98cNmI+Mi:VbyoRO+kZKoqTWvaG98cNmNMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479682, "uuid": "c93dcf60-0abc-46a1-a31a-70968c17aa4c", "value": 797096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479682, "uuid": "aceb7e2a-deba-498c-9752-b8fed1798100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479682, "uuid": "dfcbcb11-c085-4dc2-b1ee-1d4ce747c0b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab49d43-4408-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777493702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493702, "uuid": "f5f980ff-747e-42ef-9362-af091a67e69c", "comment": "Malware payload", "value": "ff057b0fc76181f34fd88e739699d412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493702, "uuid": "af6996b6-8ea6-47d8-a3ae-99e783719450", "comment": "Malware payload", "value": "b8a371cf7250d0aa18015c7ce3c434ae4f53e29af7a64e2bf11d9021bea5afcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493702, "uuid": "5e4f5268-f902-40fb-884c-62b7174a743d", "comment": "Malware payload", "value": "498174409f16e31752511c2adc6b3a6a1f97c484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493702, "uuid": "88bed6c6-afca-4b49-a7d6-7db0978939a7", "comment": "Malware payload", "value": "294f0bcd12fc18e5f925ca79421954a6c4bf923d870fccb898d6dd813cb360679dd7a4409e39475326f212989bdaac96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493702, "uuid": "0a12a1bc-5fd1-451b-a6ff-8327a08bfd7d", "value": "T137064C31324AC52FD96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493702, "uuid": "802e450b-da71-41ab-af48-302713e6107b", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493702, "uuid": "35a3533f-ceca-473e-ab32-40aa7802235d", "value": "49152:BWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5snnPAELcpB2MpF8x:Br99u4kc8Hao8eRjYBU4UAir2Y52nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493702, "uuid": "f2ea1bc3-c568-4208-9335-0f4531a8f6f1", "value": 3691072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493702, "uuid": "19cab106-b3eb-4883-ae15-1216d0ef51b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493702, "uuid": "a769c726-0363-470c-80d3-be9d53f29908", "value": "Hokuto No Ken Mugen By Mugenation Android & PC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16f8037-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494787, "uuid": "b20ebea8-1c63-4396-9d28-1a603943633f", "comment": "Malware payload (Mirai)", "value": "602c0d6af40cbaf8136a2fa7b81b05da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494787, "uuid": "d8e34966-b866-41ee-90ec-cdfcc3409954", "comment": "Malware payload (Mirai)", "value": "b97773755991298af8e048925d0fd224385146b300b166c67535258aef81a3ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494787, "uuid": "7682314d-0d60-498b-8ee0-8c9ce4820e0b", "comment": "Malware payload (Mirai)", "value": "ab5b7f222bc88bcd1ed7ee7f473000ea530a18bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494787, "uuid": "66ce9353-2ab0-48f7-81f8-4d05963ca144", "comment": "Malware payload (Mirai)", "value": "da4b446dc8afed4268a5cb391f00039bafcbff38cbc1fb1e6fca6e5b622692e359e00057153c8f71f58bacacd682298a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494787, "uuid": "e2a1e5da-4e0c-4566-b417-042a434eda49", "value": "T13FF2D0E2F7BA0888C1E885BDBF75FE9F4050E5588EC8D7456BF4242AC4CE751361C686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494787, "uuid": "0960b728-9f91-42f7-bd35-a71359ddcdb7", "value": "768:3pzkT+Zhk4Y+Ll628AvGCjF4mI39bc/YQ5hb6gfnbcuyD7U9UcV:WT/gLM28CO5cwqh6Snouy8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494787, "uuid": "8fc5d7fe-2f8c-4e64-a5c4-7085d532971c", "value": 35076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494787, "uuid": "1e1d9ebc-b689-462f-8871-e49bc4c7fd9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494787, "uuid": "a07d4b58-12a2-4e94-a5fc-760f3971dcae", "value": "rage.x86_586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f582f7-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455449, "uuid": "e780f9b1-1906-4d3b-9882-9a0f8a4e1981", "comment": "Malware payload", "value": "9d33a5fdbf8e5c4c36aebbd6788f8a19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455449, "uuid": "9e9abb34-d40c-4ed3-a650-42e9ef687424", "comment": "Malware payload", "value": "b996a1cd8ca339b7e8a5b3480dc3fd281ba10b0ac7a9543f91d233d543841ef3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455449, "uuid": "1ddf58fd-95ba-435d-88ea-261e4b72a64a", "comment": "Malware payload", "value": "4c4552b05db64401071c166c984021834f095ab3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455449, "uuid": "c612bd72-54f9-463e-b723-86415331427b", "comment": "Malware payload", "value": "14f8f74ba7ffa551bb73369e369fc2370fecf43178505d4f3ff5c1a664f159e0c0cbc429cd11aef1eca547563b833412", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455449, "uuid": "56185747-bc73-416e-9b17-b070f494049d", "value": "T10D372300AC2DDC6808F4796D1CFF0F891FB05D69959CBC88E7F27846A19DD093BA6C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455449, "uuid": "8d60581d-bcc9-4e26-8e2c-23340f8319ba", "value": "49152:3ImAIm5ImbImUImwImSImvIm9ImNImZIm/ImIfWImGImzImhImVIm8fDImcImKIk:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455449, "uuid": "c4c39a26-cb10-4fc8-a560-5ecceaee7eb7", "value": 23684320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455449, "uuid": "cf51f84a-b9b8-4fc7-b99c-acfe7ff327be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455449, "uuid": "c29ed5e0-09da-439d-9341-5578e8317291", "value": "invoice-1645080830.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c301c0-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455384, "uuid": "4ffcd674-60fc-42b7-88f6-6a69ee4fd9d5", "comment": "Malware payload", "value": "b9e99f2327291cfd911974c2a0c1c0af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455384, "uuid": "47e76b7c-780b-4290-ac3f-9b094d62dd55", "comment": "Malware payload", "value": "bb53411b2b1b8baac222cbe3f029dd9018b61e8285873535735040bcad58e275", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455384, "uuid": "f864f056-f19f-4565-b081-8d120b561d11", "comment": "Malware payload", "value": "231d46a24c3ca7f5e2589850fe54f2732ddc7488", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455384, "uuid": "1e0165bb-3830-4a47-b22e-5bfa41f21daf", "comment": "Malware payload", "value": "a8c1b5c7ac99524fc3a20e9a38b4a2a6ce1502ce0bd26d9b8804df4561e9b78012259d34a8c01d304c1c10c978aef311", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455384, "uuid": "ed88b66d-667c-4567-8a00-c159bbf5df6c", "value": "T1393722028D3B3E1F863C779A7EE919D722A4DD05002179FDA7A63CDB9D8AD0239D1274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455384, "uuid": "4e0ceecb-fc5a-4d40-89b7-551b19692f20", "value": "49152:wfW/3fW/5fW/ifW/QfW/TfW/5fW/MfW/qfW/UfW/2fW/cfW/cfW/dfW/0fW/0fWO:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455384, "uuid": "ab9025a3-4ab4-4774-8f30-af4fcb8961af", "value": 23944466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455384, "uuid": "1bdb33cb-4939-4aa2-a227-80978aaf6f6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455384, "uuid": "82d6bbc6-ba8d-497b-ae28-28e81827c3f4", "value": "invoice-1645080830.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fe044a-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494987, "uuid": "e2668fad-3c40-4e19-b253-86f18f3b3a11", "comment": "Malware payload (Mirai)", "value": "8cfc099f954b36aa6f2523a8da25e8f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494987, "uuid": "1e236d2c-cdb8-4755-aeb5-46617e453192", "comment": "Malware payload (Mirai)", "value": "bb6d5e4665fa0ff06111041f7701c79d74192ed49d4db230cd3534dd600b29e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494987, "uuid": "5b13f3cd-6f0f-435c-9484-db4291d4c931", "comment": "Malware payload (Mirai)", "value": "f4e1830958f895881efe562b256a3e8eba56eb50", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494987, "uuid": "5e002bc4-1ecd-4c7b-b85a-db24b21ab13b", "comment": "Malware payload (Mirai)", "value": "76620c8ec14986782c4606ebfcb4bc5f91f0ba2b0e1607899586f2cb4da461f14f11d649dece1e5455849f50338c9b33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494987, "uuid": "e914d08b-47ff-41e8-9d6e-f26aa097e5b9", "value": "T1FF733923EA16AF46C14761F0A9F64E740F12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494987, "uuid": "d0bfd596-5fdb-4de7-b712-85064c397c6c", "value": "1536:+pwtq/0FORx0SFXyRwBjniiQv1MjDPKM2nu7c+GYgKCqWU3cgih:+pv0QRxJcScv6fSMrjGYgKMEn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494987, "uuid": "a450cd6c-de2c-4764-bf19-b4951ea41198", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494987, "uuid": "45c16470-f553-4a8e-8bd0-fcc32bbc4b3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494987, "uuid": "0881dd4d-edf5-44d7-b00a-20fa8c3199e4", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad978c4-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1777455235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455235, "uuid": "214450d0-2099-49f1-b60b-dcf289fe0979", "comment": "Malware payload (PureHVNC)", "value": "ef550978657954819eb7364490741b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455235, "uuid": "b82eb4d7-ba61-4fad-ac4b-60be581e4f2d", "comment": "Malware payload (PureHVNC)", "value": "bbcde509fae3909f332e465c1857358bbef60c481414bb2632505337cc1204b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455235, "uuid": "fd4d67a2-4f70-42ed-9293-b18a802fd7b7", "comment": "Malware payload (PureHVNC)", "value": "08b79b554ac4f6f4b44b2d7c6b2afbf1683f86bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455235, "uuid": "44ded858-51c8-4653-bade-29d94188adbc", "comment": "Malware payload (PureHVNC)", "value": "7f54228b186fd3772ce52472258a91ef5d9b002a44bb9ff5cc9e631074143b9fdff3f8b8eda6c155fd6fbf9e23a6e33d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455235, "uuid": "81b4b63d-0632-46ba-87d4-1ec73e2a32de", "value": "T154D49E6776524E10D2998733C1CB4E4193F4A78676B7F70E734533AA24163EEDB0A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455235, "uuid": "3bc07e18-1beb-4a0b-9a29-974cffe35460", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455235, "uuid": "31652dfe-5940-4e0d-aa76-dd42acb6f4fe", "value": "12288:nK4ajKkb3j5SVMht/t8nrYZHrla4yXMNIigtyOe9OB4qDF/0:nNMm8ZHJZ6XytOB4qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455235, "uuid": "94c05d2d-974b-418b-90cd-e41868bd4dc8", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455235, "uuid": "d0864295-c4c0-4c7a-b17c-94437b969dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455235, "uuid": "06415a25-d29f-4aef-a3a4-b8aa6758ac56", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.14281334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc83d79-4421-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777504658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504658, "uuid": "35e357f1-0c9c-4eab-93ec-c1b7cf799a4f", "comment": "Malware payload (Mirai)", "value": "7d63c9a288af3072ff8f5fb0b7d681c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504658, "uuid": "a5bf4e70-bc94-46ad-9e72-cc82a8f864c8", "comment": "Malware payload (Mirai)", "value": "bbe19ef674673ecf13e8c98b9535add8aaa0a2ab288030bd84d91e65fabe4aca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504658, "uuid": "3a1e280c-18ec-4930-8ddb-0d375b284831", "comment": "Malware payload (Mirai)", "value": "5aede1006ced0042c906414a694dc09691358db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777504658, "uuid": "748acf1d-73c4-4849-8a89-8cdf92c697df", "comment": "Malware payload (Mirai)", "value": "ce5d7d632eae1c589b441b11f95a5390b85747daf011659b9a95e40e95e6b72bf89ac56fc4c8afa339313604fffb4ebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504658, "uuid": "107fd0d0-ea58-4f87-ba6f-1873cf10e283", "value": "T1D4631B07BA428BAFC14FC1F407F76A399922BDBE0A36F1E5E3A4FD865901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504658, "uuid": "f43b76c3-dbd1-4b5d-8053-9a45649953d5", "value": "1536:GnHkHRxHBFPSWGzHGAlGy5TGpWE7wH9OXEL9qK:mHkHvBFVGzHIytJE7wwXEcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777504658, "uuid": "49fa62a8-1869-4d77-8c6f-db1802dac150", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777504658, "uuid": "ea33b42a-9cbd-4fe7-a034-885d53b9cafe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777504658, "uuid": "f2291036-b3c1-424a-b418-6d2b3def93d2", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0c82a1-43b7-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777459079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459079, "uuid": "99e6765d-c8b7-4506-8f59-d53eb68c11e2", "comment": "Malware payload (WeedHack)", "value": "5d4934b4472ce78cab4c8a2e250b8c84", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459079, "uuid": "64f4f248-eab0-48e5-9b99-7f8095b07d4b", "comment": "Malware payload (WeedHack)", "value": "bc709685cdfebcfa3f8187f31227cba46644ff09e2e97cc374336dd922c5d793", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459079, "uuid": "68a3f4c4-b020-4855-a32e-496b1a1a3332", "comment": "Malware payload (WeedHack)", "value": "139ca5ba3e2b473a117e127551c23d336db166c8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777459079, "uuid": "65c29a1d-e225-469a-9a30-9f9da8be388f", "comment": "Malware payload (WeedHack)", "value": "85846939064e3a3499112c87b0eae7516abaac3c46759c1a127f3e23f159abd59137889eb8bfc4a9cd1056ac4886563d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459079, "uuid": "cf5960f6-4ab1-4eee-b3d0-2c7f1d16eb67", "value": "T1C725BF13BEDAC46CCE7744F351C282E124AF69A4EE0B917E0B945DC58B60D4B0366FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459079, "uuid": "519cee18-22b8-4054-ac14-e8921bb312c2", "value": "24576:dF9x4uLskJplhcCX3FCHuLoF+H/erj1g/6Ds:dF9x4uzblhtYMoFI/en1wqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777459079, "uuid": "2bf0312c-fb3d-40ca-8a5d-d3b901625a5b", "value": 971933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777459079, "uuid": "cd4fe8ca-294e-4e8d-94f0-ef8de61ff012", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777459079, "uuid": "25aad6ee-5817-4862-90a9-4b86aec42fb6", "value": "115.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf444e9-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494645, "uuid": "f9dadb2a-6f8b-4615-b83c-ca97eb466a84", "comment": "Malware payload (Mirai)", "value": "37dccea705ef38aaade610f6257b0d6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494645, "uuid": "f6dd26d2-c543-4ddb-ab6d-db53a0ebf39b", "comment": "Malware payload (Mirai)", "value": "bcc60e03c48fc907e3f48b7858702a71d6defbf455f279d2a43e78340e9afb00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494645, "uuid": "ec72e10f-4514-4639-9489-b043eadc7f75", "comment": "Malware payload (Mirai)", "value": "be3ae56c494050315cb40474fa04f5dc3c317085", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494645, "uuid": "15238870-eaed-4130-abb4-9aef41733f47", "comment": "Malware payload (Mirai)", "value": "adead2dfb436dd3ca407b9ec910d1965fec1136c26eb01de04cb1bacff1733e97cacd604e2c966db95e038a26f602553", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494645, "uuid": "b485ea25-19d4-4b26-a5c0-153c618ebb47", "value": "T1A89329227E761F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F246C032577B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494645, "uuid": "72dfad0d-5229-4b1d-ad5f-489dc0db9ecf", "value": "1536:5y8MSzlPyzhCJuWsZIJH11SYIZDptbwgENWq5+/sAlhEtZr:5y0A2j/SpVBJENlzRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494645, "uuid": "f5efcdc9-b66c-4c6c-9ada-fa7656227bee", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494645, "uuid": "1d5bb3c7-4a3a-4e9c-b31d-226634414bba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494645, "uuid": "e6dda957-5395-46f3-bc44-3cdd3c44aa71", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b84f6f-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440652, "uuid": "5818c532-e040-459d-90ff-b4f0417fe31f", "comment": "Malware payload (Mirai)", "value": "79346d459554991d561772438318dc8d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440652, "uuid": "8bca38be-ddc0-4f31-b420-afdde21c020a", "comment": "Malware payload (Mirai)", "value": "bd0238788092fe8872413ad5ea27c52825f0761be967e607b7969d59b8faf51b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440652, "uuid": "9075ca84-f228-419b-b57c-13705d4b84df", "comment": "Malware payload (Mirai)", "value": "ee14e5c4965b159e5e365fa15a4522617294b25f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440652, "uuid": "52ddd0df-57b5-4e13-8c1e-e066c6a4f244", "comment": "Malware payload (Mirai)", "value": "aef8c692fadd0261f851f973b32eda228ba387ba6ee944e868e4b73f022c9aacc6bd0482dc917075acd32e94c4bf4925", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440652, "uuid": "12171cea-92c7-4979-b696-4d98119ecb2e", "value": "T1686302E01BB1178C5676E8753ADE305F8124522B32DE29142DA791CEF81B2139573EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440652, "uuid": "60ed7844-5932-4a60-ae35-e1e96ca311d2", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZd:8D+CAXFYQChaAUk5ljnQsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440652, "uuid": "c707d0af-04da-4a85-a992-162305b81a4f", "value": 67788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440652, "uuid": "a0b87f0c-c378-46f0-924d-df79b1637397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440652, "uuid": "0afbbf2c-f3dc-4353-aded-9149a86021e5", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39def8ca-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455529, "uuid": "50289880-9ceb-46d2-8294-9768134da7e8", "comment": "Malware payload", "value": "0a0a94501fd8f1581fa87e9150c80c5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455529, "uuid": "dc426f5e-534c-4b76-8aa3-bfd1983e7841", "comment": "Malware payload", "value": "bd7e0607a45878de6e0139346c3d428e89eee94a81804aab0e88f306b24498a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455529, "uuid": "3a8a61e0-be8a-4bec-9c3d-76c9388e9ba2", "comment": "Malware payload", "value": "a7be6093b166d6d5f3c6ceb9771afb633e90d1a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455529, "uuid": "dc158d72-17ca-4558-a026-fbceca8707d0", "comment": "Malware payload", "value": "96ed83fd673f985a2b328093a4c84d485f685c16ed6ba910b4381fb71f95dd69d8885c0d6f98ecf98d03b7e8ef65c1b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455529, "uuid": "093a8863-2c0f-460a-b547-86f66926be31", "value": "T14F3723005FD41DAFA9FC3255289B9ACD2BA54F11408858E27DF2311F735EE1BA0DB17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455529, "uuid": "8198eeac-0d4f-48c9-b980-8174981129a1", "value": "49152:LuFruFruFnuFjuFuuFEuFPuFAuFtuFduFmuFWauL60uFJuFfuFQuFcuFfauL6ruY:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455529, "uuid": "3c20eb43-feed-4a16-964c-205cd16a0ed2", "value": 22903945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455529, "uuid": "621bea9a-8003-45e4-9890-a8ef42f59856", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455529, "uuid": "88d51739-afe8-4b29-94e6-7d2c9c90ff7a", "value": "invoice-1645080830.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43725324-43b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777458122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458122, "uuid": "54ed6c0f-23ec-478f-8d60-52c38e069510", "comment": "Malware payload", "value": "ea1c68edc4e6c1921a0de9da86ac694c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458122, "uuid": "7a9869c2-0e7a-4ab1-b3ea-f77b276df75f", "comment": "Malware payload", "value": "bdd328a55731c463f605f37df9f57592c82fb8583e455e0ac9b181abd3b671ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458122, "uuid": "3b9de92e-02b9-4724-9d92-8ecd9a1cf197", "comment": "Malware payload", "value": "e27c7a5579768dbd033bacc4b58e276a37b10097", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777458122, "uuid": "d031715e-c0cc-4886-81dc-a997ddb2657d", "comment": "Malware payload", "value": "7b1f62a42fe75b76c1a294113a153f67e44d5050e60cc8314e03eb14feff2078d24d51aef89d4239e8d86da6c15e5f4b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458122, "uuid": "1bb33c47-6050-49c4-8ebf-443d39b506cc", "value": "T1C764233AFFB29978F4AD92742349A740ED5081E80F486961149DCFBFACD7448F912CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458122, "uuid": "e65303bd-5882-40a1-954b-601f6c02a15d", "value": "6144:NswPQ6maj+O6IehD4XjEsJURNkVFjOU9Om8Y9tAOwEr5VM/:quQzajP6Dd4nUYOBm79qA5VM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777458122, "uuid": "83fca949-b2ef-4698-ae4b-9a1ee4fff63f", "value": 306867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777458122, "uuid": "83aa5481-bf9c-4c05-a49f-dbee678a823b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777458122, "uuid": "aa9f3d86-ee05-489b-9783-7d30488301f5", "value": "website brief.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46762ac7-43c5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777464999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464999, "uuid": "2c5aabe7-7e63-40f8-8cbb-7a261fcda638", "comment": "Malware payload (PhantomStealer)", "value": "d18e6f0dd8a71742fd07125ae6fafcf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464999, "uuid": "9a81cc0b-8374-40ae-b6ba-3f08ec308ee0", "comment": "Malware payload (PhantomStealer)", "value": "be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464999, "uuid": "ab2c1b59-1217-495a-aff2-348dda5da064", "comment": "Malware payload (PhantomStealer)", "value": "cb6d9d1c6aba200d0a2a45be3d474604b2b11861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464999, "uuid": "6604a750-9518-4737-88d0-d32d1da46b44", "comment": "Malware payload (PhantomStealer)", "value": "8dfe0f3ca2a36d68b5269ce0c78ad91867324d9eafdb9f51e9729e2986f06f46abf4ce396d047ff772fbcacc39f6f433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464999, "uuid": "7470c349-4ddc-4b8a-84f3-1eceed227c91", "value": "T18C466C8CE558C2882CA1CF757EB275D242DA715B6D8E8732E43B41B1BEF3B825D1250B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464999, "uuid": "2f207d0b-dc74-40a7-a023-8475ac5df256", "value": "98304:nfW++hIzoA53RLRaf4nbPCN1CWtc3lZPBAc6dz3dT3kmeufTlF5K47JLbayHohoo:nfWwzDVRLsfuqNVOlZPBgxDfpFIuJRgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464999, "uuid": "cd0268a6-5408-4a03-995a-2ccf101335c5", "value": 5551811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464999, "uuid": "b369b032-b404-4c5f-b9d5-8709f3f3703f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464999, "uuid": "e6ca38b9-feb4-465e-8b2c-cb67e1fff497", "value": "RECONFIRM BANK DETAILS FOR PAYMENT_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e62fb04-440d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777495909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495909, "uuid": "31c84ef5-c77d-41bd-9fdb-656190b8cebe", "comment": "Malware payload", "value": "550ba2afbf15a88e32db5f0a651c225b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495909, "uuid": "8207cbd1-6bf9-4c15-af64-9327efb5b372", "comment": "Malware payload", "value": "bea3c9d40cccbef25749dc72449e19cbcdb61602b64cfa47f6e250a3551a4dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495909, "uuid": "9e469012-acc2-4004-a8ae-a2e5eeb16fae", "comment": "Malware payload", "value": "aac90db3bbacc8cb1aa5cca59681b906708b3530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495909, "uuid": "cf26e2ee-8d17-4a77-9058-336a05ea4499", "comment": "Malware payload", "value": "d3de9ea283a158c304e5260a4476df3481399c15eaf765dc1a733db8400eb1df7b45234c871b62f5cb2a9bb298ba0830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495909, "uuid": "a6ca00c1-9003-4ad5-a02b-e3f002e75824", "value": "T11D064C31324AC52FD96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495909, "uuid": "47be1413-c74d-43c7-8f49-12bc697f84d7", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495909, "uuid": "f6e5aa39-bf61-4eba-8d99-ed30510f00c6", "value": "49152:hWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l58mGPAELcpB2MpF8j:hr99u4kc8Hao8eRjYBU4UAir2Y5rGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495909, "uuid": "f0a96744-6c9b-4a07-907f-82a1c833650c", "value": 3690986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495909, "uuid": "4a7f65e3-7084-4542-9e96-35220d5ca0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495909, "uuid": "95a60973-2f6e-4fc8-97ea-cbb2aad9374a", "value": "mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be72839c-4400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490541, "uuid": "cf27976c-332e-4caa-9129-c871c3c92932", "comment": "Malware payload", "value": "e483997c0f83295c14266e33cd20d622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490541, "uuid": "8218fe38-8595-4074-bd2c-adc60f0f28a0", "comment": "Malware payload", "value": "bfabf6b30ec27d6e5a267072e2e75deea7afbd197031c7704f0d708a4d129030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490541, "uuid": "06a63428-2e3d-4f5c-9544-7076d3639891", "comment": "Malware payload", "value": "fceeabcd005ac6e0151609edd721802ee7833b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490541, "uuid": "65b7bb3f-34a1-410e-b583-0a9b0e326d7c", "comment": "Malware payload", "value": "7cb948c845b77ab4d9ff781027c28f57a068d9486a4b6cc5933a90454b8d18e405ab648c6750c53d567177e18e811139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490541, "uuid": "a0534cd9-a915-4513-97f9-5bef13f6955d", "value": "T125677561D1092E4ED6E4EB268D94DBDCAEEDE5D169E7DF4140002BC627CBB1218AF0C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490541, "uuid": "ea98303c-a345-4b59-82cb-b588a35962ca", "value": "37b82a9148f4574aa87110663b36200e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490541, "uuid": "9b973abc-4287-4802-8241-9784a9c4bbc0", "value": "393216:Gmv7Sz7dPR+KXOnPlpSiOWUoXohIaVI4j02I0DxwyhC/d3TAIxgmJdD4++NRWKW1:G6EQPX/UthH3I2rxe8BmXVd05g9dbAC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490541, "uuid": "b56a6095-48d7-4b19-874d-f5ba90b26983", "value": 30431882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490541, "uuid": "f8ee2d10-a015-4ee2-802c-6fe3377c1403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490541, "uuid": "acc8ae2f-6dcc-47cb-8067-e7c1c5d46a0c", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd92f6-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455603, "uuid": "7d9bc2af-d645-4fd8-81f0-c26643b83ef3", "comment": "Malware payload", "value": "e42685a0147c510b933c2cfe9b9d0230", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455603, "uuid": "25bca6bf-81eb-4666-94b7-55a1b29c563d", "comment": "Malware payload", "value": "bfcdaea81b099b1a9f0177ba4aa92baef7d2ca85b1297be6a881f759e882ae2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455603, "uuid": "f3cc9544-1e66-4bef-92c8-9248ef7addad", "comment": "Malware payload", "value": "04b00f83e286948d4d729adedd1d2933d1d8ceaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455603, "uuid": "bcdc30c3-c5d3-4e49-bbae-9299d4fcdf49", "comment": "Malware payload", "value": "648e45940a0bf6b5ad6dd662fd21fd358094ecff885649b76084df463244482f6e330c40b10807f80de72327f68543d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455603, "uuid": "b1cc2be4-37da-4d31-8157-d0e5b73cdcdc", "value": "T1B43723436C950E5AC3D01319307A1FCA1F6CCE8059F19BB96AEBCC3DAF6491F52A4276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455603, "uuid": "5e1e276f-d861-42a2-ae09-ca61cec464a0", "value": "49152:61PqorFVZUTjjZoyxtnC3KiMnhonsxr9znxSCrX99Ohly6/jLnTAc/IVy/IhMCCi:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455603, "uuid": "162b0906-bd3d-47d0-b15d-28fc31d77044", "value": 22643794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455603, "uuid": "584fca7d-52bc-411d-9d4d-d58373e5ad50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455603, "uuid": "21beeff4-bc30-4f78-a009-1124a5bcc8e7", "value": "invoice-1645080830.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5f46dc-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440315, "uuid": "a5306ccc-4075-4b67-8e02-c484b792a333", "comment": "Malware payload (Mirai)", "value": "5b176f31b7d174390530f40b4e242803", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440315, "uuid": "4946a887-ea18-4a16-bcd8-eb77d06141e5", "comment": "Malware payload (Mirai)", "value": "c09933888dfb817d8d9b625f54f1845329a6f19d1acbf201863978c658ef01b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440315, "uuid": "8f4b5f51-9d6b-45e4-8175-be75cbf70d9b", "comment": "Malware payload (Mirai)", "value": "ab364155e89eff501e35f02234521b26b3e6667e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440315, "uuid": "53a4695c-9587-4988-86f3-cdfccd14d670", "comment": "Malware payload (Mirai)", "value": "dcbfe8453e75579869aeb1e492cde153a04532e2e5d1b57e88725bd770cf27fd0e8999e55a20309b7f6970de96238119", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440315, "uuid": "0601ad26-0d22-4f87-8b7e-30a5857e5c6c", "value": "T18FB31945FC505B17C6C252BBFB4E428D7B2A1768D3EE720399256F30379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440315, "uuid": "af862637-447e-4a1f-ae99-8bfd40b3472c", "value": "1536:YGZ6OjrPA8C+Uq4VtbXJTxt9vPEKOO9rb1hw9ZNqWRPlDHwywyshGz7N7ZOLqEdA:56wrPuq4jZX9vcW1hebl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440315, "uuid": "eed2e49c-c4e7-481d-8272-9e38c6f0a3cd", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440315, "uuid": "dcc5af18-4695-4756-9ace-490c1ccf51ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440315, "uuid": "f58dd323-1ab7-4ada-9e99-fc325f3b7c1e", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda97773-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495317, "uuid": "4dde18d8-13fb-4bb5-ae82-1bc4c5d28ab2", "comment": "Malware payload (Mirai)", "value": "fcb9d91f3f4070e3b2ee3365133fdfd7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495317, "uuid": "bdab8715-3930-45c8-89eb-620399ad3336", "comment": "Malware payload (Mirai)", "value": "c0d53d83255edc74630d9bc34f978041a02155003e9ad377052ad80e0e2819f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495317, "uuid": "b9f6deba-a29a-484f-b4db-36bbd29c978c", "comment": "Malware payload (Mirai)", "value": "6154baf5ae07d2b2f36c9fb640ae1a7c1c867480", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495317, "uuid": "846fcdab-1afd-4bc2-a83f-79665c112dc0", "comment": "Malware payload (Mirai)", "value": "0d84b884b06258a5fe2d3ba87c8ffb807b984698421497d446a654bd750ebe90b2a278223379018602f13b5f5ad2ce56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495317, "uuid": "5793fb70-2331-4679-88ff-c5d7b52dcd72", "value": "T15B730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495317, "uuid": "517c97c8-05f3-4476-a4d4-9cb99887f3a9", "value": "1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u8Lg:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495317, "uuid": "4f2fbf9c-14b6-4de7-8b13-04f0f056fa4b", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495317, "uuid": "5fa7551a-2b53-4e55-b6c5-b0a23f0fd81f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495317, "uuid": "d9c98d79-5f94-43d2-bc34-8884c09560a7", "value": "night.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b35f14-4384-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777437216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437216, "uuid": "792e9a40-5385-4c2f-a0e8-b973a2e86819", "comment": "Malware payload (Mirai)", "value": "3adb4b2b1d832fa0adc64cc5858a25db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437216, "uuid": "8ed1861c-8ba2-4b3e-b83a-13562b195503", "comment": "Malware payload (Mirai)", "value": "c1b84e03d4f36780e9516eda728660efb42de3e96c80273b147fc6e5c9a52728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437216, "uuid": "c98030b8-1f0b-43b8-875e-dad0e4f4cd1e", "comment": "Malware payload (Mirai)", "value": "54b6f8237b207e610e8a860fbc9d94114cd357c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777437216, "uuid": "f257a81c-7a74-4d99-9d58-b46d646d2593", "comment": "Malware payload (Mirai)", "value": "6a6c497ae1e24a2a1220504f89c7ff00f8260edafbeb1df13cf8c8203ea7a216d1b2940f19c0b5ee8a5ca5d61575d5d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437216, "uuid": "58487e85-5c39-4bfc-9ab2-9fec25add961", "value": "T179332A89E787D6F0CC4305B0115FFB3BAA36B9A12334DD77CBE4BA63B8B16415412A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437216, "uuid": "e9306a3c-6224-4845-88e6-57dc2ee09537", "value": "768:3uG7flSwfkAGssosvfuDOvUxvR0sRlzhJdt9QgcpOYrmABjul/iE+nKPCFO+hTT1:3rfQwfZsRvfqfXENjulSKKo+hfRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777437216, "uuid": "c5bfb72d-783b-4028-8a2b-94544cf31d63", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777437216, "uuid": "c60e0609-fc3a-4f5d-b31a-0003eab2320f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777437216, "uuid": "cce62dbe-2a68-4c92-a3b6-9841b023b67f", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4181b046-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441368, "uuid": "c9d54c72-a177-49e5-9028-e22eb6d64036", "comment": "Malware payload (Gafgyt)", "value": "250940c8dd84748e94a3364833c3550f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441368, "uuid": "7910eab9-c0d1-4d8b-b4f3-0891d3eca7d6", "comment": "Malware payload (Gafgyt)", "value": "c20affaaad7b9adb2b264f1c74eee50abf69243bc1892ee83243dd8e3f8581a4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441368, "uuid": "f51af600-7514-4c45-bd81-7fe60e8c4e9f", "comment": "Malware payload (Gafgyt)", "value": "2800a92c0188b174c7bf2eac12c7deedf1f3eed7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441368, "uuid": "61a1fd8f-48d3-4c58-adb5-9297ee29589d", "comment": "Malware payload (Gafgyt)", "value": "c5b66859e4b26d3d8da5ef32c72d4f32998e6a538488041c690ff8204cd3053439ae225a3ec435cc906478ddbb88db2e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441368, "uuid": "84b3d5aa-2c12-4115-b774-bc69ee804f73", "value": "T17AB34A0758606F77C045AA7129F75930072BBA220F5F1B8A757DAAB4174F8DEB00FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441368, "uuid": "d14146c6-95b3-4ade-9ec9-54ba0a0a7eee", "value": "3072:FxmbUnP+Yza5LUMSEd5hLwoSCpLkC0Px9gQNfR:FxmwPDmyEd5hLwn0LkC0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441368, "uuid": "a4e767e0-46c0-479f-b29c-7fb35a06f24a", "value": 109055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441368, "uuid": "ce4eafe0-4d99-49fd-8b4f-e04ea9472dcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441368, "uuid": "481a24ae-7102-4b03-9171-bde4aaa4e03b", "value": "assailant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0297e1-4416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777499720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499720, "uuid": "c02dba34-da2d-4889-9357-ef484c072c16", "comment": "Malware payload (Mirai)", "value": "5499362b68b216c312f8024cbddeeefc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499720, "uuid": "fefc00c3-ad1a-4c52-b0f8-01a2f9806001", "comment": "Malware payload (Mirai)", "value": "c217d74d21449bed31d7a882a830b0b35ca7e1c9da1aa9d4d5ca1923e4401c93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499720, "uuid": "7e2f8099-09ce-4d10-bcfa-68c86613ea98", "comment": "Malware payload (Mirai)", "value": "af8280c4c7406bc87108b8906252297f07a61eb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499720, "uuid": "2760bb89-9321-4735-a2bf-1249811096eb", "comment": "Malware payload (Mirai)", "value": "28daf1b2d1d096bada8b91aeec2003c04bb43a36cc5f6e50e1050797e104e33d08ac9cfd1dfdb5a23e10e88c41d86f82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499720, "uuid": "7f24bd56-256e-42f5-a123-c90e48cfb947", "value": "T18E83E942BE429F13C1C221F6FBAF055D37166B79D6EB7242E9217FA023828DB0D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499720, "uuid": "cc9f341d-7b48-4d29-bab2-293821bcbcd9", "value": "1536:lmfruQUBxc3TjrC9nlQqKZkybmt6aBU0LUccqUA8Wlp5EQtTO5La:lmfdLjrC9nlQqKqYoBHLlcqKQ5WLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499720, "uuid": "95b6929d-81f3-4116-8ee9-77e6880c425a", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499720, "uuid": "615d4536-93f2-4665-8a7a-51342fea29f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499720, "uuid": "0ab76ce7-22f8-46b0-ab73-188159b3e8d6", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5167af8-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777479761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479761, "uuid": "88359ba2-f774-4e8c-97e1-1e926bc94148", "comment": "Malware payload (DarkTortilla)", "value": "391d06ddf4185cf073fe72e214dbe11b", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479761, "uuid": "ed725b23-1faa-46c2-a59a-518a8324815a", "comment": "Malware payload (DarkTortilla)", "value": "c25857bac82125964aa95c03e082e678e41639b0c9f3dbf849ac832e08dc1bac", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479761, "uuid": "96c1be79-eaf1-4423-ba09-65cc5b12cc89", "comment": "Malware payload (DarkTortilla)", "value": "0b120431bdac3bd24c7d0e00fdc51d3249a88457", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479761, "uuid": "e17c343b-591e-44e5-b0d5-81c9dd783652", "comment": "Malware payload (DarkTortilla)", "value": "e5aebf9ceb553348a55b2ebc8f21840ecbb6e4d1bc5575ec772fa21d5f36facc508b5e9d6e6a4be4a91d3e399aa8bab4", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479761, "uuid": "ebde1b3c-0d33-450e-8896-f856fafc62bd", "value": "T17585D0166DC35AA0C6644B79D3E680BC23F04B6B9311E7AB39C412F4DF6176EB50B0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479761, "uuid": "0c8bde0b-f0bb-4795-bcf1-767c59bb87b1", "value": "24576:NpwTDXZoQGE+JiCxUMbrRa3Tx4cV0dhiH8v:NpYrZZYxpbtaehOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479761, "uuid": "d1575519-282b-47dd-bb87-97982d0dfec7", "value": 1775104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479761, "uuid": "a2df7e3b-24dc-4f58-8711-dce3b09b284d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479761, "uuid": "9e9694de-3096-4c2b-b4ed-694cea22a1fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315c66ab-43c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777464534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464534, "uuid": "0f9b6acd-7b38-4be8-96d7-29e304045598", "comment": "Malware payload", "value": "132e63566c7bf3054b664925b8fac201", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464534, "uuid": "342543dc-4207-4adb-a52a-c73b9324b001", "comment": "Malware payload", "value": "c26cff2f90f7a147248d29d03a63cc31105ae3b8e1ceeba0d9b1d33c2a14bb82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464534, "uuid": "1085ee64-c588-4cf1-a6a0-fc2146a5f51d", "comment": "Malware payload", "value": "61ea70d606ec16da39db9580c86746d5aa2d5bf6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464534, "uuid": "e8965cd6-0177-4fc1-a720-9e514970cb6e", "comment": "Malware payload", "value": "3306fe370808c160aa3f6b64102066cc7c64fe71dad4802a82c04baa897ebb2bc6e28b06b8f25ea30a32e5dff7324c46", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464534, "uuid": "d60619b3-164b-42c9-aaf5-8f429787043c", "value": "T11111653E3C7BA554D84FF13C2167BA481D80465203496794A58ED9642AD5980AC9DE74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464534, "uuid": "f98cc936-aae3-430f-b9b6-267065595639", "value": "24:91mYz63gM3t/fiJk89wpIPp2ChppbJhfkU8Czn5sf46J7sX2aRGm+:9YYz63ldniJV/46Xs3Clm46aBRh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464534, "uuid": "2852a357-651b-4296-9429-12f167493b7c", "value": 1031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464534, "uuid": "3bc737dc-5e40-49c8-bbd1-94bff35bc8f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464534, "uuid": "da7c1afb-6fe9-4332-9913-8057bd5d1de0", "value": "my_video.MP4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6f16e1-438f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777441954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441954, "uuid": "b6f80f32-e5f3-4dc4-924a-44d1bf228380", "comment": "Malware payload", "value": "0f3232417b9783eaa8d2bed373c615f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441954, "uuid": "ca75c375-26df-473c-b9bc-7d95db1e712d", "comment": "Malware payload", "value": "c30be98012198164f0d14f2ddf084b41775ec4eaa211cb3347a4cab72f4a67f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441954, "uuid": "7fa9ba39-b743-4ca6-9e6d-e090db18a5d9", "comment": "Malware payload", "value": "91ec5e0f9db4b33a80bf627c157429e92dbed2eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441954, "uuid": "fa41d94a-adb6-4d8d-a380-80c5f3b7a5e7", "comment": "Malware payload", "value": "5c84456ac19877bf373b162ce28712e344b97b36c1884863d7730aa2061975697c626aadf642b58993356c64a311e317", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441954, "uuid": "81d793e7-04ac-402c-9a9d-050a53a68b7a", "value": "T163259257E6B691E4D8B6D0389662722BBC713859833897D79B809B074B71FF0E93E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441954, "uuid": "8ba4c0ee-89b0-4ccc-ae03-46ff1854b200", "value": "96bf92497d0111d646099ea1378d3eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441954, "uuid": "a6946f41-db09-4dd3-a654-0eeb4a58676d", "value": "12288:LuVzy0oExSXwDc2ncOVQlvL7rF04OqSxoT2EEY58RVp3Am1:uzy0oExqgcOilvL7rFCqS2fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441954, "uuid": "1e621761-7b08-4ee5-97ff-b37a26ab8d24", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441954, "uuid": "27322adb-e0ff-471a-98f3-5f05f7a81a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441954, "uuid": "1e1717e1-b2d9-44b5-b349-ee2397f15b35", "value": "64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6405d30-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455362, "uuid": "3508bf0f-d394-4dde-9bd6-c7f4ffe8e13b", "comment": "Malware payload", "value": "74c6a2cfb1ad35656c95b16f720719f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455362, "uuid": "220c4d05-3659-4a33-acc2-c4f1535ddbb9", "comment": "Malware payload", "value": "c3889b97a9786a609460d142280657659548f61e754984bd649a6798669a9999", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455362, "uuid": "49546c1f-93e3-4a91-aaf1-c8820ca99d6b", "comment": "Malware payload", "value": "3c37923a988005efe56adbd18dc131d2b73b010a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455362, "uuid": "7ff06b13-f1c2-4d11-9b04-9b71b04b5e3e", "comment": "Malware payload", "value": "6800287b4936712574cf5b2682a106227c64966099b3f1d0f3cead240c059de1ec6a3bd6e662c73d6915525bc86749eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455362, "uuid": "7a66155d-a55e-4558-b8ff-a0af76c25fb8", "value": "T10C372304CE1F8E148AE436813769CE4A0763EE50D05066FFB7BB781E9E9FD5461E3268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455362, "uuid": "16130d5b-c169-4857-83cc-48818fb36ad8", "value": "49152:MYrwBczYrwBchYrwBcdYrwBcWYrwBc+YrwBckYrwBc7YrwBcVYrwBcDYrwBcZYrV:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455362, "uuid": "db0749e6-64be-46d7-9c9f-769f806ba364", "value": 23944478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455362, "uuid": "2a6ce488-09ec-4dfc-97f5-11cdff24530c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455362, "uuid": "03792ccd-c80f-4338-99aa-92924c9d3c95", "value": "invoice-1645080830.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2c8ea8-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455534, "uuid": "2b69c38b-5779-4fb2-8af2-21e6bb630d39", "comment": "Malware payload", "value": "8bc73770cd2a1e184003334ccbf5e56e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455534, "uuid": "36129a69-386c-476a-af5d-4f46ddfab963", "comment": "Malware payload", "value": "c39aa2b58451a2639271e0b721347475892db067885fe74abbcf6b69b6db4eca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455534, "uuid": "4439e21a-9ec3-45a6-911f-389c4cdee249", "comment": "Malware payload", "value": "3a620b2c943f919026f7c5ed650265b07c7b954d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455534, "uuid": "51659e2f-0017-404a-9b8e-79abd34db85b", "comment": "Malware payload", "value": "0faef177b431cab8f59440c4c584211cd735349c79775e3483751b40f8e70d8af7c838688355994499ed42820492af16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455534, "uuid": "14462b7a-c69c-4340-b237-2e9df32fdfe3", "value": "T16D372356EF59263F447C36CD71BA4E9F5FA14B0A6C082F9A8A37BC01934E709349E46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455534, "uuid": "e07f31a0-d764-4a96-a4cb-e0de32fc1e04", "value": "49152:xHQH9HyHsHzHdHzHaH0HZHQHRJOH+HmHvHLHBJ1HXHVHQHiHlH9HBHnHoH7HTHUL:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455534, "uuid": "07748a86-edcf-415d-83de-9a9edb9347e8", "value": 22903940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455534, "uuid": "6639db18-a84d-4df8-8c06-1d0b80c49741", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455534, "uuid": "c9df0c35-2b1a-48de-88be-2d3967834506", "value": "invoice-1645080830.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba348b8c-43d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777469918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469918, "uuid": "ee14739b-25a3-46fa-8be2-dcd61a5e4332", "comment": "Malware payload (Gafgyt)", "value": "ac95c8aacf37f72015c329290e1bce10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469918, "uuid": "be1bcb4b-38d5-4c9e-843d-32b9545d0e65", "comment": "Malware payload (Gafgyt)", "value": "c40f306e55c66048e962b1b1af7ad4c988671051e57da84721379adf7e156254", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469918, "uuid": "628a1e0f-f664-4f50-8db1-ae1ac6cf108c", "comment": "Malware payload (Gafgyt)", "value": "6f44700d38c53242671cb4ea0424e1ededa80ae5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777469918, "uuid": "93d3342e-87c1-47f0-b0cc-2d02d09c590e", "comment": "Malware payload (Gafgyt)", "value": "c3bf0f1425c4d4761496d3bf439136ff8764cbf084b2fbc5d95c6e5542918d503e2784aac030ac7e156a004bd04651fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469918, "uuid": "838c3b20-0742-479e-81be-92dcce4c9c57", "value": "T1B5256A223B11CFA5E355D67009F3C6519AA624A217E2408AB27CC72C7E6172D6C5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469918, "uuid": "c0f1d9fc-a41a-4b92-a163-7955add8bb0e", "value": "24576:94wCnTymmXVQdoVZSYzrhUa7iy02AMsNZWO/ROrXK:94wADoVxzrhiCeZWO/R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777469918, "uuid": "e0b5c73f-6076-4f68-b30a-9af9e58b108d", "value": 970580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777469918, "uuid": "b3b10c56-e00e-4ca7-9b19-313d2c1450be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777469918, "uuid": "5a7f578e-43f6-4bd2-b1f5-565e3bc76b4e", "value": "x.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4515fc40-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494632, "uuid": "e85e23d8-fcb6-43f8-ac70-552072407418", "comment": "Malware payload (Mirai)", "value": "bec53d6301071317dc6641a403b42ee2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494632, "uuid": "ca1dabfa-4693-44f5-a994-01b6e64f324d", "comment": "Malware payload (Mirai)", "value": "c43af098ea01362628f7b17447e2e040ab74858a5f8fc508acfe50024c5ef6dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494632, "uuid": "21b0e434-8db3-41fd-81e0-639c0884c709", "comment": "Malware payload (Mirai)", "value": "b8ee6bff7f70edeee144fc9a99d663beb6a8e755", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494632, "uuid": "65de7e95-fb84-42a6-b9cf-f8235245d0de", "comment": "Malware payload (Mirai)", "value": "5af24b3384c62a84e438de97a23d5058bd5d4bf4797a68721faf0d7bb10c3bc4d94bc9bc1b0ec5a196387d9829e0838a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494632, "uuid": "4a142f5b-d947-412f-a886-7a7af9ab29d9", "value": "T18DB3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494632, "uuid": "87fe5f46-ce12-4c4a-b3d7-ea4f04cc2fc8", "value": "3072:hqiKVqVEpOFnYfG/7/0lZYz4BmnlsQatFbR17z9c7YfNpg0w0zeyf:hqiJPdYe/7/0lZYzWylsQatFbR1Vc7Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494632, "uuid": "6329e36f-475f-45e7-84e6-9ea01b81c6cd", "value": 112648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494632, "uuid": "87e792c4-b35f-4816-82be-93665011613d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494632, "uuid": "72798bb9-4ba4-4092-9c7f-afe84bbd27d4", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104aedf1-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455459, "uuid": "4d3243f8-4eaf-43bf-8945-e58e5809ce57", "comment": "Malware payload", "value": "6f369663d35b13968b9d5324fb09aee2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455459, "uuid": "1ea1e587-1370-4083-9bcc-5c5acf21acbe", "comment": "Malware payload", "value": "c52b70a944ed629ab2fe172dfac20e2ba0f75fb9712b8f1ad3f4b9ed11157be4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455459, "uuid": "d1bfc240-fe5a-49e3-993d-3b764d9045c4", "comment": "Malware payload", "value": "e650ed64e4f68dc471ea33f2d53dca0eb08a0c12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455459, "uuid": "65cc608d-0aa8-432d-94ba-11475cc5c3e5", "comment": "Malware payload", "value": "d06d73a125e136b25e7b1eb9596286eae89f038b7f677bf9328dce7d84677e7fd5df85652f21ea07f254934173c508b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455459, "uuid": "39029d67-ccc9-42c3-8ebc-b7302ae5e7d5", "value": "T1293712D27DAC8B9F53261B2C377E164F0BD08F8595940A96B6E1B8A34BDC528385F0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455459, "uuid": "2295c0e2-2480-4cfb-a704-ef7f4c11a015", "value": "49152:nBLUWBLUdBLUfBLUZBLUqBLUUBLUeBLUPBLURBLUUBLUlBLUp7vBLUoBLUVBLUtQ:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455459, "uuid": "6402b3ad-644a-4ce4-91ed-660417166b67", "value": 23424209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455459, "uuid": "1b9076b2-d9fc-4d05-8636-ea6d4c01cdb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455459, "uuid": "d1e14d79-6578-4388-adba-14b6de54cc33", "value": "invoice-1645080830.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f9ad33-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455465, "uuid": "660517ba-55dc-4c62-a177-fd10c4a55b41", "comment": "Malware payload", "value": "732171b7f523dcf65313cfd79887a38a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455465, "uuid": "e02c2b02-1b7f-48e5-9959-252b4d3d9add", "comment": "Malware payload", "value": "c618e55c30b1b637894f6eaebc081fbcd3dc8fa0afe4c2cba90753f9213c2f51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455465, "uuid": "4e7b370e-aa06-405d-af5f-efa039db9925", "comment": "Malware payload", "value": "7e4943fd6da3d2568b448b5fd63fce664537cace", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455465, "uuid": "8a94acb3-4c62-4d47-b6d4-a388e60c640a", "comment": "Malware payload", "value": "33ebc495c13b5c5e32953dc9a965c3aae0dc80b2f082c8bb838ebe5d4cd17af62156a13cf955eda38a06bb954153b966", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455465, "uuid": "7e290cd5-b2d4-4c79-9176-f931e885164e", "value": "T1F43723044FBF177D6BBC18BC09B60FCBB8A42D01109CDE9BAB6D35664A6D925344236F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455465, "uuid": "27310641-b13a-48a3-8d8a-c6318f66bdcd", "value": "49152:IL6ZL6oL6aL6wL6HL6VL6NL60L6EL6DL6KL6GkbsL6TL64L6WL6aL6RkbrL67L6n:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455465, "uuid": "55262c54-f9f3-45b1-94a9-a201f2999095", "value": 23424208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455465, "uuid": "7d7690e1-cbcd-4f22-ab89-bf98fac8a139", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455465, "uuid": "263f9b1e-a6e1-43e4-8acb-b12c2814029a", "value": "invoice-1645080830.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36d10d6-43ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455411, "uuid": "2570aec6-c2b0-4f77-98b0-42d786de4c7e", "comment": "Malware payload", "value": "5dd80a1e09bbac427a2c2536c600dfd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455411, "uuid": "97fcc4db-6988-4360-a80f-019304604122", "comment": "Malware payload", "value": "c8080899b67609e0ed66983c97f96713fa746f5f0975934ad885cf75b0ecc4ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455411, "uuid": "d37d4845-13c5-435b-8c16-723e4beaa8d0", "comment": "Malware payload", "value": "f9bdb46af557af8c3b6ea9e3fd652c5c4d5114f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455411, "uuid": "6688971f-409d-4f39-9ca8-4aec1d65bfe5", "comment": "Malware payload", "value": "61e48a1472f201a00e9845cf7310945ad4027b1dfedad39d4c95597c8915621f0bfc767c3f6147ebdbacf6e6168458d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455411, "uuid": "e3956e01-9cad-48d6-979d-e510043539c1", "value": "T13A37234B8EB9EEBE816C375C04B79F4E057213645477AA6C225DA5EFB34CE0C20E35A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455411, "uuid": "910ad3a1-01cd-4ccf-adce-d3f831551654", "value": "49152:NWFANuSxWFANuS+WFANuSxWFANuSbWFANuSOWFANuS8WFANuS+WFANuSHWFANuSU:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455411, "uuid": "8c314b75-facb-4ae7-8f3f-bd647791d990", "value": 23684346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455411, "uuid": "e61084c2-d759-48de-ba30-f3ee8435cab4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455411, "uuid": "ab86829e-c635-4393-8ec4-da7dd0a4aa0d", "value": "invoice-1645080830.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16eb609-4368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777425262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425262, "uuid": "d113094d-e39f-46df-9e83-140eaa031fb4", "comment": "Malware payload", "value": "8362f76455a64f2fca72eb5070c2fced", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425262, "uuid": "1c28faad-c7b1-4e8c-acf4-b4898ac0598e", "comment": "Malware payload", "value": "c87d531e23597afc063a5c5df22421865533aa6bb742487f8c7a32ff4961fbc9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425262, "uuid": "164a744e-d139-47ae-97cd-fd8d596eaa25", "comment": "Malware payload", "value": "d1964c28436b15879befe44970cdcfff5817cdf1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777425262, "uuid": "a776bf19-d380-452c-8a34-d8eb49119f83", "comment": "Malware payload", "value": "97ebc5fca6faf6396a5fa638ff8f6b7f43d209f475f793e127d500bb922ebc43b9eb2687f5a78247eb18c8566dfa706c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425262, "uuid": "499bd787-8016-4355-b66f-fd3e2773fbb9", "value": "T19821EB234503C3B603F75A9FA8106109EE6B37BBF5496810B8ACC1052BE467CC122BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425262, "uuid": "ba68c859-440a-41bc-95cb-212a527ea45c", "value": "24:oJaUy9NcJjss4EPGWyrzufvI1SiwCtKDaNm8I8vDT8xZhS4CfISX48:UUmt6e4SI1dYaRrg/hP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777425262, "uuid": "657af51f-1b66-4544-829f-ae7b2c8fb3e6", "value": 1314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777425262, "uuid": "b84ac855-cdfd-417f-92f4-9562ee037f3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777425262, "uuid": "f04f887f-f7c0-4a5f-8b14-1c0d05764940", "value": "kkfbmw.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1af2608-438d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441234, "uuid": "80ffdfbd-cc99-453c-ace5-56fcaf45520b", "comment": "Malware payload (Mirai)", "value": "d21f4f861b2038d1fb0decc0ad0e32c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441234, "uuid": "993b7a1e-9656-4c36-8161-d447c8ec6b67", "comment": "Malware payload (Mirai)", "value": "c8a3e4273574ccdc175bee4133b96f49db1620d7bee41cfcd841a88d98a38339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441234, "uuid": "6ea35ddc-5be0-4ed1-8c4e-b41169806ccb", "comment": "Malware payload (Mirai)", "value": "435bfcecb8e7a043ba02011972addf9633d46656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441234, "uuid": "cfef1aee-1ce6-4d5d-a21a-e058d1089eec", "comment": "Malware payload (Mirai)", "value": "fed31ff8108c782c96a24990473f5b18ab0b514897d0178e274086784c41cd9e6176d8ed5844d912d2767a4a2e20a090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441234, "uuid": "387f74b6-3612-4957-94ba-67530e0b9b5d", "value": "T119B2D0A4730049EFD93AD2B54BD503422BB50FF0D7479C263998F593AE8046A3987FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441234, "uuid": "e827190a-1bc5-4a67-b88b-bcf3a2c46dc6", "value": "384:nxnVrIxpRpw2Q7Gv7Sprn0M/zmKeNs0hv5DBJgGlzDpH7uNj1JZS+:npWxRw2Q6v7an9/qNs0rdJgGlzDpbuR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441234, "uuid": "d6dd682b-f390-4724-91ae-0c65405bbdd2", "value": 23824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441234, "uuid": "636be31f-3dc3-4b0b-b54d-2808fb7249ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441234, "uuid": "4e15da25-29da-4a99-b45d-164f0f2cafb5", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600b0635-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1777479645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479645, "uuid": "575f8ab1-a555-4650-a688-0d3cb7a9e14b", "comment": "Malware payload (Amadey)", "value": "f16f3cc997247de5c1cbd9927c86f78e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479645, "uuid": "c436cf03-ff3f-46a0-9891-ba9063e7e5d8", "comment": "Malware payload (Amadey)", "value": "c91e20371a7b292a5fd83e91d72d2042a5ae33aa45b14e5ffee21454b746ff5c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479645, "uuid": "cd2153c8-1f34-4178-b36c-05e33d10a728", "comment": "Malware payload (Amadey)", "value": "b60c563b3a39be25dbf4ab5e4fe54d59bccf322a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479645, "uuid": "5e6964f0-a629-418a-8701-8b40549b8d00", "comment": "Malware payload (Amadey)", "value": "cc39ee9ecb2bc967453394a1e051f95841cef52f1394b9de74f2305101e08b50c7a318577ee24221869358141574ad69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479645, "uuid": "9d0acd89-cea2-4b62-8cef-16a748a55e78", "value": "T160359D16B941C071D49401706269BFF2593CAA35672145DBFBD02EB2AD305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479645, "uuid": "7c2a8ff9-50cf-4ce6-adb0-6ab1e48f4c61", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479645, "uuid": "5d7e8fee-69f5-4ba6-a02a-57448f3cc716", "value": "24576:sLCrua2InCFeiwzFJEUoBmx43Bjbv0hzcJ31rT:s+ruaRnC0iwzFg36oJFrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479645, "uuid": "5866e8f9-6e57-48c5-8d54-58f7e8f8b7da", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479645, "uuid": "7726a1f6-cef5-40bf-be0c-26ad32d851d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479645, "uuid": "7e926f15-43b7-4728-aacd-8f51ec6a5116", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a68075-4398-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445561, "uuid": "d98c75bc-6d63-43ae-af36-9f38f1c0e487", "comment": "Malware payload (Mirai)", "value": "47aee7a185d19db921bfca50b2f7d6b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445561, "uuid": "bf91b0d0-30b4-46d9-be61-21814f27f1c3", "comment": "Malware payload (Mirai)", "value": "ca1f1e117af110cb5cd70af087123ee4c921d69d7ca2eb88120337498fe81735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445561, "uuid": "4908f0ac-a736-486a-9a3f-bcd5076dead9", "comment": "Malware payload (Mirai)", "value": "66654d4012db163834ae4757ca96e5c4f09a3401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445561, "uuid": "94c61977-0059-4252-8f54-0f30a65441a0", "comment": "Malware payload (Mirai)", "value": "d04218569ce1ab9de0acf3e63441044ed3b8d61a41254f9835de119d3f38befae9332ba688654dd9700ffae229e53295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445561, "uuid": "2ca3f506-cf16-4fe3-ac23-a5ca07b03d83", "value": "T13103F236C7BF5C8EE3A7ADBA7A50C586B7D05FDF23A4CE258362160137F21414A419D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445561, "uuid": "05429396-a345-4e06-9fda-f03f17e42004", "value": "768:rdeMw+2SnGQ4zK27c5l4V2WqO40BNlo0thjQSBUdCMwlgX4uVcqgw09KD:LfGQgvc5li2WqP0PQSLA4u+qgw09KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445561, "uuid": "ef1082ba-af9e-483a-93fc-ca4e1ac62281", "value": 38068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445561, "uuid": "163ef85d-caf5-4042-889d-b861bb7a19f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445561, "uuid": "6f28cb34-2981-4f7e-b4c7-8c6bc54b7102", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a15ba24-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777494640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494640, "uuid": "357ca58e-7e79-4988-9b1a-dd3e4dce20a9", "comment": "Malware payload (Gafgyt)", "value": "b9a00d3ddad761258f64176802786fdc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494640, "uuid": "138a9b40-a510-40ad-a2ca-3ed02637a9c6", "comment": "Malware payload (Gafgyt)", "value": "cad542bff9e93a7714294f644bb7e9433a9e80be5e5c08bc26ff5a249ae70b72", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494640, "uuid": "f95fa39f-7f0e-4067-99fc-a30d57fc8064", "comment": "Malware payload (Gafgyt)", "value": "0faf2a773590680b7a159e9cd392a96ee9341cbd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494640, "uuid": "ad990574-5341-40d3-9adf-bbfed76da236", "comment": "Malware payload (Gafgyt)", "value": "9b0bad91daf29626d9ae02b0919e063f68c04fdc5074632ff7987fd32910791feb82866226a154ad233f1a6bcd2ce0d0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494640, "uuid": "39199d5d-be86-4bc8-85c2-b6b3cf968ab7", "value": "T1EBC3B91E6E21CFBEF65A827407F78E31965877D72AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494640, "uuid": "7ea32c06-acc1-4137-9537-698af345b66f", "value": "1536:tw4lPfv7d7Y/YLpdYo1fpNeHvztsi8ZPDoM1ISWlKnKevNeThrF:7lPfDdMKdYo3wHvzt2ZPDoMCsnShrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494640, "uuid": "122cf11d-13bf-46b5-adbe-663cfd7e000d", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494640, "uuid": "b68d62bb-d1ae-4b23-a1b0-520bfee3a599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494640, "uuid": "85e5c914-4f90-4978-8e68-42c17c4b4bdd", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fd0358-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455439, "uuid": "58987051-b1c6-4cd0-8914-ef44702619e4", "comment": "Malware payload", "value": "611e2f5bfb939fb19afb40bbf01846cb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455439, "uuid": "d12f4a52-0e1c-4092-9c85-21364169b32e", "comment": "Malware payload", "value": "cc2aa1b72b2f7f85060e5b4cd24ab715b0ebd5a42f4d925ab6554a05678e70b6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455439, "uuid": "df256650-dccc-42ca-8c05-ef971c3def53", "comment": "Malware payload", "value": "ab6a2d2475f428a62653351193fa03b1390b07fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455439, "uuid": "dd5de117-c13f-4742-be86-505baef56f63", "comment": "Malware payload", "value": "f531542daa8951ddefc497f4e9b07a9fbc4ad434c25af2725810892532a457001739f54a44a1ab4854d53f0396d4caef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455439, "uuid": "e330b597-b713-48eb-8ecd-759fd7c41696", "value": "T11C372304297B9FAEC26D36DC882D280E5DDC5B4412066AEE77B22172635BF36183FD1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455439, "uuid": "98ec2689-288a-46b7-b828-477e59ca3c1f", "value": "49152:eorOorxorLorLorooruorOorborhor4or9orjiorSoroor1ordorevor3orXorEB:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455439, "uuid": "c16be59c-5609-49d4-88ac-c0ab5763c321", "value": 23684327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455439, "uuid": "ee00fd3e-21eb-41aa-8de5-9037d6618cc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455439, "uuid": "ded1e9fb-60b1-4fba-befc-16c3be44eb84", "value": "invoice-1645080830.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cf6d41-43da-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777474011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777474011, "uuid": "79d55721-f892-4638-91e1-78605022ae92", "comment": "Malware payload (AgentTesla)", "value": "6889a5b2616f3dc2ea934d67c41e40a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777474011, "uuid": "c76bc392-9d59-4200-a0a2-e4818d64a8c8", "comment": "Malware payload (AgentTesla)", "value": "cc3e0b23600bdcb58c090dc5d27ca89b18b27f59783a6c352dffaef0f10369e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777474011, "uuid": "a8aab648-b707-4279-b6e0-a9d2068232a1", "comment": "Malware payload (AgentTesla)", "value": "571cb3744cc5357b191413a767bcbc4710238dde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777474011, "uuid": "d2dfb536-d777-4582-91e0-23a4e72b487b", "comment": "Malware payload (AgentTesla)", "value": "e0533ddfd6b3406573b1fff3fe23eb9a8ffa7c63c5ed253ade470ed431b24405381bb587e8ea76c4268c43ef5f82b54a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777474011, "uuid": "009e98ca-97a9-4252-9f1e-358c2527efe7", "value": "T112642313BEFE34A14780A31CC5B6CD1B429032C691327E793B4E9F581A5FE4AA8F9D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777474011, "uuid": "4263e20e-d1a8-44ce-9450-90654799c19d", "value": "6144:QQ8L8pDAZXGw6fjejCgD2Q5nZvRJIv9+5doMzkLM/j1I0tdL9MQ:QQ8L/Z23fyjCgy0tIV+oykLgL97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777474011, "uuid": "95fd3fb7-dd73-422f-86dc-7b2d616f6f71", "value": 306861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777474011, "uuid": "3425124c-62db-4d34-ab54-33cd6bd47d5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777474011, "uuid": "df49436f-44fb-4658-9dc7-e44c7016c03a", "value": "ps_gYdiu7dmKWRR_1777465687660.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f011a3a-43d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777473576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473576, "uuid": "12245c96-d887-4972-8ab6-b5fae35ea58a", "comment": "Malware payload (Gafgyt)", "value": "512636c779ec5390e4e86bd1a0e8630a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473576, "uuid": "8383c5d0-6869-4954-b037-55c2da9af3ee", "comment": "Malware payload (Gafgyt)", "value": "cc4f64d64f71469e96c72abaf7525bb93c2cb6ecc81a1595a81e38bc8c996c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473576, "uuid": "ca1b7cfa-59fe-40a2-bbb7-c75013e5a436", "comment": "Malware payload (Gafgyt)", "value": "3c899ef578a94d3db9f71689c3411f13daeaf6d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473576, "uuid": "1e8e06cd-3de3-4ad1-bdec-684a83b5228b", "comment": "Malware payload (Gafgyt)", "value": "86a9fe6af12ad995aa28a44bfd0db04ed5bdef25a98b140685fdc60dfb23225396d076c65e0117c7f1327d6f20d33471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473576, "uuid": "a91d847e-ea38-4594-9208-f8addf22824e", "value": "T193D4BFA7F6261E03C4E3A63F2467C1655333E64613968706A70BF6BD3ED62398B193C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473576, "uuid": "1ba73425-cc67-434b-835e-2ee4e4361d71", "value": "12288:t4mqve0o557bLY4GNnaQNcBv70eCBDtuu6ofK78p5gCjEQKXsU9lMXBCpMxV3vm:tcs5O4GXEj0SCecXBCSxV3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777473576, "uuid": "e391321d-cb0d-4255-9f0f-9f7a0540fe27", "value": 656980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777473576, "uuid": "30d87549-7455-4c9a-aefa-f21f60d1a0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473576, "uuid": "36e54293-a370-451c-b5a9-7117e4fb9d45", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443501ea-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494630, "uuid": "6df7a17a-6897-45c7-84d8-26baf14713f7", "comment": "Malware payload (Mirai)", "value": "e64e36c4b6fb384747f54679f469d2b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494630, "uuid": "04a73dd0-98f2-424a-8f19-03f11220fe00", "comment": "Malware payload (Mirai)", "value": "cc5efe7c9b3e4c9a1bec25f99bd93cba7ab6e19a5ca336ca2eed820a03a76007", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494630, "uuid": "4e0a72ad-c9c2-4288-b975-33fc116b8072", "comment": "Malware payload (Mirai)", "value": "1846dfb939aa8a9ffafd867e406036d9d0f19ffb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494630, "uuid": "7dbc0689-b4e8-44dc-b336-9d1b9aeb35e7", "comment": "Malware payload (Mirai)", "value": "1ecc5544f16e422ca3a88376b3625582e076f36a3b748fc16b86b9ed7bb62e41a83660a364d78747bd7d08d6314fffba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494630, "uuid": "129cec07-404a-480c-9fe5-4e7f48aec7ed", "value": "T1CC83E942BD429F13C5C221F6FBAF019837266B79D6EB3242D931BF9023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494630, "uuid": "2eab432d-a399-46ee-a1c1-63a0743d2562", "value": "1536:PKDLhQ3BlLywjmConIxqPONb6uKBJw3Q2LKvDHytGwoUi+j0AnWPfX7a:PKDqXjmConIxq2B6uKeL4DHyOAW37a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494630, "uuid": "8a07ad5e-8caf-47e7-8b90-283952247ab6", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494630, "uuid": "1b60802c-427b-49ea-a5cf-cf8594276647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494630, "uuid": "8f64a237-9b8a-4c2f-9cff-e2ef024fabfc", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d352aec0-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495300, "uuid": "4a7a9578-8d08-4f32-84b7-158b43f23d12", "comment": "Malware payload (Mirai)", "value": "2dc62bf5bf7fb68cdd3ad571daf1a8ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495300, "uuid": "9b77a3fe-b07c-404a-90e6-666e43596bcf", "comment": "Malware payload (Mirai)", "value": "cd68b71c72e74fdf7125cc913631e70dc714980b754c62e50922e610f6bbe29c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495300, "uuid": "16475519-5828-4ede-99d2-5c0584e1b47c", "comment": "Malware payload (Mirai)", "value": "6baf92386348f52171b1210164b56de50ce90b7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495300, "uuid": "b25b6b63-a56f-416a-82b3-6b6eaebb1366", "comment": "Malware payload (Mirai)", "value": "37720eeb3d5fe7ed5a35154b79dbb2829c6e09ac108d6c4971ded3be874e819d4dcfc92c06cf8cc52abdcbd90869002f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495300, "uuid": "966bfcab-b19c-408a-8a8f-919340d6ab01", "value": "T13C83190377094F03C16329F0267B1BF097EABDA519B4B284756EBEC59271EF12182F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495300, "uuid": "6c4183eb-b206-40b5-a49b-130acbb452eb", "value": "1536:VLblgTewtHfOooI1Pl8Cce4Xe+2eDqs++mJvSZn2ikBIH3j8Jmc:Vy/WopP+FqKm/ikcTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495300, "uuid": "d979b1d3-cae7-4e65-9e8f-6d61a5475327", "value": 88732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495300, "uuid": "c53d0892-6dd7-44c8-a3e2-fed16202437c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495300, "uuid": "409eded7-a06a-4cea-aafc-e312fdb81426", "value": "night.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72465be2-4403-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777491701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491701, "uuid": "0d1c62e8-c7f8-4015-b569-29fb1639e43e", "comment": "Malware payload", "value": "6cd7b0c7d23da1d51a662c328d2ff477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491701, "uuid": "ff900f99-0441-443b-a038-66c3c2924efa", "comment": "Malware payload", "value": "cd77a02d2e29d9a97b4196d4a965f88f6c58c2f972d6c4c9e601de94692f7d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491701, "uuid": "c8d1790d-2196-4eff-b101-dfabc5479265", "comment": "Malware payload", "value": "f5ea35cd5db4d8614aa3b318e639143eaea820fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491701, "uuid": "2ffc83b5-2c06-41ab-a591-3fd0a5c39141", "comment": "Malware payload", "value": "fa87dc6c81dada0be866b51be8d4eab6ffe1ace23b308ae3b241cdbe65772632e333d2dc07da0177b72354ae73d0e8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491701, "uuid": "3d8c3d74-8255-4140-a5e2-0ce28fb4c8f8", "value": "T14B064C31324AC52FD96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491701, "uuid": "04f3ed06-ea64-4f4e-ba32-249bddf1b90f", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491701, "uuid": "9bfacf37-02d2-440d-bf0f-49718e8ea20c", "value": "49152:hWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l544xPAELcpB2MpF8/:hr99u4kc8Hao8eRjYBU4UAir2Y55xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491701, "uuid": "db157457-4842-49c9-b31c-25a73ad93c66", "value": 3691000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491701, "uuid": "31b81370-7f07-4b34-ac29-ba3ac7b4c6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491701, "uuid": "c8fd761f-b9c4-4597-9fdd-06431b14ba60", "value": "mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d59d698-4416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777499719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499719, "uuid": "aed6b218-6bfd-4f42-8fe2-d92e7351a37c", "comment": "Malware payload (Mirai)", "value": "b3ae626e646274aa98587804de4d0d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499719, "uuid": "bd8af6ce-0802-48b4-b89a-0490771a3c58", "comment": "Malware payload (Mirai)", "value": "cdf7e0346ea4f27dc3aa07e98ef4d1d87fe269bcf45022999931f84ddb0c0ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499719, "uuid": "0383db52-521c-45d9-947f-f049e5a7ba02", "comment": "Malware payload (Mirai)", "value": "7b51cf1cdccff421b71e549a6e0bc7c6007018d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777499719, "uuid": "4f24661b-1dab-4c9f-a906-d1ff5e69a99c", "comment": "Malware payload (Mirai)", "value": "85caddd961b5f1362dc57670c6f7dcdd5f874b39ec8f47eb927b9063d73aefef2292a8cdec7d5f48039974b3633d3aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499719, "uuid": "7b2d25f8-8d12-4230-be46-914427997119", "value": "T14A930C46B9528A12C5C212BEFBAE415D33136F7CD3EE7212DD206FA063865EB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499719, "uuid": "263a1623-b7f4-419d-8024-f09dcfb187a4", "value": "1536:H0n7OH2CMqb61l3EV5gOBngQRfGBg3MQwKrlSRDY9qpVTaYMznmaKQfiCbaf65DK:/WCi1qV5gOBnnfGBg3X7r8RDHpVTaYC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777499719, "uuid": "c5cfc24c-cc04-4edb-8c1d-3fe4c7fb1bec", "value": 96840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777499719, "uuid": "80d8a83b-3c23-46bf-ad17-ea9f076d106c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777499719, "uuid": "1bdc2cc7-789d-4ecf-8866-bc63f0dd2996", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3e6337-43d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777471342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471342, "uuid": "8612f58d-c674-47b4-ade1-f8f524920fae", "comment": "Malware payload (Gafgyt)", "value": "43687ba2c2ca1a7f3f188c9090e418bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471342, "uuid": "438032b5-1bb1-4944-a02d-9138c1035f9c", "comment": "Malware payload (Gafgyt)", "value": "ce52d28dd3b9b2b7801cd4be5443aa5fa932a9d46b941025bf9da77d707fb022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471342, "uuid": "dad59739-46a8-4118-9f02-b23af8fb0193", "comment": "Malware payload (Gafgyt)", "value": "6ad08e4c9f30043fc7f1e36a677bb165b3aa17a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471342, "uuid": "d9054fe8-57c9-473c-8a01-f6f8b5453477", "comment": "Malware payload (Gafgyt)", "value": "0346c8e61167a458aa581d05032e41b783321495b0facb18ca2e028b1fd0bd11343c6dd693be39555696cbcc90389944", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471342, "uuid": "0d43e4f6-5f1f-4092-b53b-11188016dcb3", "value": "T192356B42FB1C8522C8470EF12A7F53D5F7217A4341F5A22A670F5B672622E3ADAC7349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471342, "uuid": "35f5c7cf-0c9e-416e-8e79-e1bcf8248ba6", "value": "24576:Skjl3zBaUAOTsKUatf+AlJZtW9CJKTKc27kBcQcGwNvf6XK:SkjxzBaUAOTsKTGAvZyCJdc2+cQcGwNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471342, "uuid": "885e3932-5cb3-441f-b135-3fc3ec21f0a7", "value": 1074512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471342, "uuid": "80440dde-fe35-47df-91ee-1d2e0664b179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471342, "uuid": "5d11d322-3993-4155-84da-c30cd03fafe8", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bb29f6-43d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777470960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470960, "uuid": "bd0bed5a-7a71-4291-b6db-6d97bdf0625b", "comment": "Malware payload (Gafgyt)", "value": "97c97cad96d1b0775a191c164b4cba87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470960, "uuid": "74f0b6b1-5aeb-48c7-9ee2-023198f3556b", "comment": "Malware payload (Gafgyt)", "value": "ce769e2a77acd5744c6c3cd846437f4b817213a5f03a080aeb8abc613fc41cf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470960, "uuid": "b681e986-c117-4f7d-b3f0-97e850bb7649", "comment": "Malware payload (Gafgyt)", "value": "d4fe4b0b9c75d5e7288571d4a84e90c765d74316", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470960, "uuid": "2d6d136d-9b8f-4d7f-8b40-d84a7b990e18", "comment": "Malware payload (Gafgyt)", "value": "ddbac1c1b1efe9f4f5cac98cab91876077faf4291a4bffae1b7e66e95b8ecae78fb73ecb095b1c5226e221eee9785bae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470960, "uuid": "97975ce3-d6f6-49fc-858e-7e80b8ce1099", "value": "T11C357D5AF2F370FCD067C030439BDB62A835F46501226E7B65C4DA352E66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470960, "uuid": "b3f6c352-d532-46c5-bbcc-db40ef2b5a07", "value": "12288:88wfKBGEmoY6h8nP+Soc9qs29deskWfNQ5wUlmyiEZhCy4lE5k:88wfKBGEm2h8P+Soc9NGdfkWKlVZ0fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470960, "uuid": "cbb3f98a-b733-4bab-877d-33ab16aa8587", "value": 1160584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470960, "uuid": "2ebf7952-1db5-4f21-a3aa-8df2eeee1cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470960, "uuid": "7aa8004c-3521-4f5f-9c00-7fe27b856d55", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe43ca6f-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493225, "uuid": "c64c1d6b-dfbf-4dd5-b87b-ba8a9681a501", "comment": "Malware payload (Mirai)", "value": "5a8c9125b0930c81d85a11820611b55c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493225, "uuid": "00795513-228d-4062-92a7-be7bc47475f8", "comment": "Malware payload (Mirai)", "value": "cfd88d4c69bd6839c7ee736afcfa3e937f0d0a5da5cba5727d31f786dd15cffc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493225, "uuid": "d0ca4ed7-9274-4c4b-8e02-90e092d493e6", "comment": "Malware payload (Mirai)", "value": "4d4fe5881e49f8fbfa68668098d56cea8b27f1f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493225, "uuid": "c505c4b5-287b-4e4e-b7e3-ed6dfdb26306", "comment": "Malware payload (Mirai)", "value": "41b100ad1461fc1d92dcf4a53757281e08f6819b5895e8a1b83af086bc2e9254ee41858d3a4c48a034b98985cdeb13c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493225, "uuid": "06bc4323-a336-4149-9591-41a881f8663a", "value": "T173534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493225, "uuid": "5dba4399-2eb8-4af6-b72e-6a8db8a228de", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQpz0XYIfiV0A:BkfZJxFtojQlvnrj/a4LYZ7UYNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493225, "uuid": "199c5a0e-c7b3-4884-864a-158c3b36c60a", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493225, "uuid": "5df230c5-9925-465b-8154-f09d61ccfc2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493225, "uuid": "11bdeb23-089e-4bc5-a4a9-05f0b9a8f803", "value": "RpcSecurity.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ab5352-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777484996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484996, "uuid": "61001f0d-6d62-456f-929a-c40766673652", "comment": "Malware payload", "value": "9ff4f78527996637f1f102c88290c4da", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484996, "uuid": "2dcb4afe-acb9-4c2f-803c-20bb308e962f", "comment": "Malware payload", "value": "d047d8b78284ee503ea4c7918670737e8cdcea38c5f626a6414f3377f143baab", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484996, "uuid": "f67f321e-f75c-4322-ac8e-70b3a0599adc", "comment": "Malware payload", "value": "eb7b6757596c281c48579c37ea83f158e3464f57", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484996, "uuid": "9b6e2a98-39a6-4d0a-bd70-056a5606e56c", "comment": "Malware payload", "value": "5406382e60999402f097376befacd5f820699890732068a04fd6ba66eb95f0768a184eb071e5035c57b2315f998716eb", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484996, "uuid": "20f382ce-e95e-4450-ae09-69866427b3d9", "value": "T1FDE27C59EA27EFFA4EE67E877CF781D4F95C09A361C477E99208B11B6DB1B0480240B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484996, "uuid": "1c94f56d-2e71-45a4-9cdc-29cde8616793", "value": "768:uIsY+188mdIIjpumn8nYWH2cComaOuka7pEOz74iwXjS2NzylWM1c5hdV:f288mN9neJmwka7pP4iqjPByc5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484996, "uuid": "4a12bb4b-e6e4-4dd9-a8e1-376cc66abda1", "value": 33760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484996, "uuid": "6eca3aa2-d06e-403a-a174-8211ff939202", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484996, "uuid": "15332a39-5547-4eed-a347-bed80bcbdc25", "value": "apeda.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ba4106-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495252, "uuid": "7d3ac5f8-55b8-45fd-bda3-d68c85dc440e", "comment": "Malware payload (Mirai)", "value": "c22f267307697e7eb69b1f9aca0f12ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495252, "uuid": "3fe14079-6665-4589-b693-f4176b419c1e", "comment": "Malware payload (Mirai)", "value": "d060ba109f7584b7e1f7198b18f5b37ba348f56995957c6272976574d1e49942", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495252, "uuid": "d826dbe1-dd89-4c5c-ac04-7229fcc3ff34", "comment": "Malware payload (Mirai)", "value": "e5abbb1a03ef1acfdca7764da66374da56862566", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495252, "uuid": "9771e89a-ba56-4943-8805-d189773c4d27", "comment": "Malware payload (Mirai)", "value": "c86d857151a93f96410f33ffe63a7e9cdb73822675e0a234fe170336d736729dc37eb3d2d242a003fc4b177bd6cc988b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495252, "uuid": "67ae6f04-f3d5-430a-baa7-891bb7b209d6", "value": "T1B493E842BD429F13C1C621F6FBAF059D3B166B79D6EB3202D921BF9023868D70D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495252, "uuid": "b218af76-f93c-4b19-b0d4-c5e578c92954", "value": "1536:4V4F+8wMvh/zTjmCon3rqMGbFCive+vkQWvW/DgQ8gdxMUZ485a:4VSUujmCon3rqlpWEkrvW/XM45a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495252, "uuid": "f7200808-bf1c-49d9-9735-5612a942d09c", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495252, "uuid": "8130f0df-7b16-49fa-b7a9-ac4b99d0506e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495252, "uuid": "0a8287e2-6c93-4cfe-900e-19328a9b87a7", "value": "night.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ba375a-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455549, "uuid": "0a741595-faef-4280-807d-c200dd0a280a", "comment": "Malware payload", "value": "0e828eebdccdedd1227a86d3fcc3ab73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455549, "uuid": "17c4a9ee-965f-4170-aabf-14f8bc8ef751", "comment": "Malware payload", "value": "d07653fd110c9bf1cd453b4c9862677f8bec737a62f0ccfd228f5f1abb463911", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455549, "uuid": "899f680a-2d58-4de1-a5bf-d9c01d9bcbe7", "comment": "Malware payload", "value": "78987a3056c0f0e0d252ec24442745b247995c45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455549, "uuid": "0fc34882-709c-436a-967f-5323c2167b62", "comment": "Malware payload", "value": "862b6f3f8f893d93eca07b9572f8bcdf647c991ef41627600b67d1fee5b7dc719a9f04af642235506e851457faf22496", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455549, "uuid": "bbffdc5d-37a9-465c-b855-c50433a6a1dd", "value": "T1E23723924C7CC9BEC5BA0358242D258D1DA7CD4A1596A04FE5F1E8C6708EB1C067B7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455549, "uuid": "53e1ca9b-4ecc-42df-80f0-864638b24349", "value": "49152:9j21cOAP6PZ44aTHkEtl1LOuYaTHkEtAKjPvgaq1AaM3koaTHkEtpaTHkEt0f39o:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455549, "uuid": "13a700c2-a934-450a-9d87-2488b57e55d9", "value": 22903932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455549, "uuid": "1d21f231-d9fb-438e-b2b4-a4a964129299", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455549, "uuid": "fe3a7db1-aa35-4308-96c2-39b9f12bef61", "value": "invoice-1645080830.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269e419f-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455497, "uuid": "bee76e02-9536-49cd-ab49-cb0304ff1ecc", "comment": "Malware payload", "value": "eabc621a973f4c0f18b6caaf12fcd300", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455497, "uuid": "25ba4cdb-0579-4dea-97e8-0bbbbabe7452", "comment": "Malware payload", "value": "d08a3ba2317c75a92151f5d68796dd82249a118637e370dcada08849ca2bfab7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455497, "uuid": "f9623eb5-0350-4fcc-b23f-8890b974be81", "comment": "Malware payload", "value": "db5563f542c9b2fabbdee8ff6b32187727fdc807", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455497, "uuid": "9b2ba863-9049-4391-80d1-33993316c55d", "comment": "Malware payload", "value": "457e7c205284201ea501e2c09cc8205d939e679816de90c6562689a62a193c4768bcede1b8b6a6dcb91e7e3e376e5506", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455497, "uuid": "f570f204-7ecf-4749-b2a0-42f02cccd36f", "value": "T1DF3723870F680E7D9DFC372F42AEDB8E25AD0CDC41809ADAF587D45A924FE2244DB449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455497, "uuid": "c7bf2ada-79b8-43f8-bf4c-8ba681e9631a", "value": "49152:190X0D90X0I90X0d90X0F90X0W90X0M90X0d90X0m90X0r90X0T90X0Q90X0ey+x:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455497, "uuid": "2b22a0bd-841d-4ae2-ae2d-7baa6fcc90ef", "value": 23424190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455497, "uuid": "138e72dc-aee4-4eb6-ad9a-e6cdcf4cc122", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455497, "uuid": "bad9404b-85bf-4a62-9e4d-e51160109ccf", "value": "invoice-1645080830.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f539a961-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455843, "uuid": "83a6c469-08ee-45b6-b9bb-7af411e3d954", "comment": "Malware payload", "value": "73532e9339e13a883d7f4d04061a3af6", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455843, "uuid": "ac1973ea-b31d-4e6e-822d-b4ebf8ef6912", "comment": "Malware payload", "value": "d0d3edcb1b771120b769b8f28ecb3e71f73342c115a4d3c6ae3dea5fc6d1e5d4", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455843, "uuid": "52cdbf81-9481-4ac1-b49d-7f87d1e650a4", "comment": "Malware payload", "value": "ef1e8f4a280fff46027c6d384e36af4f296b787f", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455843, "uuid": "4702c6af-721e-4045-a690-701725e4c7e1", "comment": "Malware payload", "value": "8bd6636c6d40cffbd94bdcebf58adc46454c22900765b22ad08613aa3e0a0fe7cf604e89de488aaadc30cd0d6251203a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455843, "uuid": "cc4083de-d8c5-473e-849f-f3c3f34e1440", "value": "T15696125AF71C942FCC7B24324DBA132163174C468A979B93A514760C6EBB6C88F6EFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455843, "uuid": "17731270-bb06-45be-927a-d7a643457a7c", "value": "196608:Iu6NGQU1xyEYuat8IzWGQqwb1Uk31dnJBnxG8S4STSgC:NQKyG6tWG2qmVbS7Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455843, "uuid": "7b0d5d79-354a-4e01-9ae3-1af9067013bb", "value": 8652523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455843, "uuid": "24950a9e-22ab-4bb4-8b02-898c759bdcec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455843, "uuid": "71a63cc8-bf0d-4fce-9ae2-bd89f92ed6d5", "value": "com.care.clean.manager.junk_1.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5132ad4d-436e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777427651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427651, "uuid": "ddaeac3c-a647-420a-ac20-960cc7b95f3f", "comment": "Malware payload", "value": "49a45efbee738bc03fcd9f3e0597553b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427651, "uuid": "8ec7e0f7-cdfd-4187-8bc3-def6bef2d3e3", "comment": "Malware payload", "value": "d125badccf32b48130229237755627b0389a5de5fc9c10d97c4d70b808091675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427651, "uuid": "894b925c-a308-4d98-be05-0533badfcb89", "comment": "Malware payload", "value": "9b4ccd31280596fb417a1827585bb1e1321cbf1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777427651, "uuid": "4271fb64-342e-4f30-ba1a-214a7956d610", "comment": "Malware payload", "value": "9833628fa284ec7a1ecb036370e2ffb0db545560e318c6f03f237e22c7570df1e3e83a787ccbf74a541e385780509dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427651, "uuid": "d0317a89-d0c9-48b4-8fd7-74d82460a0eb", "value": "T1C066225933E881E9FEB7E076CA52C607C6B1B88A02775B1F01E45AB62F733705A1E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427651, "uuid": "0b9ccd49-ce85-47a6-b294-cd4e715725f7", "value": "a6b79195015e1e45d816e61ee943224b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427651, "uuid": "c6fe92da-124e-49a5-84dd-f015449fc81e", "value": "196608:sbrtW+ZT9EYz2qu/a5GId+Snrjdt0J22wJrXSVu:MrlZTOYHAa5GHm0JOJrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777427651, "uuid": "c7fb2496-bba6-482e-842f-4bc6de1b415c", "value": 7077888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777427651, "uuid": "e6f3b43c-0ae9-48c0-bdf1-04cad36a83f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777427651, "uuid": "804e7ad2-0a02-44bf-81af-0159b6f2ef71", "value": "Helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9ff057-43d8-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777473470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473470, "uuid": "b2bc2c3f-4bbe-4906-a390-8df32bca1d21", "comment": "Malware payload (WeedHack)", "value": "dade7743b51bd6f39f01b8ea6672b237", "object_relation": "md5", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473470, "uuid": "f870d82f-69c3-40f9-bdee-6dd56a6d5f56", "comment": "Malware payload (WeedHack)", "value": "d12d5d1fa82701be14bde9c127807e05753f70338a4aef2778881852c7a887b4", "object_relation": "sha256", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473470, "uuid": "02a2d2c1-b467-42be-b8bf-068ce5dce207", "comment": "Malware payload (WeedHack)", "value": "c4718be318e1a4340088edd18c7e7633b89230fa", "object_relation": "sha1", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473470, "uuid": "fe9e7ce5-a8f9-43e9-8ad2-64ac2eef5af1", "comment": "Malware payload (WeedHack)", "value": "e4f515926ec2336bfc935c4ead14dc4b90a0fa3095709ddc7174dc123019339e505438b2f170a9c9db1ab23734722244", "object_relation": "sha3-384", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473470, "uuid": "a92b715b-f3e1-4366-910d-de74ae7713f2", "value": "T1CF03E1DAE64782F7D8C821D6E2F65C1453944DC8E4CAD782CC7BA3003558CDB56F922A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473470, "uuid": "dc14334a-3c5b-4b17-aa66-ce38f434fbf5", "value": "768:DuAQ2Phb37MrD6ZCnJJ168r0Mfn73IDbKv+QtjNwRGrKRFVoetQLATznA/V:KBep7MP6ZCnJJVrLf7YyvtNwRDptQUTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777473470, "uuid": "b3013444-68e5-44df-aca5-48ea75f88063", "value": 37734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777473470, "uuid": "1537f7c4-b88c-4876-ac41-46190bae26eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473470, "uuid": "74146e56-8614-47d7-aa78-534cd51ab547", "value": "Dienstangebot_Holzinger_F_28-04-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ea846e-43fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488917, "uuid": "516496e8-7998-4845-84b0-4c5790e4acb3", "comment": "Malware payload", "value": "5ef3c90fdd7c2d4281cd7e205e8efc85", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488917, "uuid": "b7944dbe-b7df-41ca-88bb-c34dd971050d", "comment": "Malware payload", "value": "d161b24eb3cab37461d9124adad23278b6eed6efe6881cc3809e0aa4524b6ccb", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488917, "uuid": "be1fef72-3699-4e4e-bd27-35f5e00e88b5", "comment": "Malware payload", "value": "64b810841a8205e001e395c68920bb59a292cc00", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488917, "uuid": "e6a9057f-bd8c-4bd1-b07f-41b4250a8266", "comment": "Malware payload", "value": "ed8dc3ec9a5137caad552d69a8afe706e587f6930fe109c10d020b642742d9051c4132efd15533b6b22d3bf4f570f09a", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488917, "uuid": "e70127a4-a5b2-41bc-aea0-49adc7d71d36", "value": "T1F713AE9DB2235AD0C3BB5361287448D10E7C6C371CDC6E5B278E2929396EF59A4303BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488917, "uuid": "193ed69f-1122-4010-94c5-ce7f5189a06d", "value": "768:uIsATaaPh40h/h916bY0V+oeG+sjZP355/iiRoEl8AujCn/zfa2NBylWM1c5hcs:3TOc/h918Y0V+vrsX5/vR/8A1/TlByc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488917, "uuid": "280c1eae-a9d4-4f14-9e1d-a2797c4449cf", "value": 42556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488917, "uuid": "f8552b2f-4158-4156-84b5-4b208c6427ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488917, "uuid": "9a74bfd3-1257-46a8-875a-d7ca3627ede6", "value": "afujo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b592b2-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494848, "uuid": "6458cc39-871c-46da-993f-1ff66d3f3717", "comment": "Malware payload (Mirai)", "value": "5254e709c959be10ed93d58bdedad558", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494848, "uuid": "d000e967-1909-4f9e-8790-1fd0f69bbcce", "comment": "Malware payload (Mirai)", "value": "d168e38af88953d226dffc64b8b7222373b197de878e1247540100a89b0ab756", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494848, "uuid": "cf459312-7914-43f8-8096-0e7e3c1f9cad", "comment": "Malware payload (Mirai)", "value": "0e99891464b80ec219c22620c25ac4fab6965fa5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494848, "uuid": "8b0f8ff6-1d4b-4e81-ba51-15922064b236", "comment": "Malware payload (Mirai)", "value": "b5927c6f2ddd8809ed6ff7a46bb8be0bc1d899d8387c177b1e848cf99d000ea5978b5b804c616a38d281a5aa268dc2d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494848, "uuid": "ab803560-065a-411d-98da-363a5f001231", "value": "T1B2B3F845F8509B13C6C625BBFF4E428D7B2A1758E3EE720399256F30379796B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494848, "uuid": "83683187-e3ca-49a2-abc0-5d920f00410e", "value": "1536:fdfjRsZmZ5MUsyTROo55x/3naUQhJjlrAwywUt2loV8cW4kROiP3RZ:fxjjZ5MOdOA3aUwd89a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494848, "uuid": "10fae786-5a0a-45de-b851-653546a91170", "value": 109188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494848, "uuid": "29fdb582-accf-459d-92e7-00ba892b594a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494848, "uuid": "7e21360f-f825-4b43-9b70-d388500972ee", "value": "rage.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ab86b0-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478743, "uuid": "0e90714f-957d-4d4e-b249-ca2323fcc302", "comment": "Malware payload (Gafgyt)", "value": "a26ccbb31ec5f0a15f21a0b05b1bea7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478743, "uuid": "94dd675f-b840-42df-90d4-8f70559b6742", "comment": "Malware payload (Gafgyt)", "value": "d1a795bbf8e456f036885c209adf2e9c8c71a4325fe43e08bb91823413e86b00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478743, "uuid": "d5bb35e4-5155-41cc-ac66-baab717154e9", "comment": "Malware payload (Gafgyt)", "value": "366dee3670ec0250fe05cfe39ffea6f330c8d4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478743, "uuid": "d34dcdaf-b39f-4466-90f2-e6dd18f94aff", "comment": "Malware payload (Gafgyt)", "value": "f7eed5081e1d82b63abf4aba548dbf255ab69d352d2f762a431186d62610312652c27860764e69cccd62ee5cf6a629c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478743, "uuid": "ebdd68ba-7de4-4b7f-a78c-ed8a049100d4", "value": "T112630902EB92C7B3E5831BF916A79B210531FD6A2E1BEE65E32C7CB48B124847117758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478743, "uuid": "1bd67e93-b131-4ffd-93ec-4055d8fbd8ab", "value": "1536:3EWXOwUmtmRJfSmNOzl6O8U0AfNn/2mLIjVYCjEGmf4Rk:3EWXOw3tmR9rNclV8bKemUjVYCgGmf4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478743, "uuid": "e7e71965-a89f-4a30-9502-f8247f22b083", "value": 72731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478743, "uuid": "e16db073-fd2e-4f39-8042-5d8e5747e9ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478743, "uuid": "118eae62-d41d-40b7-aa7e-34b80cb4efff", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0351e2af-441e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777503112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503112, "uuid": "4b91b91a-f91b-44ae-9d31-152b564921ff", "comment": "Malware payload", "value": "8bef4cafd622c5793a94cbf9cfdbd9c0", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503112, "uuid": "447caf3a-61e3-46f1-b2cc-409f44e06e88", "comment": "Malware payload", "value": "d1c69bacc201811ae5fa1b88cf048b4537721f32c7f4967e415335cf645d48ae", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503112, "uuid": "3fad134e-c2ec-41dc-a597-85bd1ef1fcc4", "comment": "Malware payload", "value": "af167a60063d47bbf8c8461d321fc72561aa8987", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503112, "uuid": "3f175227-d051-45dd-9fbd-6df615fe212d", "comment": "Malware payload", "value": "408fe344c7e1bc6b6c0ea225d677c6a2dbfbdcb5f96f3394e0d96f7d58829f037324983987fcc5a6e6687dfa6232e53d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503112, "uuid": "bde798a4-a743-48dd-8b74-03a97f165c12", "value": "T14E267B4278D001EDC09D7A3248F27A867B34BC580B3627C72E95AA783E77BD11C7675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503112, "uuid": "2e7c5f95-0637-494b-aaf0-69f41e97cc4e", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503112, "uuid": "a7e934e3-1e33-40d5-9c83-a0d1b944e255", "value": "49152:takI39/JdfGy0cmbnJcseQUrQW9xWwD+1HZ4dzSPg3E:taft/CPJ12QWmmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777503112, "uuid": "8abdb678-f8fe-4b38-892c-ae9b9b71ea70", "value": 4718288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777503112, "uuid": "19f08be5-56f3-498a-86c2-9521d3abef2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503112, "uuid": "25616b9c-7ef3-4304-8d19-ed958ed6e920", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2c8171-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470594, "uuid": "ea3516ef-07e2-4596-becd-72eb870fc14e", "comment": "Malware payload (Mirai)", "value": "054bc8a8b0b269cd8b1165b942b2422d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470594, "uuid": "c9f7e8b8-380d-495c-877b-e2996a4624e9", "comment": "Malware payload (Mirai)", "value": "d2616b715ab901f71afba1991765e72f89113f9e4bd6cf88c26123dacda7a072", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470594, "uuid": "ed5b9426-2427-4d4f-b5cd-acd63d641cd4", "comment": "Malware payload (Mirai)", "value": "bd1a1cb9e1efe2470fdb5a6fbafabd1109e38fef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470594, "uuid": "4e89b6b4-e974-4f26-869a-4cc0f9bb6cb8", "comment": "Malware payload (Mirai)", "value": "bfd13a5d2954380af0e008909d1df995d1f0b8fd22a23af193100d11b13a1e2c4317bc063376e27560861c6891667277", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470594, "uuid": "d524148f-34fe-40a0-ab34-ace1a524c01b", "value": "T16B730981BA43DEF3E81711F502B7DB365A32FD3A083AC5C6E364FCA16A515C1A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470594, "uuid": "af5aacc4-4f66-4290-909d-71a326db90ed", "value": "1536:RcK8MffyU5RL+r9RS3TlUkf/woBORkVgu3Urpbr5ag1416mEv6+87:RcHCfyU5MuTlUknw3Ygu3Spbr4q4HD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470594, "uuid": "d4e4d165-e3ce-4177-899f-dfdd105dbf1f", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470594, "uuid": "868a138f-054a-448c-90d9-3605f50defe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470594, "uuid": "78be2369-d306-44ee-8c6c-2c9dd82f210d", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5d62f6-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479993, "uuid": "721ceb37-036e-433d-9ada-a82aa30dd665", "comment": "Malware payload", "value": "5decb9fa2db2525e406c98dd4733ac80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479993, "uuid": "a862dc8e-096c-4d76-98db-5071c6952771", "comment": "Malware payload", "value": "d3204724a4519d0609b1b9831083c6c7cdd931d9b04dbf4d013d67e166222d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479993, "uuid": "72245aca-a94f-4cd9-8310-30c37b530de3", "comment": "Malware payload", "value": "13d5e499c03b9543c0c4769fcb9fbcb1741484ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479993, "uuid": "915f9a93-9615-4920-910f-70b04199da79", "comment": "Malware payload", "value": "59b18c0988f5cb63f790100088e5bf7facc703583d555547749d16d5681e8a2921669169c4351b69daa7659f57790298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479993, "uuid": "10aa7bd4-1ef0-433c-8538-81947082ca02", "value": "T1E8E733739E4C9C88D5C71E7902BAEF516A996E524832150BDD8CF6C37ABF8C50A0B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479993, "uuid": "6bcf63ed-5281-4076-9782-95d250f4ac64", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479993, "uuid": "7429d5c9-f8e3-4bc8-8aee-dede0555879f", "value": "1572864:jj5kJof13rQcTe/FEd67As/ph6QSoXUwNSyaGgsfYHldqJ:jdf17QcTeOd60shNVXUwNbab6YHeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479993, "uuid": "c690b2fc-ee33-4ab7-a1e0-90d2e03256be", "value": 69959376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479993, "uuid": "6f5a6ee9-ad52-4dc2-9f54-643243bec467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479993, "uuid": "523536d1-8e8d-4660-8a5f-b80784ab30b3", "value": "C__Users_Harold_Downloads_Install_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e350ecf-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441363, "uuid": "92360d04-69cd-40d5-847e-8e1e0cd86636", "comment": "Malware payload (Gafgyt)", "value": "aaac61e86d98b4c99b04e00f194d5b25", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441363, "uuid": "37b4efb9-95b4-4122-bbbd-9e148ad66789", "comment": "Malware payload (Gafgyt)", "value": "d3c694a629de8d3c7af140b482948d1175b24648f360c38e142ffb2e90e77919", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441363, "uuid": "9ec25c05-1a50-4097-ada0-d9e1d1fb14db", "comment": "Malware payload (Gafgyt)", "value": "7254da676d52dadcfa1bc283815b512be6c40cc3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441363, "uuid": "742ceff4-b70f-4c4e-87c4-8bf071b0a18c", "comment": "Malware payload (Gafgyt)", "value": "f5bb97deb81a9df2881a2463e0865c96be7ed00ca9dd61c0e1bcbc69a1a734c8a3962d329dc5d70952552651f3e60c97", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441363, "uuid": "ac0b32f2-0e97-4ef9-8ec6-75248a4b6f4f", "value": "T1ABA35B86D643C6F3C4430AB1026F965A0632FB3A4E3B8EAAF71C7CF49B129D53115792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441363, "uuid": "34ef80aa-5935-46f0-8b30-d9593712811d", "value": "3072:KR3TUPKBVjBW/EZbb29akWbjN1Ul5hETeRrXnF0OzTyoQQub:KdUPKBVjBW/EFb51Ul5hwehXnF0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441363, "uuid": "139fb0bc-4b21-4a7b-a60e-6074c2806374", "value": 99773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441363, "uuid": "f625bdf9-d9c3-4be6-818f-fe76b5593429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441363, "uuid": "ea97e418-be1a-499d-a210-95359f57496b", "value": "assailant.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c717bdc-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470592, "uuid": "9808e433-5e26-4252-8c86-8e8f7b316831", "comment": "Malware payload (Mirai)", "value": "1e269ad43737b61e37c521995202649e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470592, "uuid": "1719c632-0724-4e90-89aa-ef452669d36e", "comment": "Malware payload (Mirai)", "value": "d41cc5457976ba77fcf2afe7251786ea3279143bf1c1b9517e5ae27963c43fde", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470592, "uuid": "1fdf1356-b597-4429-95c9-1d9c87cc2dd8", "comment": "Malware payload (Mirai)", "value": "31ae1a01341649ccd1097911b7691d441205a07f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470592, "uuid": "4dc08da7-21d9-4e07-a4c0-6dff5e779c8a", "comment": "Malware payload (Mirai)", "value": "3290cf82bf0b4edbe4f8123ec2cb675f296199f1653b9ed0ba0322f7c2816e2abd16dd994936d270e0e1b375c1a44689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470592, "uuid": "a8ac6318-f8ca-49bf-ad20-448813f42e33", "value": "T12DA3F897F901DE7FF80BE6BA049309197920FB660E530B76A367BD93AD310D41962F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470592, "uuid": "c19445f6-a437-453a-b11a-973a49f3eee4", "value": "1536:/yv7fKh/hLK0AaDIYtE5RS6U68Fd4HvG0Ug1pbZYvDaNzwqAxSdNC:/yziD20A8IYtSRS6Uz4FUk+JqAxoNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470592, "uuid": "d06c0411-e190-4ad5-b0ff-e1fcf2291fbe", "value": 99680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470592, "uuid": "cf845892-6770-4b9d-aba0-78f78a454994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470592, "uuid": "962dae81-94b9-47cb-9e3f-45a2a865da22", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336b3dc7-43da-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777473986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473986, "uuid": "cf546e7b-84ec-4540-b690-e8d2c70c44af", "comment": "Malware payload (RemcosRAT)", "value": "79ab98559c39b239f4e6b8771535b789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473986, "uuid": "8fff708a-f332-42c7-ac67-9b2eeffbb772", "comment": "Malware payload (RemcosRAT)", "value": "d448f06355d7484df4c27108b0f9c4ef313c34cafee87eb3d85eec012094300f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473986, "uuid": "eab23054-0193-42f4-8d41-1089d8fea020", "comment": "Malware payload (RemcosRAT)", "value": "111112478a3be18fc39a1fb0bc6e468a95ce08a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473986, "uuid": "1ade690e-5135-4292-8e51-2d3855365a15", "comment": "Malware payload (RemcosRAT)", "value": "076c93e690a98878ad47c59f637f61c0991356838df99bb85de560224772edb92b7a51ba0e70d6b8bc37fbc2a1d6f98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473986, "uuid": "36b08fbf-04e1-4b5e-a4a2-56d8369d7c23", "value": "T15AF4DF0973B2D95BC3520B7059E057BC74BD9D242926C71667A73E8DAE2FFB84AD0032", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473986, "uuid": "de8aa100-ef2c-4275-b703-a7c358ef7c20", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473986, "uuid": "40a2e4d9-2d84-4f1c-afdb-9cfa1120e461", "value": "12288:7X4unnzoRZ+5aXa0Zmwxg6Qj8C44fvF/NaBvApUFPeERlI2nhR+zmMy9kvAYfeys:z45qb0QwG6c5HFTpEmiTnhR+zmEVBD4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777473986, "uuid": "4353a569-df81-4b2d-a65c-61b5cfe94a82", "value": 783449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777473986, "uuid": "5ce70230-3a69-4144-a65d-b691f6ed9788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473986, "uuid": "d1cb6f2c-d9fd-4040-9bfe-60eb2d668b5d", "value": "Sejunctively.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f178a9-43a8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777452729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452729, "uuid": "68024f55-123e-4339-954b-1966d373e204", "comment": "Malware payload (PhantomStealer)", "value": "a800b5f208807843656317071ea86c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452729, "uuid": "b753891b-5483-4d04-8152-abd24fbbc427", "comment": "Malware payload (PhantomStealer)", "value": "d47480cab9ecefc6c7a6cba4f31739aae5108f8eb3da943aa20b31e9b8c877ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452729, "uuid": "0ed94111-aa95-4e40-94a8-744ac2e7696b", "comment": "Malware payload (PhantomStealer)", "value": "e2c28afd633c2ae01a201d0d02e5ab933dc1783a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777452729, "uuid": "42cb6a35-cded-448a-9e54-b8c00047d6a8", "comment": "Malware payload (PhantomStealer)", "value": "ff9fc140397ffa5205f649bc4384490b8f4b05c05c9d6384a2e29cdbcd588094d0f30a15e8f13bbc8eac3773e008c760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452729, "uuid": "cae6a497-b20f-49d5-b762-d61fe32811c0", "value": "T181752259339ADA02C4C45BB44DA0C3B813748D8DE510D3839FFAFCEBB5BE69568146E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452729, "uuid": "56168dfd-097b-43fe-8480-903385e7c91e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452729, "uuid": "2d18b77d-6dd8-4f2e-8d4b-2862d30bf9cf", "value": "24576:DfgyGBn0bvHok3VRq7bHQSmQnjhm7VUZ9xzH1R6DRmQUVnID2CvmtCaRQgrLFjpM:D4y2n0rZR0BmQl+Uhz68QYnIDRopWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777452729, "uuid": "8c2a9c42-04dc-453d-a81a-c602dfa432ba", "value": 1659392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777452729, "uuid": "cce13d76-b434-46bc-969c-051f7c435292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777452729, "uuid": "9d3f05a3-c362-4d46-908e-571a27648c0a", "value": "PO 90278372644 -R0-S - 2720983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a8eae1-4413-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777498530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498530, "uuid": "9c827c12-d9b1-4f5e-8cf8-c114720ec5cd", "comment": "Malware payload (Vidar)", "value": "45fbc9e80a3305abf023f89cdc971b91", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498530, "uuid": "45f26128-4bb6-41bb-b1fd-c8568ea19fb5", "comment": "Malware payload (Vidar)", "value": "d62f24565f470ba468f755f17f27671d060bc10d9d1c7b08e965cbf9fedf806b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498530, "uuid": "f06eedf4-c153-43e9-a180-ac3a54847c96", "comment": "Malware payload (Vidar)", "value": "34c9784270399a61910d660078c1e497399380a1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777498530, "uuid": "1b231ad9-9b59-4675-9930-f101a1ad2e79", "comment": "Malware payload (Vidar)", "value": "3d8b4d865f19a48fb6f4d7be8fa1c46bd8d1e132dd647a2732099a6b245b8a835b6fd303093ad1c4ba3ad024a6e2b509", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498530, "uuid": "a0b16a59-b67f-40a7-9ba0-9e2ae9cfbda2", "value": "T1EE264B855E414CE8D4382634C86AB74226A5B83C0B7063D71FB025B62E7FFD29DB8F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498530, "uuid": "2adcca0a-1f2e-4162-b20d-77dc25b01979", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498530, "uuid": "8228d6e2-1c23-4998-9a9a-183499532f62", "value": "49152:1jLKdrR8MNC1C7D2iiqm6L7sqyyw+mRTDTdNA:1qUGC14c6L7sqyTRTDTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777498530, "uuid": "cc02b2d6-018c-434c-9b72-d41dca249d43", "value": 4496592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777498530, "uuid": "0f2f92e4-8a9e-4a9b-9bfd-c212ac8a3afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777498530, "uuid": "cf9d277b-ffa0-4d0c-b73e-13665aa9939f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cd7f22-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479997, "uuid": "946cf356-a1e6-4153-a4b8-9a9e40953de5", "comment": "Malware payload", "value": "4e6fcd1e9557804529095e0d0fb52743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479997, "uuid": "41424cfd-46eb-46db-8927-f6fb0ff73e09", "comment": "Malware payload", "value": "d6834a0435dda706850af146ff9d0ea98993958ee401c526e19dafbc507efee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479997, "uuid": "5fad88d1-05ad-41ba-be90-71eb330a5212", "comment": "Malware payload", "value": "0aa92cca395c22db8adff905119a05897a5a9b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479997, "uuid": "9d6030b9-af78-48af-8233-44569c8d8afa", "comment": "Malware payload", "value": "09d4dbc402bd743f4f37a8cc15562d0006ec304e9383711a2353b81e706a86be82f0ab92d5a0b28e318174528fcdcdf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479997, "uuid": "af8a00e5-c93f-4e0b-b129-6e7bde0c2ff6", "value": "T1A9E733739A4C9C88D6C71E7903B9DF22ABA95D1248321507DD8CF6C376BF8990A0B74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479997, "uuid": "8d8dead1-1017-4c44-9e8f-1a857d3b0cb4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479997, "uuid": "021598b6-62ef-4b78-af22-fd35c45f08f4", "value": "1572864:fK5kJo4HU13rQcTe/FEd67As/ph6QSoXUwNSyaGy0sfYHldqT:fy4017QcTeOd60shNVXUwNbaC6YHeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479997, "uuid": "fb1019ed-e1e3-48d5-ab9a-3d3e0ca8e30d", "value": 69960904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479997, "uuid": "25e9c1ee-f3ae-49a6-b509-27619e5a78d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479997, "uuid": "9cba2da6-038c-479f-9de7-486d695bb13c", "value": "Verify_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf338cd6-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494837, "uuid": "6aaf7789-f649-4b99-a2b2-89eac23d5d69", "comment": "Malware payload (Mirai)", "value": "7595b635b9ed44a2c92e595078e85407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494837, "uuid": "576e1c93-afa2-45c2-82b3-fda37d66a212", "comment": "Malware payload (Mirai)", "value": "d68848bb8fb2fe67232affe05b62565b2a3133c8c63c1e88faf7ca2aa0445bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494837, "uuid": "3ea2d116-0250-4bad-b033-f437e4913442", "comment": "Malware payload (Mirai)", "value": "4a9e5a491259258429d85bfa805d4c588c32b6bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494837, "uuid": "8c782c14-6f52-4248-a44b-1f6a288f3e5b", "comment": "Malware payload (Mirai)", "value": "b56d4732927ccbca89e0f3091aaf0383e8344fb533c03c3699793173f461944dde444c2b5e24333d01eadf671ecbeb41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494837, "uuid": "4c05cdd2-090f-40ff-9ff8-8cf1a526ab68", "value": "T114E3885A6E328FADF678C73047F74A20976D63D623E1D684E2ACC1141F2439E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494837, "uuid": "b34e3866-799f-4d7c-aa8a-1eebc2ff9341", "value": "1536:Lxu8eIEL8GscMAeo4BrwFZGfFpgeMwA/YqUW2IAhYT066S5NPdFWHsHNr:LxEP8fcjEeZG3KYZWAS62FWHiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494837, "uuid": "ed981fb0-cae8-4a07-be13-8aadf8157f46", "value": 152676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494837, "uuid": "da802340-be8e-491d-be20-a1ae66f76522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494837, "uuid": "db0c8145-6b75-49ef-a7a5-a885d297146a", "value": "rage.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d7bf4e-43bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777461832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461832, "uuid": "4cfe61df-d0de-4bf2-a28f-6a90e419ac2b", "comment": "Malware payload (Mirai)", "value": "8f544202f33bc359c4dd6a67917122f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461832, "uuid": "ee7827d2-62e5-43c0-88ed-060648e1fa51", "comment": "Malware payload (Mirai)", "value": "d7cdc06e419113b95afa9608a66b901a8d9f62c7330d3ec2ed258c1ac8ed3e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461832, "uuid": "84c2158e-d16a-4218-98e2-2a490002802d", "comment": "Malware payload (Mirai)", "value": "1b3b91e4586f4c0cceafd15fbbd4b7dcbb55070b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461832, "uuid": "9cc28b3c-0e1b-47ee-bd9b-1d8a78aa9ba2", "comment": "Malware payload (Mirai)", "value": "c82f7fbbb97c841f27b379a97b27f1c2b315f840fb5f08ccb87b045b9de9323032e4e10a2f48a09dd709e4f4c373dbeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461832, "uuid": "82ceef31-06dd-47d2-adf6-bb7a76c7d480", "value": "T13673FA52BD428F03C6C321F7FBAE46987716677DD6FB3203EA25AF6023874D6092A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461832, "uuid": "e7cd288b-77b5-4f07-8247-f01436d43144", "value": "1536:gvnFkmumoQhX19i3faj5wOw96xkGI10nikTY5vXoFLKcL:GFkmutQhl9iCj+sbv0TcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461832, "uuid": "ac9e9a98-8a2b-43ca-87ae-3c819859770f", "value": 78484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461832, "uuid": "4ea55966-b61f-42fa-88ab-4a524106ec4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461832, "uuid": "de4ca218-213d-4b4a-a658-8c2610fdf61e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84516fe-4389-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777439528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439528, "uuid": "9b5723b3-ecd9-4520-8ce4-8bfc7f078280", "comment": "Malware payload (a310Logger)", "value": "5d46dd0ddfe4ed7937414d66b3dd10d2", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439528, "uuid": "40972699-3c0a-4147-b9fd-1dc89cf6f678", "comment": "Malware payload (a310Logger)", "value": "d7fc54aca64fa85cd9477aba60b89171e955e012e55b8f7156357e726afa564d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439528, "uuid": "429b8b41-ebf8-484b-9a4e-d0c64198bcdf", "comment": "Malware payload (a310Logger)", "value": "71adce3001d7f03d717e04ccce959a8f2d59ed62", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439528, "uuid": "f0e7461b-10a5-4957-9716-84d7f8259a93", "comment": "Malware payload (a310Logger)", "value": "6ccd7e12f619b5e1a4d0927464f0e55b37ad4c57725b4acd524c3cecdeb8afc24a5a7c68d1f37ddd6c5b816900f90735", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439528, "uuid": "098eed2c-dbfe-4547-ac95-dede9899cd21", "value": "T1FD944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439528, "uuid": "fb1919bc-a728-49ee-b80d-614ecd45cd77", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439528, "uuid": "c9b4ddb0-22d2-4466-9eac-163f332b9331", "value": "12288:qajYKkJj6GmZUiqrYN47vSUYPBafEfCyuOQi:q8Yb6nZ+rYN47vSUYPBafEfC3OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439528, "uuid": "893747c9-a2e3-421e-b151-f6796bf7e784", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439528, "uuid": "bddcb289-80c8-41c3-b7d8-772ee8c737fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439528, "uuid": "e5708443-3485-49d6-bb61-9c4aa2b5fa1f", "value": "Quotation request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b0c2c1-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440677, "uuid": "c020f488-fb0c-493d-ad7c-904648d146ee", "comment": "Malware payload (Mirai)", "value": "d050b42e178cf5c08ac62d97483fafce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440677, "uuid": "5764cf1b-d7d6-40c5-bba3-7504c43ea3d0", "comment": "Malware payload (Mirai)", "value": "d8260ca5cc3dcd0893328ad7d1586190ff82bc822fe42126f6512590eda4c0ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440677, "uuid": "0b62afc6-f29c-4399-834a-1bd75da35ffe", "comment": "Malware payload (Mirai)", "value": "37c30767287f9479749dae6c36301420e9d2c4e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440677, "uuid": "885d72da-f0e5-46d2-b41c-48db5c610c16", "comment": "Malware payload (Mirai)", "value": "a03abad804aeaf52e26551658c16db912c3a2eea413d6e836ad230daf80f04768fa046ae06c7940e2afd132883962a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440677, "uuid": "790ca9e7-1379-4879-a5ab-b10a47267384", "value": "T174B2D09ED08CAC45CA9DEDBBF0AE12F46D80A4D6264E575CA32448CCE67051F3D4F178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440677, "uuid": "06cd29cb-e8c8-45ae-9c34-822f993c3486", "value": "768:UUzbkeIgL0eGUP9uQNUlTv8dCs8+mN7ZyDtFoWn:/keIgaUP9nUZPs8aDtFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440677, "uuid": "c64b8e8b-21c8-4274-addf-dfac0238f33a", "value": 25016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440677, "uuid": "99894f48-c2ed-4c67-9b03-b494936d1d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440677, "uuid": "fc66ae56-0540-4343-a179-ba8af349a8b7", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6a1473-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464121, "uuid": "4e2476ae-cdd8-4d52-b99b-990c49ef054d", "comment": "Malware payload (Mirai)", "value": "060c333a475b62a3563fdf4468bf10ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464121, "uuid": "2d39fa26-fb9a-4690-bd83-e456135608f8", "comment": "Malware payload (Mirai)", "value": "d8ea24ff1948b379ab9629a33da71ea7aa608e91596a887a284c75c8cfc76a57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464121, "uuid": "f0541a81-6159-4965-a74c-3ae25c0583fa", "comment": "Malware payload (Mirai)", "value": "7c2f69c9087b7a4395df7b7da44869a985c51ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464121, "uuid": "64e8a43a-35a6-4fb0-9438-b0039e49d944", "comment": "Malware payload (Mirai)", "value": "5cedf64d0830acbd033963b3aff2f510748d9b5bb012036b110a4fb44fe5090739efbe7fdd4f70f888084a22312a5c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464121, "uuid": "5980145b-9fb9-4884-aa06-4af525fc84df", "value": "T183B3C81A7E11DFBBF169827047F38B70979976962AF18585F25CE7081E302CE281F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464121, "uuid": "34b7cbc5-4c1f-45e6-916f-035691ad473d", "value": "1536:SAlJ41jPoxdfV4BzLe34lj9u04HrjdboFLey:SBjQvVMX9OLj9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464121, "uuid": "4a8cc79a-f32a-41b6-b6da-6f4ecbf45c8f", "value": 112472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464121, "uuid": "e8766258-0e8d-40dd-b847-31767cd9c313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464121, "uuid": "a648fc58-6dfa-4b19-bd98-11a11f899bb7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184ace20-43f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483819, "uuid": "1a6a2df5-304d-4830-96ef-35a41665477a", "comment": "Malware payload", "value": "5f936be4799c86baa6834808eae8d81e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483819, "uuid": "7ee783c4-c839-476e-b281-275a21285172", "comment": "Malware payload", "value": "d8fea4c9cbcbd34f1a5a9c15b5e3e4aec81be422ad5e751c011d91c4c187d372", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483819, "uuid": "98b815bb-7823-4262-a329-17a200f85672", "comment": "Malware payload", "value": "b906e8dadba2b9c36f4e9e14324098fefe08ecfb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483819, "uuid": "e934f0f6-77ff-479f-9f07-180947c1d091", "comment": "Malware payload", "value": "c20b2c913db6c0d8cc0bcfe112f7f5021ab72309dc852656cbe8a758509e8cec27f41dac35186481a70c83a9a609fb72", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483819, "uuid": "3b1ac3d5-aa0a-4760-8bc8-ce7fd3dd9d44", "value": "T13252A66367990EAEC6C29AD3D259E21A98BEC0AF5C0C558CF5E58743F02DA207714F78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483819, "uuid": "01605fa1-62b1-40dc-8706-eea00b8d8651", "value": "384:UgWNtJyCowVTtQlys5pg3PHsOyFFzFW0c2:UgWNtfSlyspkkOyFFzE0c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483819, "uuid": "94bee7fe-1216-49d4-8ee1-4a53ce06bd63", "value": 14267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483819, "uuid": "b3eb872e-2696-4bf1-beb6-320314c14e57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483819, "uuid": "81fe0889-771e-4daf-bc86-dc596be37226", "value": "cl-ncl-following.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4486ecd0-43e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777478740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478740, "uuid": "d49159f8-70de-4418-b132-9bb3dcb3c966", "comment": "Malware payload (Gafgyt)", "value": "64c8d9c71c9bc2e12367b0e725ed0c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478740, "uuid": "f1ac3fd6-3ebc-4367-8453-7e482141d03d", "comment": "Malware payload (Gafgyt)", "value": "d90f57e3e9fb1c25456395be2feedc40ea8d9cc469c6272e7f71065770796661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478740, "uuid": "7fb33024-ff4f-4a69-a7be-392fbd002104", "comment": "Malware payload (Gafgyt)", "value": "93025bea2667b4f010b9364d4181b2dcc2bde7eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777478740, "uuid": "821306c2-711a-44d0-8640-bb7b004fbe80", "comment": "Malware payload (Gafgyt)", "value": "81be017e5e415473d334239993aac62bd42836d818ab197b50efbeaa430452f6b7372f6b75560283f9e5046677223f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478740, "uuid": "4ce724e4-11ee-4fb2-b998-783d8190dac8", "value": "T174E31A05E7408B53C5E2277AB7DB821933339B64B7DB73055928BBF43BC27990E22616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478740, "uuid": "31d3d957-e1cb-4017-92f6-8da6667ccdc6", "value": "3072:HF4nuUGjjDtajJO4v88VMHofmiwDCapNM/9m3mGwZvhQAxn:HunuUUtajJO4k89fmhDCa/M/9GmGwZv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777478740, "uuid": "2cda9d7b-c7ec-4053-8b49-56950940b2a7", "value": 146653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777478740, "uuid": "911afe39-0bac-400a-b1a7-5fa6ba6d204b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777478740, "uuid": "8af51c98-404f-4a85-8626-5006832c1c42", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b011c3-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455472, "uuid": "4101951d-6c0a-4e67-8f58-23cee2c683b8", "comment": "Malware payload", "value": "b6f9ea6cb99f371a8de53180aa8464dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455472, "uuid": "80cb9ca1-4c81-4f8a-a937-5ebd1d1da736", "comment": "Malware payload", "value": "d943b6fa332b13fd0428b33c28cb601c2da696249fecac17d220b716c509f662", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455472, "uuid": "a38b4336-1560-4db0-b0ab-1bba757c21e5", "comment": "Malware payload", "value": "3cbde288aa49fb7cdead47ce13473412c1b64d03", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455472, "uuid": "38f74d43-ce5a-40e9-9bf3-f4602baf0a89", "comment": "Malware payload", "value": "d4d0ced69f3594e7ae40cfcb886fac141636aec6e09139715bc45b7484fafa5e24ff2f525aa5736084c9ea4ec663176a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455472, "uuid": "3a5fcaed-297d-48b6-8850-929bd3b994f4", "value": "T10837230118BC47BAB9BC25250C6F9F99EAF34F2946A4FCCF69C138678E8ED9125D5C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455472, "uuid": "9c0f7c75-92e5-49c5-8a55-44c6e439b9e2", "value": "49152:CYhkMHYhkMKYhkMXYhkMgYhkMeYhkMkYhkM6YhkMKYhkMpYhkMoYhkMUYhkMCyYj:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455472, "uuid": "df972f38-9723-4bdd-b38b-f83fdd325ee0", "value": 23424207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455472, "uuid": "05a2163e-af4b-41b1-be22-61e7575f822b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455472, "uuid": "5d116fd4-f44b-4cca-af17-872c2407fee7", "value": "invoice-1645080830.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd98b160-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493224, "uuid": "4d3738ba-c06f-43b2-9642-008a0eea8d6b", "comment": "Malware payload (Mirai)", "value": "2e59310dfcb5776f04428d80b50bb1d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493224, "uuid": "4695d34f-3edb-4e01-9a7c-b1061ec466ec", "comment": "Malware payload (Mirai)", "value": "d9aef13fc12400503f56768782d9853afc3a5308c62fc44e6d5bf5c1bcaed92b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493224, "uuid": "64856aee-8aa2-489e-875a-a0fa9b893afd", "comment": "Malware payload (Mirai)", "value": "bc810faedacc4754f50720b820bde4957e39df79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493224, "uuid": "274e11e6-e1a5-4fdf-940b-d04e334970d9", "comment": "Malware payload (Mirai)", "value": "738be2aace82b027a92826410eff76f11a75862195614f349b920b37ce22965da561b44d39aee64817aea1898e268e9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493224, "uuid": "226b4dd5-8369-4038-a7c2-0edd79ad1a8b", "value": "T17F435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493224, "uuid": "a8dce71d-c915-40c6-b442-0b99989c668c", "value": "1536:eF6QcATQdskHosl9k1dP9AT0bI666hJa10z:tqgtJHk1dPKgbI6x4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493224, "uuid": "cfbb6918-83df-48d7-98f8-93ef78af1bd5", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493224, "uuid": "4cfab7a0-57c3-42ae-9eb7-f3752f2e23c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493224, "uuid": "d8529d99-5689-4b95-bda3-f992044cdf3d", "value": "RpcSecurity.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c5a3b6-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441367, "uuid": "418b6274-c2d4-4979-9f6b-6c3d0e2491d9", "comment": "Malware payload (Gafgyt)", "value": "32e00210fe405dcd26f1a3de3c210fd8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441367, "uuid": "380b474f-4517-4914-a308-0ff99043d6ab", "comment": "Malware payload (Gafgyt)", "value": "d9d8cc29be66827561aef77972502bbcb3d546caffd4aa7c561c136a59e31cdb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441367, "uuid": "6677ccf4-6a80-4f43-81af-7f3adf60d913", "comment": "Malware payload (Gafgyt)", "value": "320e65a2adfc0d4c7b5c620a950680c460267e8c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441367, "uuid": "c295cd75-e3a9-4307-bab6-6e3d23b920e6", "comment": "Malware payload (Gafgyt)", "value": "44e5e3c28895bca6e4925950aac7de0763cdb2a46f210c1692e796b7a7f1aeeade74c463533bdf10a755f0086294d7c4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441367, "uuid": "b83fe48a-81a5-4b3e-9327-a9c2fd310b63", "value": "T1C3B34A47671C0B43C59B5AF12DB737F187ADEA7106E22185E40EFF801B72A705622FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441367, "uuid": "d46e6f58-655c-4879-8201-d08b78f93656", "value": "3072:w/ZpCk/EO0Z6i5JCmV5hyp+WvCtQna0PDG4gQNcR:eZpqO0Z6i5wmV5hyp+5tQna0PDG4gQN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441367, "uuid": "e961b96a-ca40-4298-8f64-66a09b6b66fc", "value": 116437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441367, "uuid": "4c8a496d-57e3-4d53-a602-358e4c43c43d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441367, "uuid": "205be969-8cd5-46e9-9c82-b1e35be25e4a", "value": "assailant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d9c08f-43eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777481205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481205, "uuid": "925cf38e-b32f-4a70-a6c1-d7ab4cea50dc", "comment": "Malware payload", "value": "ccddd512677af1e3a2771d76006c0678", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481205, "uuid": "1578935c-485f-4879-99e1-2a2e527a26c1", "comment": "Malware payload", "value": "da1118c6a615bd4b9dbee39c93b51669694a07211058649df4da66142d2b81bb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481205, "uuid": "d25a4be0-4236-4483-9107-14fb3867bb24", "comment": "Malware payload", "value": "fa9cb523440ac637a180b4d8ef7ba9b989cc45ad", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481205, "uuid": "2f1331e8-8669-4261-9913-1ab1d37a25b2", "comment": "Malware payload", "value": "e8af1bb421c6c757986fc7bc8978172ca27dcdf9b0187f4bb2c63dd3bf3ca7c419199f94b3329ffaa13bbc398462eef1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481205, "uuid": "bbdf557f-8606-4537-9c4d-77e3b3f06c7c", "value": "T1AC67339C871ED000F397F7F8706F025ED2759AA27AF8968B6B7426543DC76811E3630A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481205, "uuid": "3111bcfc-e960-44d8-9944-ee28780ee986", "value": "786432:tppzvJJ8jX4dKVkFSYFcQrZ5kewTkZ/7mkq:tppzv/01kFSvswTkZTVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481205, "uuid": "82e5f5a3-52e7-44f3-8f3a-804d5892d790", "value": 31743207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481205, "uuid": "53b135f2-b763-4e38-aaca-25697d0ce940", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481205, "uuid": "b6726d78-faab-4c78-863c-faf66119eacc", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc4ae3e-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455453, "uuid": "c88f9a2b-d0aa-49a6-88e0-febbe2b85746", "comment": "Malware payload", "value": "dcc5889e9a92b1c4bc6b068f6507abfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455453, "uuid": "346d65c6-8137-47d0-abad-5df3565ebbb2", "comment": "Malware payload", "value": "da23cc487690de293f4a631114a19c6b5150eef782733f52fbce71f864b396f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455453, "uuid": "6a80e87c-2114-4889-8cf5-564afa7f12ff", "comment": "Malware payload", "value": "5f83e3e055faea486e8d8d8d5707dbb9658217a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455453, "uuid": "cf4e0226-a285-4772-b9ce-d3a603576956", "comment": "Malware payload", "value": "06e3d7b0a55ddabad658595f9da650eb88d629f6fc52226ce317888ce357f2722b145a6a2397057c56396fecee332228", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455453, "uuid": "16529f13-f4aa-4da3-acac-055aad36a454", "value": "T19C3723590C6CEBBD0A51134C2CBFBE6E72DD8860C1599D4A6911FC4AE2E3F2A215DF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455453, "uuid": "3368b553-20af-4e06-91a5-d9b16ea589f4", "value": "49152:/SZPSZnSZaSZ1SZLSZ9SZlSZtSZgSZXSZvSZS2oLSZ+SZnSZ/SZ/SZV2okSZbSZx:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455453, "uuid": "7758f4c7-91a6-4d6e-87c6-7dd16c57e175", "value": 23684314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455453, "uuid": "27fdaac7-1f5f-4410-b4ae-00d4567b9737", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455453, "uuid": "59008406-3e54-46f4-bbe0-685b378f9409", "value": "invoice-1645080830.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dff75a-4402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777491352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491352, "uuid": "0b1c4bc9-fbbd-4d13-b62b-84e0b03a4ac3", "comment": "Malware payload", "value": "dfee2added6d55596e5bfa55fad9ff45", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491352, "uuid": "06611c77-0570-4179-89a6-8819b3833da8", "comment": "Malware payload", "value": "dab05de508fb31fe7a4ae0d6a377d386edcdfa2afcad800d042a36cc690e3b9e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491352, "uuid": "334f8759-0e08-451d-8aff-f1e8bf69a6f8", "comment": "Malware payload", "value": "08169db018f3f16f58af97c2e5cbe5dd7ffc6011", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491352, "uuid": "29f187ee-18d8-4ce8-9465-e9ab74bcc53e", "comment": "Malware payload", "value": "f054063749318172cd8b0c6d9b5002aa892be7cc5dfd3fec3782f6d3705045bb33eca2dfda8609e6b5897fa94ca91728", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491352, "uuid": "ebf6d796-2dfd-4a16-97de-63273d5fef10", "value": "T1A52523605FFAEFAA0FBDC33831BF1E4647D44F978889C9EA40521CA29B53F06856B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491352, "uuid": "ef487722-d02d-4efc-8cdf-414b241e5772", "value": "24576:cR47teAwoUck/cnwJW+m2JrCKxbLz01eYOtvYO:+AwomiwxCKWA7tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491352, "uuid": "ddff5cf0-44c5-4a67-b11a-2ffeae5c2b12", "value": 1045804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491352, "uuid": "e71d55ef-13ba-4d93-af3f-1ad22961bf8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491352, "uuid": "8679dd6a-7a94-494e-aabc-0284be1f1816", "value": "Watch.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2525dffa-4391-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442609, "uuid": "38852460-61d6-400f-a890-813905d26fcb", "comment": "Malware payload (Mirai)", "value": "dc6dfbc528ee3f214c8dd4428671becb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442609, "uuid": "6e33efdc-6ac1-4751-b2dc-6cc74aeca9d0", "comment": "Malware payload (Mirai)", "value": "db2099cab29b18070afbb0e7db0f2f8084ce7082bc486c5926337fe495938a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442609, "uuid": "bd867a95-809c-4d4c-b7b4-a332ff084d01", "comment": "Malware payload (Mirai)", "value": "4a660a25197aeb26334157c8165434f778a2f690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442609, "uuid": "cf3e767a-63eb-49f2-9be0-97da43f841d6", "comment": "Malware payload (Mirai)", "value": "566141852c0a4c6ec88d251d966c7bf2d858556cfb7d5cd82f981e8142717c9541d730372b1d6186dc6699172668e9c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442609, "uuid": "edf5fba4-28a3-4f5e-8b97-07e68d5b9a73", "value": "T16E334A02322C0E17C0A74A74253F5BE587FFFAD122E4F685261F87669A78E371085E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442609, "uuid": "66eef222-3f38-43bc-8b90-45725283f5e3", "value": "768:VWyL6uBIhNRLbv9ZdbhPKetI2uJa6eZ+wGQnyTHs96pMt2gIHiqwT:YvPJ7d9iB5YJZ+wLL9ELgICjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442609, "uuid": "ee7f0766-14a5-4edc-ac9a-17a491e1b575", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442609, "uuid": "3d74472c-eedf-465a-b6f7-baacf4160248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442609, "uuid": "a1fe60b6-c82d-4f6f-b302-88462d490cf7", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b3c4b6-43ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777481122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481122, "uuid": "5cbdd61f-851a-4a5d-b582-d5dd1809bd18", "comment": "Malware payload", "value": "5851296b482aec0267f5b3590ba4c209", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481122, "uuid": "57216d46-a73a-4817-ae51-515e1834db95", "comment": "Malware payload", "value": "dba4a6533658e2cd0807a735eedcd00a0a069421f4f301f3e17b7328a9633aa4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481122, "uuid": "17b74dea-0ff1-4540-a863-08c5036b1a74", "comment": "Malware payload", "value": "1e917156c603a0ccb08ed9e969d11b5b1ed0e47c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777481122, "uuid": "8c7735cb-ce9c-478a-9442-0f174d767236", "comment": "Malware payload", "value": "6e802b313f3defff189e454943027739593b8fd86e36e9711cc45d532f60b7450b0dfe4a671c26cf381c8c417ea9c202", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lapdog-kindterra-cfd", "colour": "#239000", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481122, "uuid": "48bbecb3-9fae-4927-bdd7-6215b5e5336c", "value": "T106370216B384503AD06F2A360867F6F2983BBA516A21BC576FE0094C4F395D4B93F74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481122, "uuid": "a93f5ac9-98ca-41d5-8762-08c363f0a3d4", "value": "7d548c37a2e49c7d64b1b5952e9eb3d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481122, "uuid": "326180ef-456b-473d-828e-30e7e305ac3c", "value": "393216:+cIQyOVYCp2vpQOmgUfS0jTkyOxfGqkqlw9ye26ibD7ZQV1UGb:jFrtgdNfGnyrpD7ZQPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777481122, "uuid": "0e9216b3-6097-4a22-839e-e66cbbfa667f", "value": 23320352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777481122, "uuid": "1d1303a9-48f3-4452-bcf1-bf15f678c58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777481122, "uuid": "b9da562a-0e5a-4066-acbf-877f0fc9b32b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921d0ac1-440a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494761, "uuid": "1c4199da-3122-4e16-b523-b651b0feb2b6", "comment": "Malware payload (Mirai)", "value": "c113ad0d8b5eec09a6aaa3af1d2ba0d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494761, "uuid": "5fde5038-1ac7-4ad9-8735-6d000507ef15", "comment": "Malware payload (Mirai)", "value": "dbd43cf8a5835208fbc9cc33188c1e4b55d85b6c5233e17b74f2b4e91f0e2922", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494761, "uuid": "92be95d6-ad60-4381-b1c3-600fc3901bb6", "comment": "Malware payload (Mirai)", "value": "3989b9bb2c2fc70f0b924d646f0853ba85fcca79", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494761, "uuid": "ca4ea69a-b8c2-4e01-a845-6ddde669d5c5", "comment": "Malware payload (Mirai)", "value": "9a5043a6de30d4ac3a267286bb3eb07583983cda4027028bf3582c9150777447ea47a5746d25583196d93a79b3f8fdb8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494761, "uuid": "f1c5bc76-6612-4809-9c48-da2bc11a5797", "value": "T1AED3F7C7F900DAF6F80AE3374853050AB130BBA649925A377257356FED3A1D90477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494761, "uuid": "a87b013f-7440-4d64-b815-199dd2f9dc8b", "value": "3072:+K/vKAAthjEf4H0SM+hbswVVjbiBLLyYIubJByQQalQ:0AAthjEDB+hbALLlIunyQrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494761, "uuid": "f1ed99cf-a6cd-4b4e-ac9f-c15d19fc4899", "value": 136292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494761, "uuid": "b42cc0cd-7559-4f79-bf42-2f6e576d55ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494761, "uuid": "6a957463-9c37-4959-b3be-468a088cf751", "value": "rage.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb971bb7-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493220, "uuid": "1c151430-de1c-4519-a960-89929d8372d8", "comment": "Malware payload (Mirai)", "value": "53e44a5fb730377ea6107f8ea89a1f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493220, "uuid": "945d2ec4-ef0b-4e1a-b94b-9bda0f89cc4d", "comment": "Malware payload (Mirai)", "value": "dbde8c10c2ab3497212b6b4b738f0356b7a7b861e2968242161af4570c6e2ec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493220, "uuid": "be6ee36c-905a-4fea-95e0-ae19aed2e246", "comment": "Malware payload (Mirai)", "value": "3ed7873fdc5517b3f73c2f36788357d194dca386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493220, "uuid": "5b54cf18-de50-46db-899e-b1fcb00a5b4c", "comment": "Malware payload (Mirai)", "value": "c80355d0e49888b76a243213a905a1ec9b0d82cdc53bf2280738af6d3910cce6f6413d4c66e2ab2d8cabe6694487effa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493220, "uuid": "d379ff2b-2ced-438d-b60e-20d1887a664f", "value": "T1F673F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493220, "uuid": "e239b79e-c0aa-4e6f-b72d-f3ab2bcd700c", "value": "1536:7J5dbFB4x92nKoIza98M26ofWU+UZ9CYXzdJa10K:7J5dxBu9uKoqIUXd4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493220, "uuid": "26de80f5-9473-40e3-aefb-510833e7c37a", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493220, "uuid": "8e1eceba-40e2-4803-9e8a-430cd8434bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493220, "uuid": "2a80b496-c2c8-4acc-958c-a78120d38e8e", "value": "RpcSecurity.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31731a3-43a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777453236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453236, "uuid": "0e5cd527-f9ad-42f3-88ee-b7d32c94b0fd", "comment": "Malware payload", "value": "c44dbf7541a2d0533a9d93b5c3281fcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453236, "uuid": "bcfa7009-bb4f-49f1-9946-07e96cd92570", "comment": "Malware payload", "value": "dbf08306ed3c5423dadff7e9daa2db0af8a759bc3d085d6b8a7e57ad4b628f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453236, "uuid": "5b7fb400-154b-49fe-b4e3-faa3650939f9", "comment": "Malware payload", "value": "98af751780df70aeff1aa4111a275823e1b9c4f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777453236, "uuid": "8b7aa22d-b9fe-4048-b264-1339671a2c96", "comment": "Malware payload", "value": "95ab8a90a7dd1f0084362819a2e29298237543a21bdbfb169c0a519c0aa72582613aa1c356880c54e3508759a82ac12f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453236, "uuid": "c268ec77-af63-486b-9d7a-4041d8bbe9a6", "value": "T15427CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453236, "uuid": "0c0613fa-c669-4df8-be12-46ffe1ce15ed", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777453236, "uuid": "b8f2aefc-113c-4079-a01c-11703905fcf2", "value": 22249472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777453236, "uuid": "046aad24-bc20-44e3-a0cb-6238014bb87d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777453236, "uuid": "e9b85161-73a3-4596-a9eb-945b82d272cc", "value": "dbf08306ed3c5423dadff7e9daa2db0af8a759bc3d085d6b8a7e57ad4b628f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd45a0e2-43ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777482835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482835, "uuid": "b9ba25a0-185f-4d57-88b5-cd5229f0a75d", "comment": "Malware payload", "value": "122261b9d8e10376ca510b46b73f5e88", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482835, "uuid": "bd541f83-3e56-42fd-9e8d-9affcd8389b1", "comment": "Malware payload", "value": "dc48b7355eb066806f9d93eda3f6b1960de95c513db23060255c8364bdc06715", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482835, "uuid": "09ab0c1f-76d3-4466-9380-163a9970190b", "comment": "Malware payload", "value": "ca7c630bddf82425f4f48c5aaf17a1d006d885d3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482835, "uuid": "ca9b2fee-bec6-41c5-a4a9-3388a134d550", "comment": "Malware payload", "value": "c57505cfd6797eabc27344fc0523438bb3ba26266d366af54b5342f093295a68c853ce414295c3d314018627d6ef201a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482835, "uuid": "0b5e9457-75b0-4492-b30e-fd0eecfccb32", "value": "T1C2B633A1E2BB1707EDAEF7B6E625F12E108613A8C91B81D6F95D267C504D3DBF11C088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482835, "uuid": "2e0831de-29a0-4bfa-9524-581f99212687", "value": "196608:cli64dcdP4ch69GxyTJk2jSOi6ahqFRKz8t0fl7hmRYGEznCsrUyu+uhNh4mKL:cGd6wm6M2j9iNqjo8t+l7uuMhll9KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482835, "uuid": "7d8a42bc-61f5-4173-8b92-49e6f82b1ecd", "value": 11361422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482835, "uuid": "79cdfdd3-89ca-45db-8a58-8134681e68ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482835, "uuid": "bc58511d-25d4-4ca3-a408-ba325ffcf898", "value": "1f86ed90-6b0e-41e4-b4b8-dee23cfba443.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451fae20-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470580, "uuid": "a21a2508-5db1-41e6-a4f1-1c92e9bd7f0e", "comment": "Malware payload (Mirai)", "value": "cceda88c5893d88d55d15908cca7be67", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470580, "uuid": "2d7845d0-d147-45bd-9b05-2e5b0e9f0259", "comment": "Malware payload (Mirai)", "value": "dc55983e152169e7071561f2f80052d7cfd03cee835e5542fbd5326efdfbe682", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470580, "uuid": "b00cd701-5a98-407b-8c92-d9e0f875ce64", "comment": "Malware payload (Mirai)", "value": "fa4a4e1d4929439f0bd6504904278ecbdd341ed0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470580, "uuid": "5aa62f93-1944-46e7-b369-16998d384dae", "comment": "Malware payload (Mirai)", "value": "5e50d68a1cbca1b0336330f1ae0a157f78657a36792fdf1890ed4bdd294c02d528cbf29a86345a4b7934bd52bc495ad1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470580, "uuid": "30ef6984-23ba-4cbe-b342-b51299b269cb", "value": "T124931C46B9528E12C5C212BAFAAE415D33136F7CD3EE7212DD20AF9063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470580, "uuid": "6977d5fc-b6de-4205-a1dd-753994197cb5", "value": "1536:gUnBEkjRCMMZ0l3EVepOFnTRfGqtCMu/5hyHvhcY4smvVaZ6fEEarNQ7ibQZfn5v:KktCB0qVepOFndfGqtCV5YHJcOmvVaZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470580, "uuid": "de0f7591-5ba1-4e70-8b97-156dd8841580", "value": 96856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470580, "uuid": "c4c08f9a-ce53-4118-a301-f040a6efaabb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470580, "uuid": "cf71fca3-e528-438a-a3e9-a31c95d642c9", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b723445-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455585, "uuid": "42010fb6-5181-4833-9376-806600b550a0", "comment": "Malware payload", "value": "0ed05e272647d8fb72fcf7a68c32ab9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455585, "uuid": "ca32e882-f5f5-4218-a8f4-d84696e571a3", "comment": "Malware payload", "value": "dc93908b4da43960edf140eed1df84686c79c4ebf600dac6ab8b9fdc7e2c299c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455585, "uuid": "cf2daf80-ca60-4d75-ad73-31e4cc6e1c4d", "comment": "Malware payload", "value": "d86c6657bd916b6b72633304e7d0282c546607f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455585, "uuid": "262fa8d7-5fc6-4088-a89f-c33d6dbb557a", "comment": "Malware payload", "value": "878accfeabdada64e2d74510afbfb6507490d9e683bf8b1c8958b7b4d464bea26d72aa2e3aa4de6a4c1a4178f3553611", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455585, "uuid": "ae86eda7-2a35-49d6-961d-06af4519b1b9", "value": "T1D13723198C5D8E5F5A9C724D783F581998CD2C4081FDBBB691837C64EE1FB883CAB216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455585, "uuid": "ebe3322d-a643-4a46-84c5-f4a8999798be", "value": "49152:2DFsfyDFsfwDFsf3DFsfKDFsfsDFsf6DFsf8DFsfEDFsfFDFsfmDFsf+DFsf52Y2:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455585, "uuid": "30ffa302-cf3a-4a2d-b4a7-9f43596f5f4a", "value": 22643805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455585, "uuid": "6279609e-a8ea-4615-a89f-314880789a31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455585, "uuid": "8a36284a-4811-40f1-8e7d-ba1baec16d2f", "value": "invoice-1645080830.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b69adc-4426-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777506770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506770, "uuid": "41ca2ada-5e48-491a-b391-38bd6179defa", "comment": "Malware payload", "value": "c4e12a46436145c75f0baee177259e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506770, "uuid": "1a4a4868-6726-4d0e-8b31-03bd9393555f", "comment": "Malware payload", "value": "dcff258fefc0cc50eb51a772bcf08af5c44f85b93b1a0e504b5860712c6ca45f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506770, "uuid": "a51bdb8a-9b80-4311-8832-bd7e59873674", "comment": "Malware payload", "value": "6c1e5365bc637716442750a74b36a3ef2f148336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777506770, "uuid": "40480e66-60e2-4550-ba88-00576d16d532", "comment": "Malware payload", "value": "4f060182ba480d556c5af41b1cc547ca75c4f8001dfefa2e6071afe44a64f7e038f684253dcaa16f5fd8efcc778635a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506770, "uuid": "6460402e-3b8f-4ab1-b62b-5e2b44457023", "value": "T175566A57ECA564E5C1AED5318A729262BB71BC491F3163C32F50F2386F72BD0A9B9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506770, "uuid": "94a603b7-4871-4fcd-b5b8-85754d76aa3a", "value": "49152:+5XOOzyThpRk0pL+3ZVFSIUDlQ6te2hSFG6JeTmdT+7aApIKlK1KcZKDSb5EY:+5Jz4RMidSxcTfuZpEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777506770, "uuid": "18d1b304-f3ef-4403-aa6c-13871348f19f", "value": 5914786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777506770, "uuid": "853d195b-1ec9-4e0c-84c1-32a31018b462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777506770, "uuid": "22ba014f-9dc7-4ae6-b3da-f7aba2a38831", "value": "httpd-kworker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e9a229-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493216, "uuid": "b098f12b-b4b0-492d-840b-9d949d03d034", "comment": "Malware payload (Mirai)", "value": "87cf8e117119b16721567dc1aa7a30a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493216, "uuid": "4474602a-a583-4524-99a3-e08d611f1763", "comment": "Malware payload (Mirai)", "value": "dd111b9b7d464f07636fb52b8a6fc8b9c9e78c56a1ee9d720c78fd62c8f755ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493216, "uuid": "385364e9-0fac-4d78-b91b-4111075a0abb", "comment": "Malware payload (Mirai)", "value": "25672214ec7323626fa27f1a6ea61a0463a404c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493216, "uuid": "3607897d-2a5b-4fe6-b17d-9b57629d07a1", "comment": "Malware payload (Mirai)", "value": "63e4f92b93fd6fd6c2e5fabfa219b23c87cf51f8f8cdb6acc4334272af30daac0c57817160744b8fb612fbc200888c4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493216, "uuid": "3c61e4c8-dc3d-49ee-be33-764c543d9947", "value": "T1C5B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB5A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493216, "uuid": "c4cabad0-7e4c-4537-a67b-73e404219869", "value": "1536:Rg4uLcytbI96gfY2aye7tcOiyRLqlqOgb3a10z/LWmoo:e4uLcytU96OY2JatcwRLqlqOgbW6qmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493216, "uuid": "89956e69-e416-44e3-b3b0-11d3118ad8be", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493216, "uuid": "acc0deb2-41c0-4f24-a0c6-e9998f096d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493216, "uuid": "fa9d4853-505d-4ba3-a002-9077a8bb219b", "value": "RpcSecurity.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a35fa87-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455476, "uuid": "ecfd47dc-e1a5-4b5b-85d5-173ecb6b873b", "comment": "Malware payload", "value": "8eabbea74ba94bb2a47189deebfd3331", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455476, "uuid": "10edaaca-c6fa-43c6-991f-69190024ee89", "comment": "Malware payload", "value": "dd4abc74733a513ea9478e8eae6ab00366ddc2ea81acfd0f9ed6fd32e4b1a577", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455476, "uuid": "062b247f-b10e-4772-9d85-0a356bcc514b", "comment": "Malware payload", "value": "64d2973fde5bd984322c395d94d5e700d9dd2358", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455476, "uuid": "8d4e59ef-0cef-47c5-bb9d-ed33a03c8ef6", "comment": "Malware payload", "value": "d04939901b0c42a42a13e6c793ea7ed2d1aa15397c62f74db91fb7ee421d957b15be007011fa4585797c8b3343e5d73c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455476, "uuid": "9d358ce7-83ee-47b4-8a14-88c1d0764364", "value": "T11B372342CE122EAB413C21D4106E5F1E6FF74FA99521A48B7BF8AC1DC71DE02944F6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455476, "uuid": "428c6ba6-b2ff-4f20-b470-ca566582f762", "value": "49152:KK8nK86K8gK8DK8XK85K8mK87K8+K88K8BK8/PW/9K8uK8sK8lK89K8iPW/0K8iQ:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455476, "uuid": "31510aaa-1e0e-4908-a6a6-fa00d28476aa", "value": 23424201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455476, "uuid": "3b2a2387-5538-45a9-8d9f-778627314c05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455476, "uuid": "dbda45de-d005-4f27-baf2-d0cf078e4f07", "value": "invoice-1645080830.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31c7ca0-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777479757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479757, "uuid": "6171f29a-fd64-4e1e-bc8e-bc2b2b0c6297", "comment": "Malware payload (Vidar)", "value": "f430f4610264efac278954fe7e3e52ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479757, "uuid": "e72b4207-43e1-4f00-bab8-a4fac9413bdc", "comment": "Malware payload (Vidar)", "value": "ddec560bd692e8b4227d183adb0a8988546a7ce7e8047359a532001f9954ce49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479757, "uuid": "6f716a4e-641e-410b-aa82-adf51cddf478", "comment": "Malware payload (Vidar)", "value": "7c0be94151e125c06e0ceff0f56e4666041510be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479757, "uuid": "b31ea14b-54ba-4da0-a1c4-f366421192ab", "comment": "Malware payload (Vidar)", "value": "00a1a58150384de2e05b7236724b6d772e86ecbad44d5f08875fe500872dd81d7ead61e0941b385bc740422874a4407f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479757, "uuid": "8cfe40df-d1a8-4291-9173-541a4c62274f", "value": "T12AE42ABE9C60B326F60CD0BAE146D7538F2138411236B9A319BE93241245972DF677FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479757, "uuid": "999ccc6e-e679-43d1-8508-bae5572a4823", "value": "9a87247ef695d21e144056c4f4703061", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479757, "uuid": "c72a2e61-90d4-4558-a006-80f681d27ce0", "value": "12288:vQYyhKHH6MCmgWeh94xDx31qZ7gzt6KdtFT+MRmYo:YY0oH3gWca2Z0zvdtN+Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479757, "uuid": "7b2db658-e4e0-4211-98e1-a3c8b7e8a906", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479757, "uuid": "f94e5bec-d15c-4a1d-8a7f-1217c91489e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479757, "uuid": "853ddbe3-0226-4259-be64-a3a01f277c53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9f23a8-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495047, "uuid": "d961cb70-8c42-43d9-9719-3a2a35b03ba5", "comment": "Malware payload (Mirai)", "value": "691bc03dcea25260c9c1295a4a5f6dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495047, "uuid": "28182d1d-cd68-4d2b-9fb2-8ae77c3e83fa", "comment": "Malware payload (Mirai)", "value": "dec14796198be4d84b598da232a30a6ef9c0bdf992cf14abd0b32b7239a7075a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495047, "uuid": "17a384ba-000c-4877-8974-3881dca5a427", "comment": "Malware payload (Mirai)", "value": "9ba6460fb74da541de71cebd5e62d3ebc48f3003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495047, "uuid": "ea0ca6f0-7bf0-409a-b3f3-33f65a72cf26", "comment": "Malware payload (Mirai)", "value": "c84884d4d6ad93af10c6447fe13d888da1ef84c449cfe13933d8275a1508cb9df1e00617d74f23f380d5279ae27d7a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495047, "uuid": "ade2a292-b388-4746-826b-99408bccbaad", "value": "T148732859F981AF11D5D525BEFF0E528933534B6CE3EE7212AE209B2463C6A2B0F77401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495047, "uuid": "78e3a056-f28a-4cc5-8a3b-ce85c2c5e238", "value": "1536:+FnQIqUaayqmsFSlYfiQ8X7kqZtwl4wdgil6Y2A:VUaayqmsH8X7kq3wl4460", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495047, "uuid": "81f92c61-45f2-40a7-9fd0-b80573fe4df5", "value": 79372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495047, "uuid": "fd2e4762-f92b-45e0-9d7e-1e51171372d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495047, "uuid": "fdad84bd-2ce2-416b-bb60-70290c2c3232", "value": "rage.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e820aba0-43fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777489752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489752, "uuid": "391e97ce-6bf0-47d7-a5a3-cebf4c4720e3", "comment": "Malware payload", "value": "61bd8751614209a65d74bd7fd6eb7f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489752, "uuid": "4681aba2-e95c-4db4-b716-4549543094e4", "comment": "Malware payload", "value": "ded1bd8f0ec2dad6756f04300ac20bb34c27b2379e41b8bb73040b9e20d25e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489752, "uuid": "18a62bf8-3176-4dd2-a2c2-9c07295f016d", "comment": "Malware payload", "value": "4da3c0136e06244751c92b423166728f95a74341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777489752, "uuid": "ac6329b3-b6f3-4679-a84e-16b83ebdfa5a", "comment": "Malware payload", "value": "37df12a0c60a425eacbe6f3e17ca403efb8714cde8c14684a07bcf5a4b31c8b46087d75fcba63b74284d9aff96bf2c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489752, "uuid": "4d0bd553-3583-47a0-badc-0057f4175a99", "value": "T18746DF40A8ED5464F9C2B83C236FE867573E7F09A594E9DE82F4CEA31F1BB85805C506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489752, "uuid": "fe29626d-8347-4f8e-9012-985b00241551", "value": "d4d8a548490910c2e9bccf34d2b22d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489752, "uuid": "19db4b9b-fa15-4fcb-a24a-8c3cf9c744b8", "value": "49152:oUw8G5VZK+6szVdmA6J5Ke8Vz9FuhE8jy2vNS93BNM0V0zkz5:oh5igzVdd6HOz9shRjXN83Bp0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777489752, "uuid": "df20c8ac-4641-481d-9a35-0d429b311efb", "value": 5446144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777489752, "uuid": "4cdbe178-95da-4609-835f-a30a53a095b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777489752, "uuid": "9b7c894c-fcf2-40b0-9a5a-5308625faa63", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30560ba3-43be-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777461955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461955, "uuid": "8dee49db-4223-4683-9313-7c871bf40d3e", "comment": "Malware payload (ConnectWise)", "value": "386a804e291d30f0285572844968b72d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461955, "uuid": "30bd1d67-d9d9-48e3-afc6-e3a813278b5f", "comment": "Malware payload (ConnectWise)", "value": "df4fc899684b91d08f93c11b412bdc8fa5447f78938aa0c30a8a22cbc3ef898d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461955, "uuid": "1fdea15a-367d-427b-8095-d3063691f84e", "comment": "Malware payload (ConnectWise)", "value": "8ea357c6ec7210e91612590ea40aa88c82b787b1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461955, "uuid": "33d75ce1-7398-4ed4-be14-79d789bd68a7", "comment": "Malware payload (ConnectWise)", "value": "3848c096bee8f1a4ecc2389ebd2b214050b1ab82837325e419f5067af9ae3b604ca3f34e772f024ecb8b10795bd6ca79", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461955, "uuid": "83982add-9d5d-44a2-8da7-9ebd78437ab3", "value": "T18756F101B3E685B6D07F1638D87A46A55B74BC049712DBBF5390BD692E33BC08E72362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461955, "uuid": "41fa7d92-9a59-453d-88ba-1e992dbc2c3f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461955, "uuid": "cde06662-a910-4c9c-b507-3926b27b6365", "value": "98304:UzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:UhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461955, "uuid": "af492597-ac7d-4734-8d79-b3f8fc01a6db", "value": 5966336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461955, "uuid": "7188697d-c6b7-4a83-887b-5617fd6e8bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461955, "uuid": "dc1b71bd-84a2-4c8b-b63e-3acd4f1e1069", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e9193b-43f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483867, "uuid": "2374bc8e-a095-4a55-99da-0b352ad4627d", "comment": "Malware payload", "value": "383fe18e8b825313551b32b516ad119d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483867, "uuid": "10e0d94b-6bf0-4d25-b426-c870c602cdb0", "comment": "Malware payload", "value": "dfded917f5ebfbf2725ac68a2c1f1da77a5a916fa4dbbd6bf347cdb2f05d8e40", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483867, "uuid": "bb03878b-5d20-4489-9a92-1cbca51fe87b", "comment": "Malware payload", "value": "47c9daf066bed7e93063e6eb2fd049755389643f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483867, "uuid": "0f1a0ab3-6bca-45e9-9726-6bcabf3d9d06", "comment": "Malware payload", "value": "93f3486a21f944af70b842ce1346ee3d79816e87d605c0501b728126081191a6d0e0a21455d9f12060def781116654cf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483867, "uuid": "72da0629-6443-4b50-8a68-cccef2a8ba06", "value": "T106B5ADC357DC08ED7B8444E942593A5354FBC26B2C9E528CF5E25A07763F8217A3ABB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483867, "uuid": "e68392b8-a159-4d18-8418-9dcc8b6da254", "value": "1536:QN5nu1/SzC9FJKMvMG9o4qWoz3Oot5WtXjYzOA848PNOa+OSlz3qJZ4CqF6zpSI1:QNckkBvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483867, "uuid": "4b4e4b27-fad7-4d50-975e-f7ebb70b2c09", "value": 2275394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483867, "uuid": "ef1ed0c3-c78a-4912-9358-a40e8b6e6a91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483867, "uuid": "ad901a76-4c9c-4099-8d4b-f6ef2f6c93ce", "value": "cl-ncl-finalize.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8139f869-43f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777485713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485713, "uuid": "b1eca78d-6490-4e70-b01a-fcc0f70618d9", "comment": "Malware payload", "value": "219ae4b7d146158d24d87dac0ac58ae7", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485713, "uuid": "663eb8b9-b295-4619-92b4-e17ad6b51c17", "comment": "Malware payload", "value": "e2ef9fc25cfdcdc83f38509054ae292a3550db176566c446e5f6225be8e93f38", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485713, "uuid": "560301e4-6842-4dd7-8355-84343b4f8e8a", "comment": "Malware payload", "value": "25abd125525140427f9d85a6bf671a1b4b811540", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777485713, "uuid": "23e45f2e-2682-44e1-b43d-930ca8d8feb1", "comment": "Malware payload", "value": "ab609f9b5a60d41258aed76e087520dd06962885337438d4b8310acc629d7c5fdf721b02742ee6a7eb4c0d073ac5c2bd", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485713, "uuid": "f1d6f53d-3de9-45d4-8883-49a0acc9cd8e", "value": "T10C85D01A4DC31EA0C6A48B39D3AE10A863F04A2B4615E7EF5DD913F4DEA174BF5170E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485713, "uuid": "eb81b6fd-fc6f-4481-bac6-fc69bc5b9696", "value": "24576:+pl9R+lvBRxZoQGE+JiCmUMbrRa3Tx4cV0dhig20r:UBgBPZZYmpbtaehV2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777485713, "uuid": "a2320a67-a425-4b6f-80ad-5d91e5a0917f", "value": 1756160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777485713, "uuid": "89590340-aeea-40a5-95f6-2baf679765a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777485713, "uuid": "b981f1b8-0e34-467c-9982-50723d79d9b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe03e868-43c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777467025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467025, "uuid": "254c854d-5513-49b3-8dd4-3b21ab0f95d9", "comment": "Malware payload", "value": "24d9c5c66db94c28e4e83dd6b97297f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467025, "uuid": "699a1584-9c5d-4ff3-ae4b-fb38992a0704", "comment": "Malware payload", "value": "e4415564eea1321b7c4f7f4cef1dcab41b1a67102025f60d65c6255c0affd696", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467025, "uuid": "9bf415e0-f564-4864-a0ad-076a8fcb21b1", "comment": "Malware payload", "value": "144bf343582585677021a0db849734f60d37f317", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777467025, "uuid": "6ef2e85b-777e-49ce-9882-69004b46a47d", "comment": "Malware payload", "value": "4c48e1465ee19844b273a7ea18d60fe3a604076a7538cae996b825dfa08d6e7372e4f656d6cdb0b82c1851b84dba4fd3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467025, "uuid": "2264cdf0-af8a-4381-ad0b-d17b3c4d70ce", "value": "T19F01B1EEB175ACB8FD057D6AA8815BC06105F59B5D670F4D3C0A2E20FF861787039A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467025, "uuid": "ed4e57b9-0531-4d27-8889-9c4b95e5dc66", "value": "12:Yb2IGoi6yHPUR5uxjLVZYDIyHFIjVnIdedIIeu:GiYR5uxjBeUySjVIdE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777467025, "uuid": "93b8150a-a1c7-4a9c-827e-521985e21b77", "value": 728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777467025, "uuid": "4c9858c9-e2f5-467e-85f9-8e265dfa8afa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777467025, "uuid": "d0287b99-698c-4277-8384-3579d5742fa0", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f20eacd-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441364, "uuid": "88ffb9cb-e8b7-4c33-818f-8005e8298bc3", "comment": "Malware payload (Gafgyt)", "value": "941bc4636bb3358fc457dd20d63484a9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441364, "uuid": "9d6fb069-b658-4ef5-bf68-cf55310c8bc1", "comment": "Malware payload (Gafgyt)", "value": "e444b6b110ff36c4ee3fe7288592890cf0d9d1850dd508a6636f92ed3cdc459d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441364, "uuid": "738277ad-f7dc-4546-b1be-5400926cee62", "comment": "Malware payload (Gafgyt)", "value": "24a4949fe6e27c25c4373c3ac68bf8412dc30d2c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441364, "uuid": "e5a02159-c058-406b-9b79-f68d9a5904dd", "comment": "Malware payload (Gafgyt)", "value": "94003fc7dac1f3dac92457e3e112543cac8b4f6c1827a3fd2c654ff45fe6445fe79ce3aadcae8bae4f66f128f34412dc", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441364, "uuid": "04bb643e-5e58-49d6-8650-f13867aabd35", "value": "T148E3646E7E21AFBEE268C63107F75F708395219326A19382E26CDB185F7128D1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441364, "uuid": "5cd72f87-4df0-481b-a0da-666943894202", "value": "3072:bOwVZhQyr7g8+t+X5hKWL8YlxRxulq+1uPNd5R:6uxrUMX5hKWLblxRxulq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441364, "uuid": "3d692d7e-2879-44ce-ba6c-0b806bcb814a", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441364, "uuid": "9469338d-9778-425d-8259-249075820c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441364, "uuid": "3add74e5-a21a-49d7-943c-ca14257fd7aa", "value": "assailant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc409373-441d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777503019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503019, "uuid": "f882ee51-7936-4e90-8b22-2a0ea92c34f0", "comment": "Malware payload (Mirai)", "value": "80350c4a9df2abdf2425aa17d16980b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503019, "uuid": "c3edc54a-9887-43b8-932b-d72be98e00d7", "comment": "Malware payload (Mirai)", "value": "e47146ccd375c8b273930571807f437c80cb682bb41e76b9773396b4ca0f7235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503019, "uuid": "17cb7860-c407-484d-b7d0-073cf4a2d854", "comment": "Malware payload (Mirai)", "value": "1e02d272379824fd0108d3561b468b719076f599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777503019, "uuid": "c4318ee1-ef23-483a-8d4a-75580bc7232e", "comment": "Malware payload (Mirai)", "value": "b2abe3bab8faa8fd5fc64ca07cfe62cd9226374b5b84938d02db5e523d09ede07bc267af3bef4ab6190b65c9f7539e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503019, "uuid": "410ee2c5-8880-42ce-845c-dec12f7eca44", "value": "T1A614961A6E328F7DF368873447B74A35A75D23D627E1D684D1ACC1052F6028E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503019, "uuid": "2abff65c-e3e7-4bb0-bf5a-dce444056ca6", "value": "3072:GIYbNR5OJWned/82vuEf8u4jl/yvchJsCwXxhTJt2bGHsQrZ:G1VeN82v+lpKDLhh72bCsAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777503019, "uuid": "2fc0e3d8-9bb7-4e89-b41d-e7c6b50e50d0", "value": 204352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777503019, "uuid": "699da4ce-8b8b-4d33-9c88-5859c3b80e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777503019, "uuid": "2efe94f3-fccd-4c12-a747-982ea2e3f708", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945aaf4d-43ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777490040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490040, "uuid": "782dca6d-1bb3-4f17-8821-2c16463dec4b", "comment": "Malware payload", "value": "abf5e29d7d882dcfdf77aabbe1510b3c", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490040, "uuid": "5bc896d1-c5fb-40b6-9950-668829be2abb", "comment": "Malware payload", "value": "e4ea8cf8a2e43d1b648d47bde042e7f9fe486b2dc96cbbc987b1cba2b6440715", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490040, "uuid": "2bc93292-9c70-4976-ad2c-4eea007983ba", "comment": "Malware payload", "value": "ab04505aa6e3920a7166df509cf227d41e134063", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777490040, "uuid": "664c9043-c7fe-4358-b5f4-fce01e1acac8", "comment": "Malware payload", "value": "0b232bc69e383200555ffd1e6fa6b45211c44df3895c6319cf7e6b57d8fa1791b7c0d665c54ad6de1357d23d777d227d", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490040, "uuid": "a7235b79-ac53-4a77-82a1-53a1f2337fc9", "value": "T12F139D65B70019A48F768EE5C264C7D097487DBA4DCDB5C8EF883350198BAB5CDEE0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490040, "uuid": "5ebadadc-ac62-45dd-9734-df8b995151af", "value": "768:uIskHLalRwwuzUY7oWXvIZNCrckC7lrvFaUWo6SOTjBf9HZAT02NjylWM1c5hQC:PrP4Y71QvCrct7lLFJ6Suf95AVByc5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777490040, "uuid": "b05b791f-7a45-4b37-a3ad-5b5d1a772779", "value": 42512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777490040, "uuid": "f94647cd-f885-4d0b-85e1-bed63799ff01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777490040, "uuid": "57b870b8-410a-447b-8c2b-878d47a318f7", "value": "ucase.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf5b2c4-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488953, "uuid": "f1320d01-d4b8-4016-ac44-22b9a1b31408", "comment": "Malware payload", "value": "d4cdd3385c39b9b48b8939947f110b08", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488953, "uuid": "522a3c5b-9e67-4116-8675-5aa7d14150ce", "comment": "Malware payload", "value": "e52133f89263dde7e6de823408de2d97c810a263dc10eff4a00623ab8135818d", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488953, "uuid": "ce1ce999-b2be-439f-a36a-c1c49f21518f", "comment": "Malware payload", "value": "0b0084cb450c797d38a6eb80b9147c98c8c3c869", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488953, "uuid": "fc7fd419-ec55-4111-8c63-d79e9dd1855c", "comment": "Malware payload", "value": "f2db072b04de737747b027417b5d5ebf1bc3580ba5995766439746cd3329f58b44ba5842f3fa27dd3054cb61246b669c", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488953, "uuid": "993de47f-8128-4d10-9696-febd8bdaf304", "value": "T134139E89EBC74FE152FC8AE038AC05E8277C089645D07EE9B3CD39591D4EE5968950BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488953, "uuid": "dc9217eb-392d-460a-b755-127c1ca12cbe", "value": "768:uIs5OuNUM6YHMANQrFiC9u9MncEgCiCVGTeItqvaok8JL2NOylWM1c5hVk:urNUM6YsANQ0+n4DC8aI4vaX8JJByc5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488953, "uuid": "f9a30055-16b0-4b56-92ac-d6c184eef1cb", "value": 42424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488953, "uuid": "38319ad1-410d-43b1-b960-7bec22b63b48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488953, "uuid": "d53e6061-1ef9-451c-89f3-92a0217d15a2", "value": "epeqo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56f7ff9-4366-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777424437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424437, "uuid": "7de2b7d6-8f7f-4d32-8e28-f747048b1322", "comment": "Malware payload", "value": "d16f971568c4c5b93dd24d4071770d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424437, "uuid": "7a5646ec-4bde-44d9-aeac-e20543205017", "comment": "Malware payload", "value": "e59b9bc454ef9addbcbe3814f6de5c7a90e0a6221d1779d577da686e6875454c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424437, "uuid": "c84af261-a8f9-4f9a-b427-b84ba25bf8c9", "comment": "Malware payload", "value": "03cc1fdb6910f681a2c6bbc96c230c89c1a02a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777424437, "uuid": "781143f2-d5ec-4afe-9d68-bedc409d1e6d", "comment": "Malware payload", "value": "3ea5238c9f82bfcbeeda93b47749f4d137929af176f31188ef1814b1bb47a6f87d6ac704b760da8eb93fb5274d3f2149", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424437, "uuid": "901bb5e9-1054-48c6-b5cb-c4aaa26976d3", "value": "T18DC5F857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424437, "uuid": "ad621c01-eb92-4eee-96b1-818b7410e2f3", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2E:cqYUQuVDt0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777424437, "uuid": "1b1837e1-bcc7-4d11-b4ba-9b3d78c42397", "value": 2719744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777424437, "uuid": "161c9b18-1c4a-476f-b1bf-a6f2b202b072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777424437, "uuid": "f0c13ca8-6589-45b2-9244-caf32d748a66", "value": "e59b9bc454ef9addbcbe3814f6de5c7a90e0a6221d1779d577da686e6875454c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7d585b-43bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777461471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461471, "uuid": "4ab29c05-b8a4-4539-9b27-e8aefc2bdc71", "comment": "Malware payload", "value": "5d1110a8e2e4730dbc0fa6f95aa10113", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461471, "uuid": "5652e089-29ef-4d6b-9e6f-3fc3917f2568", "comment": "Malware payload", "value": "e6117d38803d87bb1b5a1e1df4e5c6f981a8dcfcc37f49bf70c098b230a42e62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461471, "uuid": "134a5116-3264-4570-a384-fee75456ed06", "comment": "Malware payload", "value": "dcf1b5d41b0c67dec9fc002fdce5bbb3cdfb0dc8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461471, "uuid": "56dbdf8e-3383-476e-aa69-bd45f3c808f9", "comment": "Malware payload", "value": "f319bbf1f383c938ae3a2e5c9f065e72502322ef18e3953f02c8cc7ff22cf18b1d6870a96bacb786a807b4f09238e1a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461471, "uuid": "e584bd91-edff-4e7d-90a6-2ea3851e6953", "value": "T18201A2C5F4E1AAA2D404AF92B061840780EBFFDD17790FD85A9D38F68C9D904B453F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461471, "uuid": "2f20d563-31ad-465a-81f7-3234b09df878", "value": "12:3WKDyPIacxQZrKwMIAZrKCCAZrKGrEQAZrKGcCWTAZrKVqZZrKr:GIYcxQZe4AZeCCAZecZAZeIWTAZeVqZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461471, "uuid": "78a34c68-470c-4572-aee7-4848fb41fd6e", "value": 682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461471, "uuid": "3c54fa1f-44b5-44aa-805f-97a1154ebe16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461471, "uuid": "02b93b6f-92d4-4652-a28d-57a7e2c50acb", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37899d14-43c1-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777463256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463256, "uuid": "38813051-0766-43be-b7fc-92dff7e868cd", "comment": "Malware payload (MassLogger)", "value": "7789d8b10942ef4317375019408bab1a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463256, "uuid": "e8903a0b-7a19-4764-8309-c3173a4b4ebf", "comment": "Malware payload (MassLogger)", "value": "e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463256, "uuid": "ddc501fb-da48-4ac8-9178-bd2153b8b5ec", "comment": "Malware payload (MassLogger)", "value": "ed583c6096b7dbd79a179728afea999249affd0d", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463256, "uuid": "c64bad7c-7d20-457c-8d8c-6ca19ee87316", "comment": "Malware payload (MassLogger)", "value": "2c4b504755a786f1f93bc12bc74df2ae09aec824ef42e2837d7a14aa3851ccc7e231654325b8ec26bac22cd7923d027e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463256, "uuid": "bb167933-0692-403e-afbe-9e9a0c8cf406", "value": "T165042361FF6EAF7B33A4C21D718FC548ED258A3481B49194D60AD486ADEE51FC32BC18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463256, "uuid": "f7011ec6-2cd0-487e-b234-872950aa76cb", "value": "3072:u1qpfVd2UwF9O/sgl0y37m91aEvpmBLCVrTxhs+GcozgcU4UyjdZCWOWqS3es:HVWO/sgh37m90A7/7ozvU4lvC2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777463256, "uuid": "817051fd-549d-434d-b78a-276e85dd90e6", "value": 174018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777463256, "uuid": "c1671ca2-d34d-474a-a009-6abc99831982", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463256, "uuid": "d8f040ef-95ea-49ae-8bdc-e83f1787d2a2", "value": "Shock.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef1aa26-438b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440317, "uuid": "c43f5fcf-cb6b-4093-90a9-8fc7c9b53134", "comment": "Malware payload (Mirai)", "value": "a2403fae07c53d52d8125de038feb42a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440317, "uuid": "98c9e5f9-5afc-45a3-ac5c-f339d57cf1f7", "comment": "Malware payload (Mirai)", "value": "e66421471d72be7acce02ed5991d81d88dfeb3882d85f674b935694bb2cf7944", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440317, "uuid": "47e66401-035f-4ece-8996-6e3c44a26a93", "comment": "Malware payload (Mirai)", "value": "e03082982bcc10bbe6f200f7ad64c5bd9e6742de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440317, "uuid": "090531b6-dea3-4302-8374-64c5a14b968d", "comment": "Malware payload (Mirai)", "value": "d74341d2be4b59eb009360a4938d30de2a8b55fd1ff2fcd1012873b1fc52a62ae244c37b9a1868578063e423eb03df8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440317, "uuid": "5ed5a214-01e7-4244-8a2f-e30e8882ff85", "value": "T14BB3F845FC409B17C6C665B7FB8E438D7B2A1758E3EE720399256F30378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440317, "uuid": "be515db6-9078-4f44-9532-2419b08dbe5d", "value": "1536:xjWGe2TXA7kQ4VBL2TFwdQHmbOuYLR846YcQlFclWBwywXMrMqoXmH7qCyQ:UGpTXM4v2xwdwNR8vYVIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440317, "uuid": "f2ac7c6c-a6c6-420a-85af-e54a735a37a6", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440317, "uuid": "9e360e21-ffcd-4d43-8435-0977a638397b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440317, "uuid": "dbd8b6d1-007d-4b06-8d3b-e8a8f4316cd8", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3058a1f5-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451647, "uuid": "76ff284e-0d3a-45e1-bd9c-f7e564269454", "comment": "Malware payload (Mirai)", "value": "4cddf1d63072bfd99a4e9db0e2c130d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451647, "uuid": "4fbba511-6c38-45ce-9fe1-b6e7d70e6c84", "comment": "Malware payload (Mirai)", "value": "e6ab66d6f9f19908575f9276441b255c490c41d00904568f0ff8d0543a485a8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451647, "uuid": "b5c888b0-2b12-41be-a593-ca18f1d2687b", "comment": "Malware payload (Mirai)", "value": "99b91e0de6728a36269fcd44026419b96bb12195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451647, "uuid": "ee78d977-f611-44ee-95e5-9efb62db304f", "comment": "Malware payload (Mirai)", "value": "11cafba27497f2e3d949699c5cec06ebe3cd3cff7899633240a7526e286d5e3a6e5c5d726d8bb4991e5323d1de4841d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451647, "uuid": "2914eebb-7912-478f-9491-643d20a7941a", "value": "T17C130A56FC829A2EC1D006B5B65E298E3721A3F9D2CE3307ED508F507AC661E0D7ED94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451647, "uuid": "534ef2ab-341e-4a87-9726-e7e5d0b6542d", "value": "768:spRCmZPA2w0WcZVBbrFTOB8IkCgVcHCks9d7JHRzTx3pA5J2lPZHVjCDvl9Uettx:yPIN+VVRTF71YWXCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451647, "uuid": "cb53dc60-7f91-430c-8fbf-2cf4995d5e7d", "value": 42604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451647, "uuid": "cb98982d-a7fe-4208-93d6-e8f7647b3a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451647, "uuid": "5a258d22-d3f2-49ac-8293-ed35bb3a240c", "value": "asuna.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311ac174-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "c379a840-2695-480c-9d54-0bbd03aa3c84", "comment": "Malware payload", "value": "d3e00e5279892b71e18203c472cbe8dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "01d3af64-2ef1-4e08-896d-292f68ef09ad", "comment": "Malware payload", "value": "e6b847a3cfeae0e63cd47d25e79e40fea5c53cccd11193b0282b42dd53d80378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "3ec7c9a3-cf99-447d-a62f-801b869267cf", "comment": "Malware payload", "value": "547f924d38e3f2c36f8ba3c922a145375a23f319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479996, "uuid": "b3c99010-19c5-40bf-932f-1038c0207d07", "comment": "Malware payload", "value": "2ae0da62157d66862803e4ee828e9a0b3ad4a42316ce81cbf45d9626b7051784ef2389a77a2e949b9fcb7b3b635d73d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "1941cea3-ade1-4f94-a9e7-3cf4dca66d3b", "value": "T183183352D8FCED63D5FFEF3093B41093828A95CB58881895994927BEFA8C1DE215C732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "e28ea5c0-44ec-4a80-abd7-410cc6527e44", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "654b4def-b2f9-437c-8d60-a4d1d33b916f", "value": "1572864:e32YV1HNDDCo6Fi9LauLYbTWhEngG0PXJIfKpT/bkRV:e32YV1dDCH4tX6TWDIfKprYRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479996, "uuid": "4bdb212a-7d91-4960-bdb6-44b05a80b2ce", "value": 89156776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479996, "uuid": "fd1a49c0-5fe5-439a-a601-14e62f2450af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479996, "uuid": "48e50692-fb42-43af-b0d1-59393bf62778", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5200c954-4381-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777435813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777435813, "uuid": "fef385d6-fdbb-4ebf-bff2-b965a1f1dcc5", "comment": "Malware payload (ConnectWise)", "value": "bb721a64c26ce8ba42606458ce6d1690", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777435813, "uuid": "c4a23f4a-01ed-4fe1-a7b4-fa74bcbe216e", "comment": "Malware payload (ConnectWise)", "value": "e6e418f6d10dd1274a1917fcb08a00683e54d6df4b5565b79fe73aa511e0a10c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777435813, "uuid": "a33d4571-6094-43cc-92e6-7161035b3a85", "comment": "Malware payload (ConnectWise)", "value": "f58ba4f7acf095e4864cb3846b1aff09cedf31fb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777435813, "uuid": "bd9f6b3f-09fe-4955-b9a9-a6e20e664f6f", "comment": "Malware payload (ConnectWise)", "value": "d3c6a7b3c6d5598aca3b11a65ecf56077bda870895315618b23d3255974630f2aa6afe4b7bd80d66247bcf99c70e036d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777435813, "uuid": "1e746a56-b7e4-4f9a-96e2-3fcee0cae2fe", "value": "T1CC46F141B3D695B5D0BF0638D87A42A66634BC108712C7FF57A4BD296D33BC08E7236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777435813, "uuid": "8d1e1a6b-2418-4042-bd58-99b03ed2831a", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777435813, "uuid": "6e0fbb0f-11fe-4e96-a104-467a7e1f13f1", "value": "49152:NfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8ifu:pqs6efP3rn/TYGVxz3GBwRVkGuyXOMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777435813, "uuid": "9f73978b-03f0-4791-8234-4f549737e20e", "value": 5724840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777435813, "uuid": "e76505d5-ef29-4f0b-8389-35e7105124c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777435813, "uuid": "d8c2183a-de0c-4921-8c34-92c4c34e5602", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d972df-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455502, "uuid": "88195e00-37c1-4e57-b694-37ccc331274e", "comment": "Malware payload", "value": "a6687781e17702c801cb6ad11ff57a50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455502, "uuid": "c5e69daf-b547-4a11-a183-5fca2778c161", "comment": "Malware payload", "value": "e72a89dee6fb278a3559b3a4ad18962d43eff3c440cffd9a3c999fe5111696b7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455502, "uuid": "8d731d36-1f56-4dc7-b036-27c019fda551", "comment": "Malware payload", "value": "8ea1d635e7bea7af093374e98f3e60b3dd21762c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455502, "uuid": "45e1a603-90e1-4833-9ab7-3f56c3482b63", "comment": "Malware payload", "value": "b0c400eae0d0ee4c838332aada1c226eeaba6110f8f2204d9f2fa0d6a7263cbafa5cb49195252799cf13972769a57d6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455502, "uuid": "bc20dcbb-a276-41fe-a751-5178e1632480", "value": "T11637232AC91F8C7D03BC611A206F5B1D905D4ED580907BF813E63E9696DEB2CAF5E309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455502, "uuid": "2ffbfecb-28c6-4b2f-8939-a8b9c28ec3d2", "value": "49152:uqlqmqWqwqfqZqLqJqAqpqjqARd2qZqTq4q8qzRdpq8qdqfqZqCqaqpqgqnqcqkV:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455502, "uuid": "261ab267-b268-4e9b-b94b-0aa2c50f1f50", "value": 23424186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455502, "uuid": "0c99b642-c020-4651-bf5f-515806875d23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455502, "uuid": "21d55488-768c-41bb-af6c-9b1e9271703e", "value": "invoice-1645080830.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c2756a-4403-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777491895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491895, "uuid": "21171fc0-6cf3-475c-ac57-978df27f22a4", "comment": "Malware payload (Mirai)", "value": "50e42ec0c5ac216275d2c13bd52772d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491895, "uuid": "86d74184-bba6-4a77-b32b-f5fe0d9dae95", "comment": "Malware payload (Mirai)", "value": "e7673c4698f947e1b482fc6fc4a43307addd35ce3bb74d05457e96b097b9ee94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491895, "uuid": "0f902746-8b1b-4a8c-b48f-3aa3d22bece4", "comment": "Malware payload (Mirai)", "value": "21a2bfd1297c571b622fc67e2fc6051d06b704dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777491895, "uuid": "c86b03d8-bfb3-4587-8e32-dda679afc916", "comment": "Malware payload (Mirai)", "value": "94d89ddc8f254f211c4d4603f7f8f2670b78580785fcc839b26c37f160cef693047058882f7bfb5f84c6eba7302da144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491895, "uuid": "01880a7c-c71f-4299-b5a8-4329e2cdbced", "value": "T16ED34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491895, "uuid": "b08ae0b7-1dba-4caa-aca9-848a0a97276a", "value": "3072:BxioDMQI5nr4aO4nt3qZg2IWu6b47X7LkDM/98PmPw/t93:DioDtI5rvnt3qZgPWjwX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777491895, "uuid": "0e57bc65-5420-41b0-9e94-7737044a3c2f", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777491895, "uuid": "654ef91d-a19f-4c48-add9-932f5a2c227f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777491895, "uuid": "9f1b69c3-170e-4e72-8094-87f1b9d5b774", "value": "RpcSecurity.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dd159a-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488963, "uuid": "d175ab26-4dfa-4c93-8a27-cc2704ba9cff", "comment": "Malware payload", "value": "00fc4504e8d141d22f36ccb77fce0856", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488963, "uuid": "728d54d9-6395-4be1-856f-eaa844c22826", "comment": "Malware payload", "value": "e826704c14c6eb72b6b8617e9bc3168563258ece58c110e4a5ef8769b35f872b", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488963, "uuid": "2df1ec61-c1ac-46f0-a216-626d51005084", "comment": "Malware payload", "value": "8b74143a0172689cb30841b39d9732409cfe708a", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488963, "uuid": "edc3c1e9-4e23-4f6a-97ac-b43e508e6be5", "comment": "Malware payload", "value": "576b509009e59f7b1815f5fbc90669fa94e27c7492c43e22441b4609956f925e7cf475bd7cf8ac9288d4fb285d124262", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488963, "uuid": "e96fc2ba-d178-4cda-8543-e91cf69eb358", "value": "T1F8A28D69D2945CF173E90BFF862561E07F6CC4EA2CF8CBAFBA4977901844069B8590F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488963, "uuid": "18bc1cc6-cedd-4a34-aeeb-5f8ae99f23cd", "value": "384:uIssTZAzGnDrJ/xjd/0PlAUuN7tNhtL0kov16V/Tplo2DPMr9D6IWjF2NpFclWMu:uIssdAza9/3/uctTt9o9w/tK2rMrV6It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488963, "uuid": "ac1acc05-1506-491b-94de-21ba8fa2dc92", "value": 23172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488963, "uuid": "8f7ad2b9-cdf4-4dfd-a3ce-0539ae9100a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488963, "uuid": "5c67de10-3e71-480e-acf1-765203c073e7", "value": "exiho.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010c975c-43fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777488934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488934, "uuid": "931b8070-42bd-4f72-9a95-fdd25662f5f9", "comment": "Malware payload", "value": "cd21a2c3c9d4f29e335616c727d1f061", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488934, "uuid": "26468133-36c3-44ab-b71e-80f88b318e96", "comment": "Malware payload", "value": "e8b31f5f402013018bbcb11d49e81d506cafe46e6e3e6382fdc2913382db29a7", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488934, "uuid": "ace5b6d1-0a7e-4900-8965-49c5239787e8", "comment": "Malware payload", "value": "07786f308f3caf32ab45486f73c119c00884f77c", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777488934, "uuid": "e8693c7e-a500-4ecb-9254-560adba1282c", "comment": "Malware payload", "value": "62409fc9ef323f998ff18be5591babe6eca9c0ec33c605ab5bbf43cfe3526fd356882cc113632693a0c741eca78f3da9", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488934, "uuid": "42a48648-6930-4219-b7ef-cafa9eeee3e9", "value": "T113A29D55C7050E96A95AAFD750BB47CC8FDCABDB2CE015B6A364F0A0E85101BFD2D0B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488934, "uuid": "b7d31d2f-d23e-4f53-8cd2-bbf20cbc2ff3", "value": "384:uIsGhoVKsDFPJz8yachBWOzD3VY73kujnGkDdU8gjoPoQfP4F4pPW4bvr2NFFclU:uIsGDszz8O+OvQkujnGKnxoST2NFylWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777488934, "uuid": "15e8fb7f-2147-4c4a-b7c9-139b052ed65f", "value": 23052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777488934, "uuid": "203edfb0-6161-483f-bf2f-227461f617b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777488934, "uuid": "b5686c25-810c-4faa-af5f-67927a793f6b", "value": "agaru.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b8b6f8-43c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777464145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464145, "uuid": "c8d2af66-6bc7-49c6-a0e7-875a33b9bb4d", "comment": "Malware payload (Mirai)", "value": "3ff7d28999a3b4ff466a542d63add4f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464145, "uuid": "9eb6a2f5-9be6-4d38-af4e-f478483421bf", "comment": "Malware payload (Mirai)", "value": "e94c3b8ef5507b666c6395507a1cbabc5e9b0ce8c851fefe0626abae9e3d9791", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464145, "uuid": "f4ba1487-df2f-4d85-bcda-576a84defc86", "comment": "Malware payload (Mirai)", "value": "71d94b98c225455a0f9ea7c6b85ca4e2b3a215f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777464145, "uuid": "3d78fd82-1f71-4992-83e9-f5dc204d2eba", "comment": "Malware payload (Mirai)", "value": "fe4d8a2b3a2cf7172c1cad6f82181b9f44661b5793bdab0b0d7700c4e43e8f1764235ba5b82edccda82eb4c9486568f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464145, "uuid": "bfe094e7-20a5-47db-bba0-258bf0b243ca", "value": "T13BE46B06EF840FEBC4BFCD30852E825B15ED9D9702D1A67961BC8D9CBA4D29A0FD7448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464145, "uuid": "1c282bd1-c802-466e-9f56-86cdb09b1177", "value": "12288:xmE426MA35UCwWwMvHPlmX5b3/Fs/4XpPvgtgWqMCXLLkctgy+oYRNPblW/JkP3P:HZXrVHmBVFfjpHXgv3cc2nF62C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777464145, "uuid": "96a8ec1d-3c2c-4349-ad85-7cd5053775c8", "value": 669380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777464145, "uuid": "2ffa677e-12c4-4ce0-a11e-23d27b26cb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777464145, "uuid": "f41e7c0a-3a96-431e-a51c-14ef4b060ed5", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1955403a-4391-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777442589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442589, "uuid": "2c1f223e-c2b3-44be-b7b0-105705e6571d", "comment": "Malware payload (Mirai)", "value": "85dded17fb68000c5e79d815b3b870ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442589, "uuid": "89d4d1a8-9cfd-49ff-9d0e-ccbf82dd6e4a", "comment": "Malware payload (Mirai)", "value": "e9577b5eaa0372c7f58bb440f7539b534ec102dd2d6aaae54d750a3c12ef18c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442589, "uuid": "78da44b9-7eff-498c-a7f7-1ed161acfa23", "comment": "Malware payload (Mirai)", "value": "6edecc7c2cf5b194bf312bd675672a137885460d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777442589, "uuid": "3eb5db17-3ab9-419a-8390-9a92ed4b6e2d", "comment": "Malware payload (Mirai)", "value": "b75e5f5996c9c670c1abb20d866670e1ce715097e3cd555d2078b48ff7637fd6cd4b1a1f7b3b3fdae3d5edefdd42a465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442589, "uuid": "cf3c1204-f985-4347-bb1a-11c5908fae66", "value": "T1DFA2D030D5765F69FFFABE31AFE9E6C93B224B4A73A3CAA111845F20670535210C96C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442589, "uuid": "fb983f42-f2f5-4841-b520-0fb7442a6a62", "value": "384:MzpGXxbU5u2QMZ/hjBPG3ktaIP6vBuUcEom1pBl3skEmM4uVcqgw05VxJHw:0GBIuwZ/hVe3ktByEY1zByF14uVcqgw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777442589, "uuid": "68465d3c-69c5-42d3-b0c7-e93f68829d8c", "value": 21932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777442589, "uuid": "4f6e14a8-bec2-4173-86ba-848f85b46824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777442589, "uuid": "dbeefffd-e751-46d7-98c3-65bc69eae83f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041a8f86-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451573, "uuid": "eac3b12c-5f3b-4357-b81c-6f700c625972", "comment": "Malware payload (Mirai)", "value": "907a570c6de74fde2a32ebbbba9576e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451573, "uuid": "3d51eee6-ee03-47d2-8cc7-3fce26abbba4", "comment": "Malware payload (Mirai)", "value": "e9d3ebe98b1cd3b0c1323e10be5137bc63def782f711c330faa8f6e71361b5d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451573, "uuid": "739ef0a0-81b0-43a3-9d79-c3c3bba3cfbc", "comment": "Malware payload (Mirai)", "value": "9954aa2ff66d838c425b76c9955a56c2f99913a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451573, "uuid": "3ae11932-a20b-451f-8154-b86c5bb0f2b5", "comment": "Malware payload (Mirai)", "value": "8da5a9747d610c089a0e52cc0377a81deaff4edad42110b5ee1ae4ab316dfb3969838b0cf60a2518ef62f7bd2ff746ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451573, "uuid": "98e6898a-997d-4e97-a2b9-788ec2214f3d", "value": "T16E437B23D8651DA4D1A944B034A98F310F23D1C183936FFF71698BB5A893D89BA16FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451573, "uuid": "5d30a9f2-fbf8-4ba1-8852-0e939d5ab9d8", "value": "1536:EEwtUqFYiWN8fvQH27D2/KPhTnyPbodUuieCVegJ8R:peFXW1m7PUP/uie22R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451573, "uuid": "7ca19d90-970d-48ea-b679-2142c472bddc", "value": 59844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451573, "uuid": "2ad9ae85-4244-4d65-a68d-160e74519393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451573, "uuid": "da39b6a1-b7c0-4a16-97af-a80ec9bf70f3", "value": "asuna.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f06af1-43d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777473291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473291, "uuid": "b848e25f-92bf-450b-bcac-02ce1ddfa951", "comment": "Malware payload", "value": "2dcf27213a0732811c5d83a57f3a388c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473291, "uuid": "aff7728b-af1f-4a8b-b927-6932ff58d00a", "comment": "Malware payload", "value": "eb114627f78b64f430f636b3ed26ac10942e69f70ff2d37bee5967d734ce983a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473291, "uuid": "4b6b423e-54e7-4be9-8dc6-5c5aaf4db813", "comment": "Malware payload", "value": "7ff6a5399753f6108b00029b63cd18b1cb854fef", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777473291, "uuid": "abe3cbfb-fcb0-405c-a630-84d7454ba83a", "comment": "Malware payload", "value": "a224a40ac1695164e014179aaa0807de96c30efa9a36b8e9956047d5156f1821d197c54b63f34c3e96ac2afb5c2bbc1e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473291, "uuid": "264b1107-26e1-4384-b509-837118d63339", "value": "T137513B42090F0EAC4A6236F960CFD569066BB7B2CAEF71EAD07304FF146167855F5B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473291, "uuid": "0cb5d4f7-0b17-4cbb-9300-d19650bdc93c", "value": "96:orCTkAbP7sVUCzh9GvP4S88EIRP1uvfRXwXnjUCnGnv:o2TkAm7hsP4S3P16CGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777473291, "uuid": "85007056-1b97-4e08-9d71-b57b243192d7", "value": 3156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777473291, "uuid": "02f17e2a-719a-48e1-b959-41373048d31b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777473291, "uuid": "6f87b42a-60fe-45f6-9b6b-f3863ce4e8aa", "value": "\u0420\u0430\u043f\u043e\u0440\u0442 \u043d\u0430 \u0432\u0456\u0434\u043f\u0443\u0441\u043a\u043d\u0456 \u0423\u0411\u0414.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3c14f5-4398-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445812, "uuid": "1b40808f-310e-4f8b-9bf3-2068c9c6bc76", "comment": "Malware payload (Mirai)", "value": "fc364d918df20126f3ca2dbb11735d7c", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445812, "uuid": "ca5de6f3-8bdb-4e37-9785-164b49fafad9", "comment": "Malware payload (Mirai)", "value": "eb6781065e259e6fe2780446c4701bce27f4211de048eea2c8f2a8ca5ed3b34e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445812, "uuid": "96baeeae-0a3a-4eeb-8aa7-1ac67c8a21ac", "comment": "Malware payload (Mirai)", "value": "b1f88f74c924f17e99648c8eb820209f891a7c89", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445812, "uuid": "19515ed1-3d1c-4e18-8860-5a4b8ec5467c", "comment": "Malware payload (Mirai)", "value": "7422dd2d57888a3c6d7dd7afc3c9c03e6347f2dd359bb4956270fea7948443e2eb267a16e61795faf624930ea248c510", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445812, "uuid": "6f141a25-cb3d-4c64-b3aa-90ecc4db8e87", "value": "T180733B03B641C6BFC897D1F447EB5625D933BC2E1936639AA7A0FE912B19EC06D1D320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445812, "uuid": "de9f369d-3e37-4761-becd-39b4a6c4e6a4", "value": "1536:K2UxzFNJY47wTMuqOuRLd+jywY2V326HR25Ld3qWAPRxu:KZWow5q/ddtwjmQYL1Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445812, "uuid": "795af845-d3be-4db0-ad65-d4c2cf43cd17", "value": 76712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445812, "uuid": "bd37f4a2-efd6-4ca6-866b-3204a87a1ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445812, "uuid": "3f0fb4c6-5153-41bf-8772-42fea99804b5", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150a05b4-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494981, "uuid": "ebfda4ce-f4cd-4e1e-9188-7d30a6904fda", "comment": "Malware payload (Mirai)", "value": "694720493cbf9a1acb6b0b1762685105", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494981, "uuid": "5ac331ae-5772-4195-9091-baf06eb4ed29", "comment": "Malware payload (Mirai)", "value": "eb91c9b86803e2db64c9c09e26d58b6ec65ddfdd0bc4b2ccb59994ed324d488c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494981, "uuid": "f2dd83b6-780b-4919-bc34-2a28530c0ad0", "comment": "Malware payload (Mirai)", "value": "f95cfc68b0b9fca1d07b33cd275ba8815341344a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494981, "uuid": "78180009-78bb-4b54-9ab0-080b1c66a470", "comment": "Malware payload (Mirai)", "value": "62e8e161e70f67fd8848ac859bb57423736e7f04c7a49bd6272f7f81df1adab95615937022ad0f12795773f61bb2a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494981, "uuid": "4c165ac4-1ca2-4ea7-ace9-095d22518586", "value": "T188932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494981, "uuid": "31fb47b6-171a-4c3b-9b61-8e5587076722", "value": "1536:NJaUfdQD/bb2s5rI3eQYmUC3100x7u/oVLuAasxlrI:NJNYn2SrIr6kpYAp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494981, "uuid": "28dbc735-33bb-4741-ae43-59cd879325c7", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494981, "uuid": "62714f3d-bf84-47ba-ba8e-3e13b780bb46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494981, "uuid": "2c38716f-cbfe-418d-b7f3-a9e61fe9743d", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e178f58-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455617, "uuid": "2abd07b4-aca3-41b2-ad54-bd57959825a7", "comment": "Malware payload", "value": "d03efa10eb7ba56609555a3ce0716e6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455617, "uuid": "eccbb7d6-b991-4e0c-88da-1903ffd569c0", "comment": "Malware payload", "value": "ec34f420b62330e46b1e41b6126f7b4c18342ad8555da0d7c41590c42f0e5962", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455617, "uuid": "ad9b7758-3f01-4d2b-a662-c5f634d129ec", "comment": "Malware payload", "value": "bbfbf7e37464809f4f33ad1584c1764693478c12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455617, "uuid": "ae6596af-7083-4244-8485-fc1077a3efc4", "comment": "Malware payload", "value": "68bdd46fe0dd987bb78ab347c66c498f62402126f5d036ab81e8221d1195c5c8ddc6e536f0e86fe3e0f4e49bdeb242c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455617, "uuid": "2ac2065a-a549-4f3f-8c20-3ab8c17449f9", "value": "T1B137231567EE4F7D4C3C47F1257A4F8C4BE20648808CA7E2DAA1E77E913DA22DC5216E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455617, "uuid": "d1ff8f82-90b8-49dc-aaaf-47bda5431050", "value": "49152:UO4OGOiOHORO7OvO/OQOROZOlKOtOsOeOqO+nOQOdOvOvOfOZOgOaObOtOLOTOP+:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455617, "uuid": "b4659b72-48a0-46fd-963a-946b3162655c", "value": 22383683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455617, "uuid": "d581ff15-6373-48d7-aaf1-bb457b631ea4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455617, "uuid": "6a7abb03-6fa9-4bfe-b5a3-dfdebc5e6b97", "value": "invoice-1645080830.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f996802f-4406-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777493217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493217, "uuid": "41db5bcf-6bd2-4aba-bd6d-bdbfda887e81", "comment": "Malware payload (Mirai)", "value": "57ef32559cd7c580f93e8a718c506422", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493217, "uuid": "d1f5fe91-4580-485f-9dd7-cd769037d106", "comment": "Malware payload (Mirai)", "value": "ec8d8701cd6218f80098e4ae6fb86c09082c799ecfa6d9e2ad2eb802152bd6b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493217, "uuid": "dd809378-02e0-41cb-b7d4-dac62b99f134", "comment": "Malware payload (Mirai)", "value": "2bdfdeffdf29b8634b6608e82610eab9e054a802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493217, "uuid": "818e36b1-7137-4778-b617-9ea6474f7cff", "comment": "Malware payload (Mirai)", "value": "1a818bfcf3727408274097bb55ee3b07f7790a967b52511a30607e0aa399d82e4eb38aee619b3921cf2521302a4fab03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493217, "uuid": "204a2d68-8308-40e1-adfd-840e40e55145", "value": "T10473D70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493217, "uuid": "6cf1167b-24d8-4414-baa8-cca0beea98c7", "value": "1536:bpxe5qoct9fdlQBI6rVnnUFndlBotYG9CJa10cDv:Fx3oANdOWndvomgC4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493217, "uuid": "26ae03d1-402b-4ebe-9db6-afbc170afa9f", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493217, "uuid": "4883c211-fb51-4fe6-b29f-e0a2382337ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493217, "uuid": "7defba8a-fb59-414b-866e-3d0371063be1", "value": "RpcSecurity.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790bb695-4408-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777493860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493860, "uuid": "69772168-aeef-4973-840b-449945d00e86", "comment": "Malware payload", "value": "ed6f8cd87329ec7a02e05ce33911af56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493860, "uuid": "21346dcb-8af1-4243-96eb-111aab056315", "comment": "Malware payload", "value": "edea1565c4c0fde5a036fbe73525e180983bb0a67d1fed6bb846b9ab8cecd7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493860, "uuid": "3f327fe9-77ef-482b-9893-259300a9d528", "comment": "Malware payload", "value": "643f43605ad04cc270d1c77ccf57f478b0a8bf3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777493860, "uuid": "288f0787-5751-4b1a-b94a-f55ce920d3c4", "comment": "Malware payload", "value": "e983816d2644b67f794cc60dc2853dae897d96e2dea4fdac2a92e810c3e9cf25e6ba12c34335ebf173f0b73f9b346e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493860, "uuid": "07caca25-bf73-4ce7-bc57-04bd8060ddb0", "value": "T16F0833AD1A2FFA14DB4419B8653887204FC8B0A557E5C51C17ECD23CFA9BD30785EEA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493860, "uuid": "1481467b-3a68-4f1d-b4b7-2f9e24046f1c", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493860, "uuid": "b51de12b-62c0-4d59-8839-9a0fa50153d2", "value": "1572864:edfq7622KmlraeUwbL+NFrod0Gws6k9GN7GEE3gZ4y9KfNl6kZYP7Vinz:edfU2Km1aeUwPIUCGrGN7GLS4Ayakw7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777493860, "uuid": "4cd7b40f-caab-4151-87a1-bf9c0d6f0ef4", "value": 79638176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777493860, "uuid": "cbaf216d-0278-4f40-97f5-c84fd7184eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777493860, "uuid": "8a5e19cc-f24b-4931-8d2e-5f7d62ffe26d", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b847a44-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777484845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484845, "uuid": "5d10cfc8-b067-40c2-91cd-5fd958e9335b", "comment": "Malware payload", "value": "f8905f77dd784414844d8585fa85b0a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484845, "uuid": "e08339dc-3b98-4211-8afc-d21bea536062", "comment": "Malware payload", "value": "ee84d3f0434c27adf695555c8d9b97f40af590487e37c2d07587af74a2d45ede", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484845, "uuid": "8e075496-d29b-4479-831b-e9eb3a883ddd", "comment": "Malware payload", "value": "3b38579d814c88daded66b8217d49e6f1b5f2b60", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484845, "uuid": "ac204dc0-6ccd-414a-bad4-9ef78470be28", "comment": "Malware payload", "value": "b139910af07f88ddca3706e722a4e05ef4b451bfecf8d364190a0413b7f4ace3f605c176a680b00949f18493de150ba2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiinterchillers-com", "colour": "#2071DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484845, "uuid": "6e9af060-84de-488b-9e58-ffe67d132e19", "value": "T1094609C2A5C904A0C1522534699B767F1A388C3D4F39E393CBE939766C7FBE59C22349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484845, "uuid": "f7d3e108-35c2-4f70-ba7e-6cbdb9017b9f", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484845, "uuid": "3396ce11-542e-4675-86a4-0a2339a67674", "value": "24576:nnQuqTlVOg+s1y3Ae3Uc/O9JTpK7tBVqGc61XJzYqzGjbZWNt8knn/Z6D4IwDjtW:n2YSwkeqGc6JAorRl0bv8z4IU+RdCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484845, "uuid": "8322a061-808b-4d3b-8fd5-d1af643fcc7d", "value": 5384392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484845, "uuid": "c015c04f-eb66-4e22-bd49-7a9dbad8e93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484845, "uuid": "858596cf-30f4-402f-ad3b-d1fb9a76ecfc", "value": "NqwDkn9PdE8jhm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240a31a4-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455492, "uuid": "52fdaf8e-fc83-4196-af2e-0221af66f5ea", "comment": "Malware payload", "value": "87d1ef10f47c5cd706835c6c2b236046", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455492, "uuid": "f0cf8b9a-5f74-4592-9983-960e00119c5b", "comment": "Malware payload", "value": "effafa437a136c793b26083f6b920f3cf6c043da5dcd2e93fce16a68d6d8d538", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455492, "uuid": "2453de3a-c17a-4b57-8765-2e27436f7be3", "comment": "Malware payload", "value": "e511fb53953ae59f636db34049a9857d58a7dce4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455492, "uuid": "ae897acb-067d-4b95-84f4-bac6a4ce295b", "comment": "Malware payload", "value": "1e280afb0be876c845f7d1045f621b5f60855e97749ac56db836a2a5ab4d8bf48397059bed1803e14c71db92ac906697", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455492, "uuid": "7edd552c-ce83-4d50-9796-f13761c862e0", "value": "T1383723660F0BEEAB0AB8738C307F1E8615F448E89A61E7F645E6BC4F47DB558500981F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455492, "uuid": "fff37c34-9307-4777-8924-1ef982d5b84d", "value": "49152:4pF9pFWpF/pF+pFApF6pF0pF+pF1pFupFopF805uNDpFwpF7pFPpFvpF705uNmpc:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455492, "uuid": "e4aed95b-0597-48d5-a1e5-74e294cbaa60", "value": 23424194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455492, "uuid": "54f24310-5352-41c7-af04-2d72e6d2ba24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455492, "uuid": "ed6dc07b-b234-40ce-a5e8-7d970ff305d9", "value": "invoice-1645080830.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97850390-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440654, "uuid": "c4332856-3879-4379-a7e6-9127d1c15466", "comment": "Malware payload (Mirai)", "value": "896ed982d40baf9d8e3ce59809f27c8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440654, "uuid": "766f8688-3829-4fe2-95a9-8d8eca51e058", "comment": "Malware payload (Mirai)", "value": "f01cd903fe89665ac85a57ab0422afb83fbb9078ec5bd0b2a0340e183235c138", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440654, "uuid": "10447ea5-52af-4b4e-bb37-6eb08cc490c5", "comment": "Malware payload (Mirai)", "value": "e9ea22fbcaceb26348f90f48fb189b7691ca296f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440654, "uuid": "6ba244e2-4efd-48e4-904a-cd9b5ff98b7e", "comment": "Malware payload (Mirai)", "value": "5b97faf864ee9009a5c8465b72b7e6cd193a6141f7b82500b50d9c2f8050e2b7891d9f1e4b396d18f7864686227361d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440654, "uuid": "ab7c94b9-e01a-41f7-a427-fa887c49570e", "value": "T1696302E01AB1178C5672E8393ADD306F4124222F329E29101DE7A1CEF85B603A577DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440654, "uuid": "d6255644-706d-4810-a56c-9ceca93197a0", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTv:8D+CAXFYQChaAUk5ljnQssv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440654, "uuid": "27716625-01de-4a59-8417-a52f409cddc4", "value": 69374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440654, "uuid": "2de651ec-9fbc-4d03-b6c4-a35f01dddb89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440654, "uuid": "7881cbcf-e95b-4454-b4f8-8b2e5b4124bf", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63b52ad-43d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777471656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471656, "uuid": "c48a455f-2448-499a-9ffb-202676f6984a", "comment": "Malware payload", "value": "bffc82589b165f1a059d5f08602c9082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471656, "uuid": "ee667654-aef5-4cc4-96d6-f3b46ca64b6c", "comment": "Malware payload", "value": "f0bae4987bc558a5e6696d3cf62919d4e0687f59587c1085d201ce7f8cca78ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471656, "uuid": "5d3f9d6f-7fa1-4bea-9d1d-0176827dd789", "comment": "Malware payload", "value": "48219fbc3cd868fd3052d9537bbbe973151728f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777471656, "uuid": "981bc626-0bb2-4fef-9d61-aa773e51beed", "comment": "Malware payload", "value": "338112d6b52236b481f3e48db74fe57e82c918f67da1f2807fa8073dd4aa71d78cf6a226234669f3595d872e095a7aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471656, "uuid": "6a509c99-6d44-400d-bd6b-8bb755f49a85", "value": "T1E7346C4B72E559BCE156C038931B9673BA22B88A0631BDBF13F4D6302E5BD521F2C719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471656, "uuid": "9dde6a56-ae30-4353-8b0b-fd5eb16fe265", "value": "0491a93e7da80593fe96794d757a3b4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471656, "uuid": "6ab03ef3-4255-4cb1-9ea4-b16f455cad9c", "value": "6144:FNZjJbLifrr9nTx67R+t4pxBUufiQa472xXXbmNvDOfkAf:RjJHWVxZ4pxXfiQa47IXb2DO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777471656, "uuid": "37e9202f-b2b7-41b2-86dc-1aa13e72d198", "value": 242408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777471656, "uuid": "c84eba3b-70e4-4d97-aa52-24f97b1622b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777471656, "uuid": "23bc6856-b3d7-4ff2-9f7d-0c43b2dd929f", "value": "WinUpdateCheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0361ebe4-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451572, "uuid": "09113f6e-63fe-4779-861b-93af6b191916", "comment": "Malware payload (Mirai)", "value": "8264f34bf199984d099b97011e94ac12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451572, "uuid": "92fbb2d1-747a-4db9-8540-9e953a5d4376", "comment": "Malware payload (Mirai)", "value": "f0ee0678f622b9ed8d7e3f48fa1a0559db581e64964311660d4473fb9f70bc91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451572, "uuid": "beb5f48b-04de-466f-92ff-64c6ad5d0162", "comment": "Malware payload (Mirai)", "value": "e0c5aa7cba62eafd44850afc800f28d659a4169a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451572, "uuid": "f560b74d-9d16-4cfe-b01b-130b36e55af6", "comment": "Malware payload (Mirai)", "value": "7062242357e6884e9f27ad4b7c6d140589d7a24be8e3a75dee660b88ffb163c2a4f0ff87e282b3aab955c9b5e959bcb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451572, "uuid": "99d7c0da-00db-45ac-b18c-6b2694cc9676", "value": "T1DF82C0713B56EA50C2604578CF988BD53B8F0A79B1F63063141431E8E5E671A9EFCED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451572, "uuid": "847a5979-11c8-45f3-af02-4b2071651ed2", "value": "384:FX9gVh9P0a2f2E1rPxAq6B5vgLXynyEUaThymdGUop5h75:wVht0a2fN1O5vyXkyoTs3Uoz95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451572, "uuid": "d8e3d851-2f3f-42fc-8b3f-532eb3050272", "value": 19200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451572, "uuid": "ad6f7ec7-0e92-4efa-84c4-593e9fd863b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451572, "uuid": "c254d70b-3e5a-46e8-8d88-674f7c9d248e", "value": "asuna.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cbaf27-43bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777461111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461111, "uuid": "e07bd8ad-08bb-4da2-ad8b-77d8e6fbbdcb", "comment": "Malware payload (Mirai)", "value": "0ee20710a2576eba50fb42586e18c684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461111, "uuid": "1a57c410-919e-4c31-81f7-29bbe9afec1c", "comment": "Malware payload (Mirai)", "value": "f130d66a513c167195b0084d04d2ca70c96fa583357a8fe39079932611c33e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461111, "uuid": "1c4a830d-272f-468a-b3cf-ad44976ad7e8", "comment": "Malware payload (Mirai)", "value": "5d4666eb953ee3b108867f44cf93c641e8726f64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461111, "uuid": "ca7d9af8-18de-4efb-a13c-49572decd935", "comment": "Malware payload (Mirai)", "value": "51f794520f38f74ea7fe54916af8507eaec8bea92bed24bacfe76ac209249a8041ef15c25118055262949d8b0e18bbd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461111, "uuid": "d37c019b-9d4b-4126-8509-c8b0af9604be", "value": "T161F20211C0A0A27FCC57537CEA383D1F56E468118F1F87091A8D52E6A9BA67507B2FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461111, "uuid": "6364cdc3-a579-4dd2-a21c-11b4e528071c", "value": "768:tKz7vc4BzY51VaFKLsh2vazVHV7jRsxMT5lqBVPF26:tKXxcPE2y1Zjd5lqBV9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461111, "uuid": "ff6588ea-892a-45bc-89dd-acbb982fc753", "value": 37180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461111, "uuid": "c975a02f-4442-4028-ac4a-61403b5703c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461111, "uuid": "9730b47f-de58-47bf-9667-b35ef27a386b", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4756fe-439f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1777448713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448713, "uuid": "df78d684-66d6-4c53-b61b-ebe6a6a564a3", "comment": "Malware payload (NanoCore)", "value": "7d4f2b6c054d9d5df5297c0bcbe3aed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448713, "uuid": "69c40570-4643-4be1-8776-d2e2f19a99c6", "comment": "Malware payload (NanoCore)", "value": "f1afb783b90808a49b4a37d6e1ce5639a992c89990b6bdc1e67d34e768df6053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448713, "uuid": "744d3dc8-6834-4def-b755-140077f936d9", "comment": "Malware payload (NanoCore)", "value": "7268d5af774d71ba557f84206237832c5f2802f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777448713, "uuid": "c50ffe88-3023-41e2-9afe-8f5c9a65504d", "comment": "Malware payload (NanoCore)", "value": "48d835b8658f2ee9358d4b6b641175caebefd00c58c46d39ea9f0c84f88c536b4dcfd9d1bee3a7dad7570adedb8fe896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448713, "uuid": "aee9051c-edcd-4387-8d23-ea36f1517dfa", "value": "T13114CF5677E9892FE2DE86BD612241538379C2E3D8C3F3DE28D415B69B263E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448713, "uuid": "31ab641a-2ff4-47a3-bb3d-3f239fa35ad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448713, "uuid": "c934550c-173c-437c-89bf-4b9ca28eee94", "value": "6144:MLV6Bta6dtJmakIM5UUBPnGZd3wwMi5Tzw:MLV6BtpmkjMOhwwMi10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777448713, "uuid": "0b3d44da-6478-4ddd-8f52-99595b6fefec", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777448713, "uuid": "8e600ce9-05b1-4e09-bb4d-b9e3686b0380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777448713, "uuid": "a19cf624-2b99-4f64-b95e-6a69894d4e5a", "value": "help.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f410eb36-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1777479893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479893, "uuid": "7c725ded-1739-405a-bca9-e1956e7fe95a", "comment": "Malware payload (SalatStealer)", "value": "95f80b9385f275f37b9a967015539ec8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479893, "uuid": "168751d1-e1c4-4b2d-838b-a24cae0c8279", "comment": "Malware payload (SalatStealer)", "value": "f1e01192c55ccf4eaf14a1c242e32e525fb7f8c5a4bac24e223b1c54ace6feb6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479893, "uuid": "1d6840b4-ede6-415a-a92e-4f49f33fe884", "comment": "Malware payload (SalatStealer)", "value": "b5a248ee53c3ed1ec09b53bc8b1afd7d4f01a6eb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479893, "uuid": "fc1a299c-6ba7-4434-ab07-71c7240febba", "comment": "Malware payload (SalatStealer)", "value": "2e1b061bdd4666b99c3cab5afb4793a3ad7fb9cf8bd822ead1c81b9e865feb08782e2485aa96f3e23d042af6d419f300", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479893, "uuid": "22d408a0-ff31-4367-b8f2-2469ed0455f7", "value": "T10636C0027BFEB45EEABB97B4956962918624FC370C51804D71CD548B0F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479893, "uuid": "4070287f-aa50-475c-9b79-adf0d04e0628", "value": "5e8911c0528031eef2857e8ab6e01657", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479893, "uuid": "a1bf9ff1-2163-4cf9-a86a-18cfb08a50fa", "value": "49152:rr/7/z5evSm+5kRp7WHg4/oOLFVkwn582NFeUqcQfkAmg0kDjx1UsFiTZqVD+8EF:rlJd8tY/hL4wu2Ncfv0Gkn0Ss3ockgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479893, "uuid": "90087712-3aef-40b4-b793-1df5b6548653", "value": 5155328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479893, "uuid": "7cb4a5a4-07e5-4dde-aecc-9e29057b8778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479893, "uuid": "c56ee2b2-fdf4-47a7-a8f5-4c13945cca83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e8da30-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777494982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494982, "uuid": "4fa64eea-5c8a-43cf-b72f-03153efc3c64", "comment": "Malware payload (Mirai)", "value": "d1a80ee50c94a6e2fcf2b705112510fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494982, "uuid": "15d25c41-28d7-41cb-84fc-9932a7bd6445", "comment": "Malware payload (Mirai)", "value": "f24a2145c94a1a7b0ca47456f3b0803fc15ed13d701f2036841c0dda80758c93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494982, "uuid": "57627a4f-91e3-4af7-aa97-3e8c2e1db4c8", "comment": "Malware payload (Mirai)", "value": "6968dc176ea1c14ad183a603c9fc078c1411f994", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777494982, "uuid": "172dd3c3-0cba-4579-a1da-7f4a93065922", "comment": "Malware payload (Mirai)", "value": "5db5709faaac87c7ecc2f170b6a7e99158ee808f45d54e866ef8c02cd5879560cdf3e88c7ca343fce117128d773fdffd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494982, "uuid": "b942ba9a-a79d-40c3-bc16-53a461295d02", "value": "T1E773F942BA47CAF3D41708F041F7B63F8E31FD3A493285A9EB65BDA2CA275C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494982, "uuid": "01b9c72c-466e-4950-9651-9542874c38cf", "value": "1536:t+ml11IujxuIX9GtkxBP4HojtsKjIeh/riWj8iamQuPbiXaGYjqrU9+z:t+ml16ujxVXPBP4Hojt5L/3wiam/DiXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777494982, "uuid": "3ee2de96-f5e0-47d2-ab71-ee2f2fa7c297", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777494982, "uuid": "30f56c5f-4e45-4669-aee5-d399c329c444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777494982, "uuid": "e231e431-dd19-4b52-af5d-223dc915008d", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff6249e-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777441366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441366, "uuid": "8135e65e-bef7-45e6-90e5-e8cd2f727f17", "comment": "Malware payload (Gafgyt)", "value": "276bfb98cc77ace4b16610b78b96394c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441366, "uuid": "74482e16-b05e-46b9-a046-0d3de5e1192e", "comment": "Malware payload (Gafgyt)", "value": "f29945516df4e9c2f964acbab90d944d1171a7dfb1758b4b1f36b1399a1441dc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441366, "uuid": "93d7cf61-52f9-4bee-9d1e-4380aae28acc", "comment": "Malware payload (Gafgyt)", "value": "6f7ac86d4d3a6c43ecc22d32af54166a52eacad6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441366, "uuid": "4c58a3bd-1205-4178-85b0-6e9e45cc1f3c", "comment": "Malware payload (Gafgyt)", "value": "f961fa055899e4203353e59165e8ac7eac73d62b32ea43989f46eb3befdc2196aadc6b9013f654de92ea0e6d2e741ef5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441366, "uuid": "47961302-8319-4d5e-9440-a9a1467f4caa", "value": "T1D3E3A55A77618FB3D81ECE3306AA4602108CD55A02ED6F6FB2B4C56CE78B84F45E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441366, "uuid": "e2d3d7b5-1184-4291-9e0b-b97225987add", "value": "3072:JqSf87PE046LUNL5hdCgPumzxRxulq+1uPNd5R:JqSf8w046YNL5hdCg2mzxRxulq+1uPNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441366, "uuid": "05d158a8-8484-4e17-98e1-ad77420ca1ba", "value": 154580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441366, "uuid": "54e9d20d-c183-429a-b450-fd9d86d64bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441366, "uuid": "523852d4-5d6b-4484-8c90-7e90b311e8e7", "value": "assailant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3f3854-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777470589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470589, "uuid": "eae6fbad-e885-4a5f-994d-358f933aab84", "comment": "Malware payload (Mirai)", "value": "22c36ab6c6852b10a0d5f649e192bff6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470589, "uuid": "12a0e920-b130-4c17-b727-50ee3d135934", "comment": "Malware payload (Mirai)", "value": "f2f6d4fb3affdf8194d3d0a800370b867d5998c513dd49e6ecebb0734383bb2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470589, "uuid": "9fa34b35-73dd-4b5d-9ae1-075737ec7233", "comment": "Malware payload (Mirai)", "value": "296fc6569af892719607963c306056b4f5afdd42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470589, "uuid": "516857b9-cd41-4af5-8446-71026399eece", "comment": "Malware payload (Mirai)", "value": "39e3dde5077d91beea469911a8ca6d28c03f41204f0343cfaf4d4890ee3b60ae4da1cff5b447a8ebe9af4197ada2607f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470589, "uuid": "4abc1d7a-a076-4a98-ae01-82c2d1004550", "value": "T18993084377094F03D06329F026BB5BF087AABD6118F5B284B55AFEC99271EF16042F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470589, "uuid": "afe91cf5-ad2d-4af0-9f34-0689df7fe49d", "value": "1536:uLMm0jisRhf6Y4aK33rSCWlT1nfH5jATqSPvFFqTItVnrTWPN1dJ:umvR4YoTCJHSFqT0rWbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470589, "uuid": "c3f25690-c955-48cf-b9ca-5aaa28b5d6b7", "value": 88804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470589, "uuid": "a773bef3-3244-4240-b06a-865d4753aa74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470589, "uuid": "5a66f045-23fc-45a7-96aa-8d151d1ff643", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb55b6c-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777484904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484904, "uuid": "53a0d870-11d9-4c96-a1e5-44756017996d", "comment": "Malware payload", "value": "91424d38e571655411004289333579af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484904, "uuid": "26cbe1e4-34f3-493b-ab87-d1e6455ac90c", "comment": "Malware payload", "value": "f31f322c95b1a2860ea8c592991200df452c80a9beb3a8bf1431372e7842d218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484904, "uuid": "e751f771-4700-43b5-b09e-7748df1fa9fc", "comment": "Malware payload", "value": "367a414ab0c6345302286c7a5fdfa18d009017ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484904, "uuid": "99b79c31-e265-47b8-8975-07d3c0752625", "comment": "Malware payload", "value": "ae1d315c8ac594dcf7618dd6a300d80e342a124c6573ae44f2b6a2d5e7c71d394be27536879a206cdf5cb3870cb7fdd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484904, "uuid": "04d7f9e1-a6da-40b9-8bfe-c219f272044c", "value": "T131064C31324AC52FD96201B0192C9A9B552CBF760BB254CBB3DC2E7E1BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484904, "uuid": "7a572b09-0fef-49a7-825c-a1dc6645980e", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484904, "uuid": "83e0083c-3e8b-437c-8a19-0ffa76b9ca49", "value": "49152:xWbbWb9tjju4k9y6lHao8JhBJyRjYQcUBiUARPU8Gbr2Y5l5z9GPAELcpB2MpF8q:xr99u4kc8Hao8eRjYBU4UAir2Y5xGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484904, "uuid": "96d4a232-dba4-4b3a-bbdd-8c395bb8b40e", "value": 3690970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484904, "uuid": "b96954c7-0c66-4e30-bab7-cda5da1dba03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484904, "uuid": "ac1c6ce3-b976-4b2e-b04a-baf2d3a6c617", "value": "mugen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0222f5-43a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777451664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451664, "uuid": "1057c968-137a-4007-9130-29835f18daf9", "comment": "Malware payload (Mirai)", "value": "b5ebc64aa5b2191c8314af041285a782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451664, "uuid": "85d51c3e-56a1-49f8-89f6-f8ed558f6f0a", "comment": "Malware payload (Mirai)", "value": "f47e87499cf614a9a571a9fcec5d75f5a4c0a0f4b1b0cbb23caff7e56ed48c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451664, "uuid": "a4e16b6c-56c8-4547-bb97-b741db68035a", "comment": "Malware payload (Mirai)", "value": "3814899958fdb0dba4697f03c6661f08db34576c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777451664, "uuid": "e4b08eae-89e5-4520-af62-83d5d4737bef", "comment": "Malware payload (Mirai)", "value": "6aba070ce881dad1f6a46c4eaa7c7395875d88983743bdfb277a230fab2b60c54aba07f0c130edddca479c467ea65c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451664, "uuid": "1deb7eea-d450-4bbb-8afd-71761466f7d4", "value": "T1CC730856FC814A16D4D206B9BA1E158E371313BDE3DE7212AD209F3077C6A2B0A37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451664, "uuid": "a69bdd37-b2ec-4ca0-b4d8-a7cbc01e917e", "value": "1536:HpnWsqwZJK4Ts0qvaQnH64LIfiOMdanH+u0tN5ZYes:7uvavMdanH+u0/H3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777451664, "uuid": "0759f8bd-2ad3-424e-a518-d014ccb905c7", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777451664, "uuid": "57c3dba4-3f6b-4b4b-b559-d7e26f225921", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777451664, "uuid": "7aa749aa-57af-4502-93f4-6dfd51d1ce82", "value": "asuna.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0981d87-43ee-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1777482840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482840, "uuid": "2aee119e-08c5-4faa-8fd9-214acd044733", "comment": "Malware payload (CountLoader)", "value": "e17f9740a4f7f5c62acead9e723c7eae", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482840, "uuid": "83b37431-ae0a-4033-a2d3-cae18d78bff2", "comment": "Malware payload (CountLoader)", "value": "f4cbfa1d48ee398e983eab2fc604e96c77c44334208c724c1217337335bdfdf8", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482840, "uuid": "850fd018-e132-4722-966b-b4b698c160d0", "comment": "Malware payload (CountLoader)", "value": "1d78ac8bc8933f2482ba0516072b866352201eea", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777482840, "uuid": "6487b856-2af3-4d71-8b28-763abd43c254", "comment": "Malware payload (CountLoader)", "value": "f197505d997fcbb3793cb6ed02d335c1b5fe95983ca30f59df43796ac641ff26c367852fd29c24f31d076eb1610096ba", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482840, "uuid": "3741e809-b2e8-4fdf-a928-1479775716d3", "value": "T12FB56B80A9D340B2D646223290B673BB67305C0D4F3DDB57DAA5BDF8BA7F7820827645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482840, "uuid": "44a077c9-d8f2-43b4-986d-7d5b625d7953", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482840, "uuid": "15dd9a58-1372-4494-9086-aaf62308d35d", "value": "24576:15uJ/YW5d6NwLb3ezR/a4qkYDYhDEneNUUKlIA5+OQRvXGiDvIhAOPGvKlyMCfd3:12zoh9JSqXfKyKHJvnoE7okxlEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777482840, "uuid": "c89c2640-c728-46f4-b72d-273e4f7881ed", "value": 2324992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777482840, "uuid": "5e564177-f836-4465-abe4-838a7bec25e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777482840, "uuid": "8d63cde2-be34-40cc-bdda-0f6f53998f9c", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d0be8e-43d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777470600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470600, "uuid": "5f4aa306-44ef-45b1-944b-875945b1df3b", "comment": "Malware payload (Gafgyt)", "value": "9701c48747bdb613eae94fc7739695c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470600, "uuid": "d1794da6-2a18-44ad-a098-b4d983fbe750", "comment": "Malware payload (Gafgyt)", "value": "f5857da89c671bd6c813a209d3bcd0ebe9642183f729ff9535e1d8e660ca0850", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470600, "uuid": "1f720e00-8e1c-4a5b-a008-715a8adebb93", "comment": "Malware payload (Gafgyt)", "value": "ebd9521ff313d8432e3884065799281647c832b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777470600, "uuid": "a3f469a6-cac0-41d2-b68e-11826a721210", "comment": "Malware payload (Gafgyt)", "value": "61145caf9209a1d6a0721ec5b5bd48a1e0ed2f4b38db7cbbb72a963f167374781767b5164fccbcc54098b9ddb36e39d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470600, "uuid": "ad931602-2b54-46f5-b37f-cb2304634240", "value": "T1DA054956F8809F22C5D125B6FB5F42A8731747B9D3EA720699188B343BD782F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470600, "uuid": "e22bef15-ee8d-45ca-b731-8337b8cffbc3", "value": "24576:UXIY/nCHx5F4WagCn76kClSVbwhaMClHoNU:OC/F4Wax7gIAaMClb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777470600, "uuid": "aef66f40-f436-4889-baf2-4de4875d940b", "value": 850080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777470600, "uuid": "b9159104-fc3b-47c2-96d6-b8f1f67dd3ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777470600, "uuid": "210ffefc-04bb-4839-90c5-267b49154004", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70d5c96-4364-11f1-a769-42010a9c0008", "comment": "Malware payload (LimeRAT)", "timestamp": 1777423554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777423554, "uuid": "a889bf63-5def-41cb-9778-0fcce057a046", "comment": "Malware payload (LimeRAT)", "value": "e9e6a9e19d2e39d74f5d650bddf6c856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777423554, "uuid": "da5a8f4c-c232-438f-9fc0-962084a67f85", "comment": "Malware payload (LimeRAT)", "value": "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777423554, "uuid": "46c9b991-6769-4889-88b7-d7c256b434b4", "comment": "Malware payload (LimeRAT)", "value": "ed13d69de43570998edca4258b929bfaf0271bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777423554, "uuid": "f6d4f432-9614-4017-938a-ef0b07979126", "comment": "Malware payload (LimeRAT)", "value": "ee3edc95f87c532417954a216d1fb52f861115523771f1f7ec0a231bb5324853929ad79c7fcc1e9e3b76ebf8b6af93fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777423554, "uuid": "5d888d4d-4769-4af3-9047-5b7b9caf85ff", "value": "T177844A2437D1F01EC69D5AB28F86F0B816703D5A5E568A2639CCB3CF39BED904978361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777423554, "uuid": "40a38f03-7ff6-48c8-8639-bb9b9c35a4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777423554, "uuid": "33cb10cc-96b8-4d10-96fa-6536718b11c9", "value": "768:sj8T/2iB9/fi/Jak5Ni5rMYbUugGwog1s3xg//L//////////y/////////////i:sjG2iB9OJFlPuxwo4uxg/uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777423554, "uuid": "22678446-8f11-4bef-aacf-70c215ca73ca", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777423554, "uuid": "7dea121c-34f2-470a-986f-05bfd51e7ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777423554, "uuid": "f2d2d8f2-d8e4-4f70-af5d-3c1992a6fceb", "value": "New-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcec77e-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455643, "uuid": "0e9c160a-52ed-49ef-aece-d19b7b05035c", "comment": "Malware payload", "value": "08641397bc425e973b82f7842eaceedf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455643, "uuid": "161c36f8-c75c-4c31-8bee-e0c4467b6ad5", "comment": "Malware payload", "value": "f646bcabf42a7a2263ae5eab683b5e53bafd01f4c116193a4211dca8ad9ef055", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455643, "uuid": "2f9fa421-cf60-4f5a-8856-87b7ef1c233b", "comment": "Malware payload", "value": "7dcb62f8a9c502b2a7efe6c55ec0ef32d86d008c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455643, "uuid": "08a7b477-7c8c-469a-b3e4-c596c3502145", "comment": "Malware payload", "value": "3f929b8f91f97870d6d4fe2d68e266642bcc8ba27507454474fa27118034ccc4b269ffe2af96616f3f931f7a8bcc95c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455643, "uuid": "01417704-5987-4069-8d16-8e134ac57c16", "value": "T1CD27232EE5BCAE7D069562BC18E24ECA06FC09410679C5F1F3DABC0E5A4DB65309B17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455643, "uuid": "b9635181-8b8e-4148-9dea-da436efcec4d", "value": "49152:dKwKhKpKsKmK0KtKrKXKzKxKaA4CqKuKYKxKJKfA4CLK4K/K4KJKqKNK9KZKEKYb:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455643, "uuid": "aac49adb-7a01-4980-b095-16f7d104410c", "value": 22123546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455643, "uuid": "3c5cb5e6-bf2c-475f-916c-2928eb16e446", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455643, "uuid": "49c31dfd-9986-4102-bc0e-22738ab4a579", "value": "invoice-1645080830.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fafabe1-43e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777479671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479671, "uuid": "1b4624e7-72c2-4b69-9693-d23b08edd84d", "comment": "Malware payload (Vidar)", "value": "f273abd67990fa40e847fc169920311e", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479671, "uuid": "4932f50b-9bf2-471b-afc0-673e367fd6f9", "comment": "Malware payload (Vidar)", "value": "f661ed66cd3d4137859af3327e4943d41671ce1099f80a531280f4a2108ecc19", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479671, "uuid": "68ae64fa-7912-4973-b45b-0946e8cca7e7", "comment": "Malware payload (Vidar)", "value": "c4ddc2a0533a845c1d4ec34a9d5c77bf2cad167e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479671, "uuid": "b685f99e-622b-41b7-b4d5-06303cad4f84", "comment": "Malware payload (Vidar)", "value": "d47b362fd6e722ca220f136d62e6864aea5283d779784881257b8c6ccffb6c0eba06bd9ae15d5bda966a8a9453a2e9b1", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479671, "uuid": "1d2b3071-1a23-4f2a-b8ae-f32a7674d581", "value": "T1682423913A4C54B9F0C95132E0AD3B5FD736382B988AD5AFBED5BEB0C6D13087B16460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479671, "uuid": "6b840257-81a9-403d-8ff5-30281b8c27b0", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479671, "uuid": "7921f5e9-a960-4874-93b1-d3f5e871e344", "value": "3072:7EhkPIeyKI6giu6p9pDTsXCHDTKQaFmW2Uw6wp4TX/9MPCKK:61igiu6pBH/KdXFwa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479671, "uuid": "edb72955-d703-4fbf-b6aa-1d4053f5bdf1", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479671, "uuid": "c41a157a-6094-461f-ad8b-9d3d6a3478a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479671, "uuid": "1c579b44-aa06-4316-ae2e-942ee7de9bcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5b165-440b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777495292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495292, "uuid": "e09bd981-0ae0-464f-ad85-024bd2f7a7eb", "comment": "Malware payload (Mirai)", "value": "452078b492a7a6a8426c1399552743b5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495292, "uuid": "c78f5d77-0dfe-4f13-9c66-3c5e668cfe37", "comment": "Malware payload (Mirai)", "value": "f73b6acd1ee45f1c9d604d1fa1754ba7b48365906a67c74d2cec3fff07784052", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495292, "uuid": "e0c91190-8359-4980-b4b8-81f3754b80aa", "comment": "Malware payload (Mirai)", "value": "e65ecdf68c90ac44223ca5e182b4917db8660321", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777495292, "uuid": "5c71f4e2-c83f-4588-88e2-2112d3d82f88", "comment": "Malware payload (Mirai)", "value": "ca266df97745f3ad91a553828966c14a2bebabdc369aa94cd61594a6a56acd1519ffde29f63ff3e76a46cc3e61fb2264", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495292, "uuid": "c70e74a9-960d-4c3a-b7ec-d942e1857fbb", "value": "T1CCC3C91E6E21CFBEF65A827407F78E31965877D61AF1C685E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495292, "uuid": "a6203864-5d02-475f-a2f2-8b06e2547d92", "value": "1536:tw4lPfv7d7Y/YLYdAo1OhNWHv7t9i8pPDoM1ISWlKnKevNeThfF:7lPfDdMLdAoKoHv7tppPDoMCsnShfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777495292, "uuid": "45746972-4f18-4a92-812b-90da1827344b", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777495292, "uuid": "d88808da-eca2-4a95-83a0-6d641748b223", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777495292, "uuid": "c5830a61-04bd-4019-8e68-4be8ff6bf606", "value": "night.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9000149f-438f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441930, "uuid": "41da1934-e74c-482e-aad2-8feaf2d5f9a7", "comment": "Malware payload (Mirai)", "value": "540b02e412a40882bae0f85be0eb5f64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441930, "uuid": "3de61202-eab3-410a-8642-d50f8157d38c", "comment": "Malware payload (Mirai)", "value": "f77fb33f62f75a65255bf83f3d87b244f9b5fca8fcf71fd3df2c9410faf154fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441930, "uuid": "3bd10ba8-1e0a-4697-9cd6-5f21f0021e3d", "comment": "Malware payload (Mirai)", "value": "8fd7fbcfe7939491ec3014cdcef87da97e10579c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441930, "uuid": "336b1816-8f76-48cb-b6a9-3691a5304afa", "comment": "Malware payload (Mirai)", "value": "343ae60707a5cdfa6b900711add80e03899544e62b86774ab9f52b67c2f2a243f190a2cb57ee3211111fd062bc70f31a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441930, "uuid": "e0a612e3-4499-4c42-a3b5-ea78f6fa73de", "value": "T123D35C43AE905EEBC01FCE70866EC35722DE98DA92D1733B717C8D8C766D64609C3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441930, "uuid": "51aad1db-cc5a-41fa-8013-29c516f712f7", "value": "1536:dpMqKUSgbN6FeKZrCKThlM0uvLnxLkAxqBGoDnMx/AmHPLccHbtMhKJu4rC47:dpMFgbYdZrKvLVkXGWCAmvBHbKSrC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441930, "uuid": "572ef6d4-87c0-421e-a4dd-47db4d7d975b", "value": 138592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441930, "uuid": "c306dc08-14db-4cf0-97bd-06998f041e25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441930, "uuid": "41ffca3e-e099-4035-9bbd-d7f41bc19b15", "value": "agent_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0264213-43f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777484987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484987, "uuid": "31fd8e36-2458-4301-985c-d10739e5764b", "comment": "Malware payload", "value": "d74d54fb6d9801a788dc961426922657", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484987, "uuid": "370c0d93-c1c6-4ff8-9e27-271bb28e4886", "comment": "Malware payload", "value": "f801b2d49fa88c4c0ab065477efb6aeda35b876a496176d00958a5b814bbb9fc", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484987, "uuid": "bf384f50-1bcc-42b8-8b73-ad1a9083770a", "comment": "Malware payload", "value": "5a30243640fcea1b755218e0b65ac51214026169", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777484987, "uuid": "ece9ec3b-7045-4cae-a0cf-433407a6d813", "comment": "Malware payload", "value": "cc11e267b92bd2f5c7e403d043d28eabda653a574fed3a94b92cd7ad12580065fa494efb060d1739bf98d5b7fa0fecaf", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484987, "uuid": "17fd6ae6-6b71-4b1e-a956-4908e8d0dd9c", "value": "T105537CACF3994DBC1FF15493A2510E2109B8E42086C158EB6245FBF71C9E945F3928FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484987, "uuid": "42d6e067-752a-4c9a-bc5f-b944595e66bb", "value": "1536:3hzSRAiN+6d+Z6lWosvr730MRXBNHyC18e+xdki84zXpJ1sm3+60iEQaJRvByc5t:jpu+kcvroyx1yC1mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777484987, "uuid": "df602915-965e-4773-90ec-e46161786d72", "value": 64688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777484987, "uuid": "ca2743a7-5ab0-4cd4-95ef-25ab09677605", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777484987, "uuid": "ca5e49b4-2c7b-40e9-b321-4ce1ebef5569", "value": "ajogu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f2a742-43ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777483198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483198, "uuid": "ce2eea81-35e9-42ff-8484-9e48c5331f87", "comment": "Malware payload", "value": "efad46229e0d2e757c9d98fce92cb50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483198, "uuid": "6bc6d68f-745b-4a2a-83a0-5b2eb01fbb06", "comment": "Malware payload", "value": "f86352ecaf34773e85d979220b9825f6c1ec45b5c93d5ecca9998dc2b49cf3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483198, "uuid": "acc3816c-83af-4058-b979-ff301f2e6e47", "comment": "Malware payload", "value": "1f6eb84506c03de716e2af8239f050176287425d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777483198, "uuid": "4f97af78-99df-474d-b7e4-60c441df44c3", "comment": "Malware payload", "value": "34b7e157c6b26390686c787b8d678ba52659ca8b227c7fc1d589fbc0f203288b2792a917588efa71f1e5fe595d67ef02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483198, "uuid": "45e3ca37-b99d-4ca3-a49c-f9f2966e9d4c", "value": "T190E733C8D50D9811E99765F2D7B938A8EF4D16C0C4FDC231A6A89F0EA05FDE14B4B863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483198, "uuid": "cbf69287-b111-4770-b8db-61cf760f729b", "value": "e24e2b765a0ca8ebb142df10bd69ab5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483198, "uuid": "dc723581-d929-4fb3-873b-f3bac9774470", "value": "1572864:VLdkjx5RYiCUdc6O4sdUWV99kbvCgrs4D6uSicJJyXT29lfuv:V2jxpnO9dUWV9ERrsy6uS92T29lfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777483198, "uuid": "17414d48-1cfe-4d69-9855-6e4234bc8e09", "value": 67582173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777483198, "uuid": "c4382434-a052-47fb-a372-c066b9b7a9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777483198, "uuid": "b836ef05-f02a-46af-a72a-6429376c8563", "value": "ProjectLoad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f284fd0-438f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441928, "uuid": "95b9557f-edb7-4ae5-b4c1-fa8ac1319d31", "comment": "Malware payload (Mirai)", "value": "0eefb0882b40bb6832305cea6a352ba0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441928, "uuid": "9c35066c-8b26-4222-b741-53ddb3d21d69", "comment": "Malware payload (Mirai)", "value": "f8ceb83ab6d5f7956aef89a865cdea7ef5ee0daaafa9e10aac3c89ca2fe94ed4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441928, "uuid": "eb045770-a9de-4113-8c59-ac52acbf1954", "comment": "Malware payload (Mirai)", "value": "bd05d2bf0701751f36f960a725982fc7c43f965d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441928, "uuid": "2ccb3175-ac5b-45b6-bfbe-3f527c72c41e", "comment": "Malware payload (Mirai)", "value": "38a6b51c9805463542d1e26dd82b52c0b795fde8be25f530396cd68be50a6d932ad78e16247087569a79a1c5427efdfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441928, "uuid": "791cf75d-4b21-4d4f-9be3-1414c5c512f7", "value": "T187C43955F880DFA2C6C12976F65D86AC73074B79C3EB720689244B343BA786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441928, "uuid": "7f678e8b-a2bd-4706-a2f4-596c01c47c62", "value": "12288:+1GwvZnrx3jpEEm8gqfLgApGIMXpZ30gpkItus:Mdrx3jSKUAgIWpRvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441928, "uuid": "0b9e44e6-dfd5-4411-b53e-cfd6df2be9f3", "value": 558236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441928, "uuid": "8b935cea-3537-4c48-84b7-c018c480cc3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441928, "uuid": "2aa26cb3-c2aa-483c-bff8-c7e0402e0d60", "value": "agent_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb7ba7b-4397-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777445439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445439, "uuid": "35920b7d-3cac-43dd-95cb-ab76c0fa09b7", "comment": "Malware payload (Mirai)", "value": "2d1b66bd6058053bda2dad1c3e10ebec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445439, "uuid": "654d0b27-f635-4d8c-b5e0-b448108d38b0", "comment": "Malware payload (Mirai)", "value": "f93058cfcf48460732923aa205c62d74247c427816d41648aa3b9f360b025370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445439, "uuid": "4d1c0348-a461-410a-8e41-5f60c18116a8", "comment": "Malware payload (Mirai)", "value": "ee2429f654b7489546c501691a09d30d433cb3d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777445439, "uuid": "70d3915d-6463-444b-b8dd-1345785329eb", "comment": "Malware payload (Mirai)", "value": "0358af86070a22527967661d636e7bc0a2699e7125bbd4052a2161719caae7668a1a5ea31b38efde63eeca68cbd70969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445439, "uuid": "f25ce626-f1cb-498f-81dc-7a2ecd5bedaa", "value": "T16AF32B56E6418B07C0D217B9FAEF825533239B64D3E733059A28BBF43F8679D4E26205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445439, "uuid": "5c9f63d3-4688-4efe-9d2e-a0ecc05caef6", "value": "3072:r3xW4MFRiqiaRV52ZzGaMxUE9VH27IT71Hc+ENW+TjM/9/EtXUmGwIb46MP6:r3xWvb7iaRv2ZzGaQUE72cT71HcpNW+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777445439, "uuid": "cb3f0f38-db14-4247-b2c0-e4b78bc83aeb", "value": 169112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777445439, "uuid": "ee0c939b-db5a-40e4-81f9-da0c982f8823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777445439, "uuid": "ff051394-4d3c-4a53-b852-0baeb926e34b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e20318-43af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777455516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455516, "uuid": "beb42cfc-a0ab-4406-959e-876ce3c09c12", "comment": "Malware payload", "value": "e7d59bc987e6c359888f7eeab7eed987", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455516, "uuid": "301fe10a-f206-4bac-b3e3-b297555dd08b", "comment": "Malware payload", "value": "f9585ee754feb665c4c843fdb99a3ff67c81bb3cc1bfcc9c89b90bd3a24dca23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455516, "uuid": "c5007e54-8f74-4b0c-8779-87b7b33b12ee", "comment": "Malware payload", "value": "97d9ea30a5226fa5cf3bd55af0c3829a9faf7514", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777455516, "uuid": "698b1cf7-2c9c-44a7-9659-34388606510a", "comment": "Malware payload", "value": "f5715a39b7606b9d3a7bcb4d7d62ebb25c81d30fd2cae169feabfa541b7c5673520c1b8dcb39d80bcfa63a60ceacf097", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455516, "uuid": "a3be8fb2-4c8b-4954-8460-ca081a263c52", "value": "T1C137234BBE31586E1C5D757D109E098757FE00181888DEFACBF7A435E2DBA7E20AE064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455516, "uuid": "a219f3bd-88ab-41e2-9872-08eb7f81ccf3", "value": "49152:EjJjujEjHjHjBjnjBjWj9jTjRBJ6jtjHjKjuj8BJnjGj5jjjVjHjcj2jAjFjJjTs:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777455516, "uuid": "926096cf-ab2a-42e0-a60a-a9dbe283afac", "value": 23164065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777455516, "uuid": "ccc11d2a-589b-4c1c-b13c-42e3caa9b4ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777455516, "uuid": "129fd2c5-0f4b-4461-9ad0-254683077aae", "value": "invoice-1645080830.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ea3e67-43bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777461349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461349, "uuid": "5e52f722-3638-4954-a180-9940e21e9094", "comment": "Malware payload (Mirai)", "value": "b96abc014e899ae5507fdec84db61a8a", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461349, "uuid": "f8753cc9-8d83-45cf-b46f-a8eba3332e86", "comment": "Malware payload (Mirai)", "value": "f98139db0ca2cdbe681de3421c2b7b9479ac708b972658996e33a31d285c2746", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461349, "uuid": "795f4a62-8690-4864-8f83-1eee55f34846", "comment": "Malware payload (Mirai)", "value": "c00a36ecbb8d678d0a9e0368603b7d9e702b8173", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777461349, "uuid": "ff2a87fa-471c-4b76-9dab-badcfd840f90", "comment": "Malware payload (Mirai)", "value": "23b214cbcf232f434345e6c0bf89875ac572143cb89d243cd141222351e934d4a2d415bb4cb51f207d00b4718b39bdd6", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461349, "uuid": "96f27335-bbb9-4f10-9c5c-53eda66fd0a4", "value": "T1DF734A03BA4295BFC497D1F057EB9624DD32BC2E193272A97B94FE912F58EC02A1D310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461349, "uuid": "84d1229b-0ecd-42de-943b-ec03142d6143", "value": "1536:rJC/jUMHYNk4WiwnhOQuazIesSEVpjwGxia/B3IIFhMxu2h:rJk2kiwEJowScEk/xSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777461349, "uuid": "72d7c00d-b3d9-4930-a4ff-3d0dd6fd4abf", "value": 75624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777461349, "uuid": "4a41de92-118f-4f6a-9881-373e71371a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777461349, "uuid": "0a3c3098-58e8-43e5-828b-a122e5ca95ae", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed20699d-43c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777463561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463561, "uuid": "3bcc7f7e-1c9e-42bd-90f1-0947ecda807e", "comment": "Malware payload (Mirai)", "value": "fa2488cf6899401af42ff4bd346b19ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463561, "uuid": "d15e2495-1ab3-4ce7-94ae-4ce9d667f827", "comment": "Malware payload (Mirai)", "value": "f9ccd12913b1b05cff3684dffe3180975d4ed2ca3166b8ef986a0e8e87796687", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463561, "uuid": "29f11bc5-b128-4306-ae71-a604f00ded59", "comment": "Malware payload (Mirai)", "value": "f38b5e67648e67494f02a01b912af26a21451662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777463561, "uuid": "c8098f39-927a-41fb-9770-d7ccf7dc8e6f", "comment": "Malware payload (Mirai)", "value": "d44b7aa4e3306e56d24d2c779f366780784dd19e6b54f1d7cffce7fe460284f121029c93587988bea97f42a57029706e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463561, "uuid": "18434985-878f-4fa1-a05c-68648a458d6b", "value": "T1D0833966F9418B05C6C112BAFA1E528D7313077CE3EF72269E24AF34678796B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463561, "uuid": "f0eba285-98cf-405c-a154-3fdacebec744", "value": "1536:vEnuBlASnAtImTPeBofqoaqgFQgJGOg4MLiwtNXXss86Uzq+7o4dO57Y6t2oGZ:Z0SAtZSBofqoaDpMZXss86Uzq+zdOV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777463561, "uuid": "36324e07-5695-44c4-9272-829927439415", "value": 87516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777463561, "uuid": "35c7f5d3-a396-47ab-9ae0-4079cf986fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777463561, "uuid": "09f474ca-51e5-4895-bf6c-affe8bdd1157", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9460b78b-43a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777449668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449668, "uuid": "371cdab7-f661-4592-bd99-661362700c18", "comment": "Malware payload", "value": "21039f10cfc6c5478fcdeb736bd8e005", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449668, "uuid": "a616854e-5a91-4cd9-9acd-48fc44917f6e", "comment": "Malware payload", "value": "fa9ee575e1e76b63bf3a8505656ea2553c212fbdd97399f3cb1f8969b1eb545f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449668, "uuid": "1e125acf-fece-4535-8d7d-487b64e69008", "comment": "Malware payload", "value": "62e44620e05f04f128e05c0800e3d46f5f52dd85", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777449668, "uuid": "5f218ead-c2da-4bd9-a703-65ac22923088", "comment": "Malware payload", "value": "36597bfd8bc75c60e107811e375a4b1b06597b22822b6ce5be235814cd63a1cad4cd43b1ed5d64f4c66e7f6f0dd72118", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449668, "uuid": "9a6698da-b400-436e-8ed2-7d6390d6c307", "value": "T115128457AD5726E07E768466AF6FC14813A5070306BDC050B22EE9C25F5CA6702F8AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449668, "uuid": "8ad2a7aa-b972-45e6-89c2-7f2db6e215e8", "value": "192:6S9WMunMYHCUGSSEHn9Ir1ZJSt+u9JaXw/EwMettECxLozGCK:VIpH94/Sya2itECxL2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777449668, "uuid": "76bb40a4-953a-40f8-911e-b3ab1d0183b1", "value": 9473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777449668, "uuid": "3c8cd1da-7130-45e9-be67-db860ce2f45d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777449668, "uuid": "eb120812-f536-4488-a41c-d64d53ae64ec", "value": "tebx8wonw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cc0137-438c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777440466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440466, "uuid": "62fe2994-953c-43b2-887e-36e12bb5031d", "comment": "Malware payload (Mirai)", "value": "b127a7aa8200afbf8deb8963dba84281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440466, "uuid": "b4c71131-b31a-4613-afb8-3694fba90cbb", "comment": "Malware payload (Mirai)", "value": "fb1747422a0842d8963ee9d72eddd9d5ec3cf3e6d91adff3640add81f290eb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440466, "uuid": "5b85b9de-f830-46ca-9841-48d854cf373c", "comment": "Malware payload (Mirai)", "value": "f8a3907ceb042c37eca9f94baa3cbf512ba0418a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777440466, "uuid": "168cc105-96a9-40ae-9010-6b395dbf7510", "comment": "Malware payload (Mirai)", "value": "de5dd9246f62be4865f43fdfc7339174919f3641620afaae7bb334d47ebdc31c72da31b5580c1516d70b91076c42eb38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440466, "uuid": "cc65dd2f-a376-42e1-aedb-4a04335d2ff8", "value": "T104C35B1774C1C0FECCEAD1B88FEAE126DA73B4295134B21E27D46A261F5DE205F6E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440466, "uuid": "ad1db992-6694-4469-a0de-dfaf95282cf1", "value": "1536:sQYZ7qo81LlymV6fC4axMvB61ce5XjMiE2b2xW50N1MwccxF3a:sFZ7HMAJaxM81ce5XjM2b2xW50Mvcja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777440466, "uuid": "1d658d91-7d19-48de-87df-0c61b2ec05c8", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777440466, "uuid": "5055f401-be17-425c-83af-ae75b613e752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777440466, "uuid": "373755e4-4861-4c74-9364-bcf39a208410", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089f5d5b-438a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777439555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439555, "uuid": "aa401ea6-6276-4fb6-99f5-17831787fdfd", "comment": "Malware payload", "value": "52663acf8d21bd4a91683edd1b2149d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439555, "uuid": "29a71518-b318-4c61-8bf4-ad6a7b92af53", "comment": "Malware payload", "value": "fb73b089690545779cdf7ee2f41c8d56b0cecab8908565ca638295807f41ceb9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439555, "uuid": "083ae8be-5962-4bef-b453-d1ec44282cc8", "comment": "Malware payload", "value": "f306382b322454c1ec1cbed3f6fc9f129a21dc37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777439555, "uuid": "ee4d1eb4-92aa-4052-8806-51fe1d650ec5", "comment": "Malware payload", "value": "21a56dd4be17453cd66f5a8c391695ac537f1d02d11d4723bcf99186c03a8884e3b97fb477658ed7dcc52139aa51b874", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439555, "uuid": "4627f92b-aaf4-455b-9b39-315ce06a893d", "value": "T16D137D6966857C24AE9988371C7E2F0CB9A983E1310851EDBFCB3CF58C496DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439555, "uuid": "20d7c084-39b1-4225-befc-60606ef4adee", "value": "768:bf+Z9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bf+ycy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777439555, "uuid": "7c940198-35b4-4d2b-ae77-15b74fe23a56", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777439555, "uuid": "379088e6-208e-4b83-8ed1-062aa970ea01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777439555, "uuid": "f16d1b89-184a-4dc6-a030-579f25fb0bae", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea200d2-43e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777479991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "fff86596-12fd-4982-8090-b1f3a8fa015d", "comment": "Malware payload", "value": "a2881c9d22e27663e9dd2597e97bfa0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "6b00e6e4-a53b-437d-9c0a-5e2791714694", "comment": "Malware payload", "value": "fc1de9abdfe9a31a30aed6c10e6cb2e3226afc8fd50c66b139d0851676f71927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "9bd7a1b2-c61f-4678-835d-3f36865f1289", "comment": "Malware payload", "value": "64bd28304f19fb6a90c843b27e0571ef60c74702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777479991, "uuid": "63b19f60-91e7-448c-aa66-ab2842b90d83", "comment": "Malware payload", "value": "3a8bc967f3b8b59d5223ba6996ad4053a849f5c8c2a0f9cd2c8398fd8bbd78a126045ba144c360ae4842c91ee68b5e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "05b8062a-83d8-4515-a8d9-e91114a93b04", "value": "T16D183343E8F9DE23D5FB6F7197F400E3919A94C6588414AA958627F9F6CC2CE122CB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "e7ad4b69-5226-4aca-a67e-17a50c953fee", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "53952538-d140-46b6-a763-80b0460385c7", "value": "1572864:jb2YVAHXCo6FALauLYbTWhEngG0PXJIfKaNT/bkRP:jb2YVA3CHWX6TWDIfKaNrYRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777479991, "uuid": "4f627f9a-1617-4f83-8d70-e288ca4f4e72", "value": 89160120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777479991, "uuid": "e19ce6a6-510f-4449-809f-94da1a72ecc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777479991, "uuid": "8fdd432d-0441-4a21-b73e-a5f3cfe7d7e5", "value": "Lume_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fb2812-438e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777441302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441302, "uuid": "f5b48a9d-910f-4cc3-b251-493a1c28f1ee", "comment": "Malware payload (Mirai)", "value": "610ef83a8f16c6074bc3f8f365f5b21e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441302, "uuid": "f9173c43-b3c6-4ef2-bc40-73e912d8f4ed", "comment": "Malware payload (Mirai)", "value": "fcf843df44eeade097d862f244e1b1a46334d30e18595b2f0647a4be88ca61a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441302, "uuid": "ef66fc18-56ae-446a-aa3c-cfa8eea71c68", "comment": "Malware payload (Mirai)", "value": "39de5d67633c2e1916fb30869c823f3ca1d611e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777441302, "uuid": "1a4087a1-dbf9-477b-b553-af283fc11401", "comment": "Malware payload (Mirai)", "value": "b8730df3e94a98f628f5fbe2ce90f041f8dd39995a90dac1030b63c4ad614f15fb53f2980b11c779a86100a30dfe56e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441302, "uuid": "1f1c1683-9cdf-46a5-a3b3-e9e89623c43e", "value": "T13963941E7E219FBCFAAA863447B78E12564833DA37D1C581D1ACD6012E6064F341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441302, "uuid": "ba1bc489-4731-40d8-b2a0-7b1a2aaa6f44", "value": "1536:LnN4ZHPyGSyqSuI28LMkEVacv/3bLBX8Xt:WqxhJBacH3bLR8Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777441302, "uuid": "b9f049ef-0478-411f-87d3-b92f2b7c1fbd", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777441302, "uuid": "ce40ce29-8b5d-4b41-82fa-4d08363f79fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777441302, "uuid": "23c51ee9-a983-4e47-940b-9b9497719409", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6093cd60-43b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777456882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456882, "uuid": "550811d7-be6b-42d7-91a0-66584b00f0c5", "comment": "Malware payload (ConnectWise)", "value": "d4d778f43ed942bc5c8bc6bb6e68faab", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456882, "uuid": "f776cbbd-7c0f-4d20-adce-0e6d9c5a3973", "comment": "Malware payload (ConnectWise)", "value": "fd194b6cb538d710482b2e2d570814ccc4ad1135550ca7316e43ce5e0afa6552", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456882, "uuid": "4edd0093-aea8-4e14-89b6-4b35bc4c3fcc", "comment": "Malware payload (ConnectWise)", "value": "eb41d3dd78ec2a0918a10cee17449e4d3e00dfb9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777456882, "uuid": "fa9820ae-a563-4820-96b2-08dd3593b112", "comment": "Malware payload (ConnectWise)", "value": "82770e23fb94fb1fb0bbfb9887e489833de1041deb5055f2f73bd629dd61b5e1157cffe163b59dfcfde0b9f69f4d119d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456882, "uuid": "ce8fd00b-d4d1-4257-8457-ad17238bffb8", "value": "T1E7647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456882, "uuid": "5d54d753-439c-4c1a-97e1-a2c7863923b7", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456882, "uuid": "f55a4ec5-f3f0-4533-af40-366d57734e5c", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777456882, "uuid": "117bd096-25b4-4b36-a217-e97d528aad8a", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777456882, "uuid": "3a954576-3e65-4a36-83da-e969f0b4b19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777456882, "uuid": "e35a6c25-efef-4447-9110-0c7a41b7962d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15953ed-43fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777487915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487915, "uuid": "8fb44247-25d5-4f00-a116-0a7416b6ac76", "comment": "Malware payload", "value": "e11ce158cd2b3112a2160dd38697340f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487915, "uuid": "3aadfd3d-6af9-4a97-af2d-c26c65a447c4", "comment": "Malware payload", "value": "fdb5b69b13768ede6df401fc0f6fac8d20e8f62b77622100749770681499e846", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487915, "uuid": "a37c83fc-79d4-43ee-b09a-957849ce8d4e", "comment": "Malware payload", "value": "70fa61cc00bd61e5c644149787b75d586619c952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777487915, "uuid": "62d45ada-5aa9-4100-a97b-05cba8adaff0", "comment": "Malware payload", "value": "c88eae575d2f9e2b57ab7b951b93242eca92e5aaf4fd68f70d8962398ee213a7724ee4672c66bc107c526cedd95a701e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487915, "uuid": "8f8fc04d-f553-4348-a046-a5a03b10663e", "value": "T1C9D68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487915, "uuid": "3beb3b2a-c508-490c-8c6f-f522d63bc2bc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777487915, "uuid": "68a97d7f-4d2e-4f46-aa17-d9b8239189b5", "value": 12976128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777487915, "uuid": "1ad99ce4-bcd2-475e-885c-8c6050d2f15e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777487915, "uuid": "207eb680-0222-43e4-8037-83cbc0387ce5", "value": "fdb5b69b13768ede6df401fc0f6fac8d20e8f62b77622100749770681499e846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }