{ "Event": { "published": true, "date": "2026-02-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-15", "timestamp": 1771200181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2607912f-822c-46a1-aa2c-c3985e13ce43", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0727ad13-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150432, "uuid": "f8b369ec-0ec2-4572-ab9a-8ebd0df77607", "comment": "Malware payload (Grandoreiro)", "value": "16a7a146ca2ca287f05f778506b763c3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150432, "uuid": "1bf95055-064d-4870-a9f8-4767c4464fb1", "comment": "Malware payload (Grandoreiro)", "value": "0012dee6d43f8a6dcbf3d463f16fb11b431fce29943537afca7cafb1f2dccf2d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150432, "uuid": "4ec339cb-3504-493e-96ca-f815d2b2bcb3", "comment": "Malware payload (Grandoreiro)", "value": "d1294076579a05fd5214da14c79cccc432d64493", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150432, "uuid": "a5f86867-b098-4bbe-863a-2bb989f32e73", "comment": "Malware payload (Grandoreiro)", "value": "9de71d309c5a95f8cb391d90ccc8352c68cca0c5f341fbef462256db13e0bbf24df39fb348c1d528efaec836dfda9c23", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150432, "uuid": "a3709c0a-07d7-47a8-8a94-f25622a667a6", "value": "T1AF262334F9502997C6404BB2787A3A31BE3E710B478E96D1785CF35A37829E3A73B854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150432, "uuid": "f36449c3-dc7f-4aeb-bc43-3c687c6fdf48", "value": "49152:jnbzVyhUzlXezRtg8KB2hBP49GI0MDO1R3XeauWLbzYEUfDdXPYuD4hnTq:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150432, "uuid": "3cd8e4dc-7412-48a3-a67f-6fe1f2e6a487", "value": 4755456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150432, "uuid": "8a7c661a-9678-41ab-a399-128e830e45a9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150432, "uuid": "894c234c-363d-43a8-8f02-89f804408485", "value": "Reg4I6Z20349-PCBR.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ebfcbf-0a90-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771175131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175131, "uuid": "d2372f6a-7564-4f5d-8676-369fded59360", "comment": "Malware payload (Mirai)", "value": "ccb5eeae38c924345589821ff75d85d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175131, "uuid": "b9010172-4619-43ee-b805-43d83b3a20fd", "comment": "Malware payload (Mirai)", "value": "00def227563541e149047cdbbf610401cbce51c60cec8d3b4c1d1ef77d6869c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175131, "uuid": "1b84e423-ca55-43df-8e96-8b8be5f16fee", "comment": "Malware payload (Mirai)", "value": "23a03f7343e07c1def3a6a8d6862f3ffd55c3e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175131, "uuid": "2f041ea0-d026-4940-8155-9837bc3ab660", "comment": "Malware payload (Mirai)", "value": "3367fa2f89ac77413045f2d9b7242d0fbc03e8168d36b077306bf06e19d718fa3f5856d54d8e3763b59e6b4a41feee43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175131, "uuid": "d883e015-4e77-4c11-99f1-d3df2395427a", "value": "T1C5833A85BD416A22C3C116B7FF5F428D371597E8D2EA3302D9281FA4778B85B0E6B706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175131, "uuid": "c9f57dfb-830d-44d3-b084-afe41798c572", "value": "1536:CAr1UwMyniL7amRPWdFO9seClbz6E/tU6k5KHrCSKmbTkOhON6cvHvnzW:CArqQ27FqsCvbz6sUl5KHrCSb5cnnzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771175131, "uuid": "9dab75fa-522d-48a5-a5f6-78354185337f", "value": 88568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771175131, "uuid": "8d072533-5bea-45af-b42a-80c6cf8324a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175131, "uuid": "6a0e4fc6-9088-4ab9-aba9-a9bc3defe406", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee7baf8-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120192, "uuid": "d2fdf919-be8c-4e59-9f90-91d88f25cbb9", "comment": "Malware payload (Mirai)", "value": "e3afb23b46cfc277b1cca503defdac90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120192, "uuid": "27e57651-dec6-4b81-9159-05c1596d1f05", "comment": "Malware payload (Mirai)", "value": "014c5f951d1172044cddafc71d74e27689c4c0041dccba9e531b2e8b8ad8fe66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120192, "uuid": "d80fdb07-e8f6-4e45-a423-8096b1fb8afd", "comment": "Malware payload (Mirai)", "value": "ffaa7e3a8f1d479f35a8ae821d3e4114284cbf49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120192, "uuid": "56ac709e-fd73-4b29-821d-ad4518343b40", "comment": "Malware payload (Mirai)", "value": "5c390d90dabefaff5d6f696add70ff6eeea1e7aa0f85c69ae7621f2d7b92962b5317043eb0616a9103d624b2d1b1d59e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120192, "uuid": "62d5a4b1-30e4-4cbd-9385-cf14ff79a9d0", "value": "T17D93F842BD429F13C1C621FAFBAF059D3B166B79D6EB3202D921BF9023868D70D76251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120192, "uuid": "7c071518-e2fd-4170-8c75-6518c1247fc2", "value": "1536:wV4F+8wMvh/zTjmCon3rqMGbRCiWeFvkQ+vSLDgUMwdxMUF8D9a:wVSUujmCon3rqlNZdkbvSL7M39a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120192, "uuid": "b9ce7572-ef4d-44ea-9a2a-c1cb7f98ba7e", "value": 91532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120192, "uuid": "9edab450-e885-42b0-9fdc-54f1a7bcfa0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120192, "uuid": "3694ddc2-18bc-4209-ac4e-0556cdbaf5db", "value": "manji.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d6426b-0a0f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771119590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119590, "uuid": "cd474367-4648-425c-9bed-760acef66751", "comment": "Malware payload (Mirai)", "value": "ad82f0b8361ad2c86dbfcbc892ecc9ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119590, "uuid": "c2f96d8c-91f3-4a03-a897-6faf28f88b06", "comment": "Malware payload (Mirai)", "value": "035b7d20901c38e32d40799a24b5158a8e705dfdf723294733e86d1a112fe6d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119590, "uuid": "02132253-b6b1-4849-8b58-a2edaaec065e", "comment": "Malware payload (Mirai)", "value": "71a4558d528d715783afb5691b3dd91c3191cd70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119590, "uuid": "e2efe370-03fd-4d39-b9c0-8efba8472397", "comment": "Malware payload (Mirai)", "value": "203a93c7085562ff05f801f58ea40372d0f1cfeaf1b566a9a771f3339229c781d050faa57f94de31cc1466e9ce817957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119590, "uuid": "75bc0017-fe1f-448b-96ba-aaf75c5bc95a", "value": "T173A3299ABCC5C602C9E061B6FB1F51DE371643A8E3E6B107CD19AB29674B8970F37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119590, "uuid": "daca0dce-8c8a-49eb-a445-e5d03547c39d", "value": "1536:E4oXdELzG5NqpD8Rd4PcPtC52kKw+4ucDYnMXLs5+eRWIwz8vUXk:E4oXa4MD10Pw52kK34uc9Ls5+KOKUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771119590, "uuid": "37dbf5d6-bcb6-43c7-ac7c-668c1bb63407", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771119590, "uuid": "1215b748-39aa-4e6d-a4a9-b12d543ab2af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119590, "uuid": "87ac3531-ecb2-4afe-ac34-629491eec9d3", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af55b7a0-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118072, "uuid": "54c1392e-40b5-4dec-932a-a256a4b29706", "comment": "Malware payload", "value": "c818b95cab56d1a81170594002d941fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118072, "uuid": "b1611e60-daaa-4616-a9ee-375be37919bf", "comment": "Malware payload", "value": "042f6d9dd8f2216fd42c97f53cface4b23a3544a69ad0e458e06fdb368bb538c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118072, "uuid": "92ce6896-5e64-4963-9ed8-cbad1640200a", "comment": "Malware payload", "value": "c116bd956a82122000b1dd5949e48e4581ac6fa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118072, "uuid": "5f0ec48e-14ff-47ed-b7fb-e7f2d88a8467", "comment": "Malware payload", "value": "42b327f38384e2adc23048e20d7c0c567140a3c75a756a25c211ee51e70af1e7609bdec7dcb47b38b36925911d54e2ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118072, "uuid": "ca5df835-5407-4f3f-a101-2fb0fa5f9b42", "value": "T130E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118072, "uuid": "04d3c7b2-c05a-4eb4-8189-e028d6d92cee", "value": "3072:nxjJw1Cc/0s6YAPwenUr48pzfR+JonAy:nxlw1xAop0YfRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118072, "uuid": "f1dd0b01-0c48-4ef8-9523-e4f95b5d5f0b", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118072, "uuid": "47a3c34d-3fab-45b2-8026-4267c127a5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118072, "uuid": "359cbf21-861d-4b20-8f20-52ea68c348f7", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b6f92f-0a4b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771145465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145465, "uuid": "45779f8f-b703-48df-b85b-ea592ea11076", "comment": "Malware payload", "value": "97558949f8311c80823bca9f802be6e0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145465, "uuid": "ff6bd443-ebd9-4ed7-b797-88a7f4f307aa", "comment": "Malware payload", "value": "04c6ab57035d2f19ba8a00dfec1836e88d03bf8bf153819d751260e13fa269f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145465, "uuid": "57035d14-8265-4509-a8d9-a5af348c4d79", "comment": "Malware payload", "value": "43794a8ee7348ca5088292c8d1c0199cb044f891", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145465, "uuid": "f883cff7-024d-4973-a2b6-ca4d0aba2022", "comment": "Malware payload", "value": "a7aa0f738d7ae77e403ec465ad512157a1f4ae0b7f47d51fa5510f7143183970c1fef15e1b34672b7aba4940d77ca46d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145465, "uuid": "7af79fef-4aef-470f-a8bd-ae5f5ee2d02e", "value": "T17E187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145465, "uuid": "ff0e6dfa-f529-4156-87f5-1e9f570a9191", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145465, "uuid": "17d3ce67-57ef-4772-8275-016e437621e9", "value": "786432:fAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW8:fAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771145465, "uuid": "2a40c431-0734-4e3e-834f-c3691771c54f", "value": 90429440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771145465, "uuid": "6fb6dff2-0373-403e-831e-a937adea1c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145465, "uuid": "71ba5ca0-2e13-4b4a-8d81-1a4150ea8e15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b5fe0c-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193869, "uuid": "a850d83f-8215-4d2d-aae9-55c4d6800d41", "comment": "Malware payload (Mirai)", "value": "c4456da9ecfcd09ff2810fef049515f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193869, "uuid": "084172d0-921d-4f25-8e5c-c2f78ed1fc3d", "comment": "Malware payload (Mirai)", "value": "05a48c4743325851f38de8ff847d6f1d8e44b9ba44f789ac12b75b5024473a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193869, "uuid": "1573aa1c-88de-4461-b8b3-cdcb55ee68d9", "comment": "Malware payload (Mirai)", "value": "4b026bc04f57332038cbdac33b574724f18b263d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193869, "uuid": "97b2159d-6534-40d9-b1fc-e277471316bc", "comment": "Malware payload (Mirai)", "value": "1cceff15d3c7ee593c473d168a36aa1fba2e4552d2803e4d88f824d0f5a338caea611bf787ac6911218284a826fd5b98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193869, "uuid": "118e4ac8-76ec-45b5-ae45-ed3b22941e6f", "value": "T16CC33B49F8904F23CAD652B7FB5D428D3B262768E3EE32039D156F61378B95A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193869, "uuid": "6bdeba1f-3411-46f0-97d4-525b237043f9", "value": "1536:bB+hTi2kqWMghExBJCs2OR414VU24BTBJyUS2+qlufkwywFZ0x3l/6uAZE/OkcMN:b81WMgs3CsI4POO2Kux3lORU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193869, "uuid": "234171c6-63c0-4f8e-a43e-ebe3ca9da9be", "value": 129632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193869, "uuid": "43b53d30-99dd-4d98-b876-8fb1545afe4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193869, "uuid": "419fb544-2602-46a4-867e-3593f4a132bd", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287123ee-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193867, "uuid": "859676fc-6c4f-4df3-a76c-3c4f4d6db84d", "comment": "Malware payload (Mirai)", "value": "b4b2b6b28618bfc62759870439ffc009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193867, "uuid": "c931cc7d-84fb-4e96-b860-11a8ac717f98", "comment": "Malware payload (Mirai)", "value": "0ad08d082dbbff78272ff8c24fb0d081ec809080c219180a3d7319517b10ae0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193867, "uuid": "eb875959-2147-4cf9-a6b1-5e6b404af58a", "comment": "Malware payload (Mirai)", "value": "624273d2915dfbd1afbc0bd6d2127b7b01546726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193867, "uuid": "f84380b9-6987-4775-ab5f-7abf6ca9e074", "comment": "Malware payload (Mirai)", "value": "02dbcc7b35bc7c4ebb4862f4984a1e9dd13260a49b92acc92c099f3c0a7775ccb3157fd43f71e33f8de13f3706dcf431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193867, "uuid": "9f55dd6b-4027-4cfb-96b4-1967f46f08c7", "value": "T17D934AC5EAC3C8FAFC160575213AAB76DF33E17B202BDA47C39D9932A821511C61676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193867, "uuid": "459f3edd-7fc3-4fa0-89c1-e02245f57ed8", "value": "1536:5NllXn3Tq35VUZS5kq4D4XNw2f0I1f+nPjaI6SQsfT9rTeSno:5lXn3TqpKHIXNN2nL7TQ8T9rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193867, "uuid": "5989d5dc-be9f-4ddf-a51c-856cdf07339f", "value": 93704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193867, "uuid": "643ece6c-a8aa-4f5d-ac18-bbe5d5b39ac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193867, "uuid": "ce0b67c6-8dc0-4efe-8b06-5e31c810d80c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39208762-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193895, "uuid": "4b3a0831-efdd-4abc-8fc7-2418cc52ccb6", "comment": "Malware payload (Mirai)", "value": "b37f0d8d39d66db32678731acc599220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193895, "uuid": "c2a26931-c9eb-4f97-8172-974dcf7359f8", "comment": "Malware payload (Mirai)", "value": "0adc90823498151d6660303f3a787ac943877e3ee92ec08304f6322aafcbbb95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193895, "uuid": "cd3ce143-3917-4501-b585-9b216522592b", "comment": "Malware payload (Mirai)", "value": "fd813f8140d4b1d1354de9e0588a39eef25541ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193895, "uuid": "746d03c5-6dc3-4922-bb74-a94cacb0f892", "comment": "Malware payload (Mirai)", "value": "707ce7bc686a24227968ea9e4eedd0b9d448885c35e375165ac7c09616246a07514aae9e7f8682d37257ca27f9935f80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193895, "uuid": "02ea0229-a6a6-45cf-b3b8-ae978b1196fb", "value": "T127E30A06E951CF12D1C211B9FF9E415D37136F78E3EE72029D24AFA067868EB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193895, "uuid": "38f40319-7bc2-4a51-a2d4-ca3d518cf73a", "value": "3072:Jc447oQggWOfarK2ag/KdcgG9fDT0QCS9nF37/rpu:K4LDyfardaH2fDD79F37/1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193895, "uuid": "45401828-b26c-4b96-9fbc-43037062cfd9", "value": 147428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193895, "uuid": "cdb3960a-f099-49f9-b718-c855d93283a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193895, "uuid": "c03b406e-37b4-4b01-b9af-455d021bd12c", "value": "israel.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded4d25-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150390, "uuid": "5b2a46e0-c6af-4404-90bf-ac5f97e8542f", "comment": "Malware payload (Grandoreiro)", "value": "551a7bc823a86eabbdabe6844926c4e3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150390, "uuid": "3db8894a-417f-4f43-b8d5-58c67bd9a255", "comment": "Malware payload (Grandoreiro)", "value": "0d8177f8c1d9a1beece0effbdb02214227979bf377a242cf620f8a4c7713d3df", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150390, "uuid": "291c2f75-dd82-4e1e-9ae8-3357de420a28", "comment": "Malware payload (Grandoreiro)", "value": "0a137038dbd76ec10663490e7431bc4f063975f5", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150390, "uuid": "0540eff3-f6ab-4023-b34d-6fd264d3cd81", "comment": "Malware payload (Grandoreiro)", "value": "9ea39d9362575ca980c26ef4b2a98235e9fe74d33f0e1316da2eb7099cab7ac16d04f44b960977534e037c09ef2da1bd", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150390, "uuid": "e7beadcf-6ad9-424a-9140-8ba4f5d224a2", "value": "T1E1462331F68608AAC4914371713B3F7A2F7D7207458996C2B9AC9689BB07FC2D13F4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150390, "uuid": "201e8437-dd12-4912-909a-64e0667dfbb8", "value": "49152:9cZiCVADkvgYo1xjDnBGbXVYZrYhVKopuHJrsgxaenB46XyPBjoLMML6cJox1p2y:xuim3Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150390, "uuid": "f8c1b2fa-5ec8-4e13-92f7-36173c6b44ed", "value": 5441536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150390, "uuid": "f2f1bb4c-0f51-43c9-9d27-cb39ee66e181", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150390, "uuid": "83e92715-3013-4bba-be68-326526f6430c", "value": "PrdcX02B_959044ROCLPYXR24bqlpry.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82989ebe-0aae-11f1-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1771188005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771188005, "uuid": "243c5d66-55c4-4491-add3-1a413683de00", "comment": "Malware payload (NetSupport)", "value": "041df33cd831ea3fc016739bec8ea5ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771188005, "uuid": "a03e0575-3432-469b-89b9-8b642a76989a", "comment": "Malware payload (NetSupport)", "value": "0ecbe1f822dfe8275839a986aef349a04d6772a2beee2c4269670fbb5456326a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771188005, "uuid": "32ad4360-d064-4805-8f9f-b7c7aaa2456d", "comment": "Malware payload (NetSupport)", "value": "f4dac56afcf37920b8b4fe3ec9a80a188894c26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771188005, "uuid": "afc596b6-51d0-484f-9013-324888721136", "comment": "Malware payload (NetSupport)", "value": "6b093c187e817e75f2ca77afb69d50bc07a6465a7777ebc999e52c28d5c35cc8672c5f063b32f6203ad59646b8920727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771188005, "uuid": "e9bfaa27-415d-4744-ae7a-44fc93a2afcb", "value": "T13DD633A096E825FFF9EA933DC9619992C996756B3B49C183C3F8C0A12C733C4657E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771188005, "uuid": "a5acca65-c2c8-4d9e-9d9b-6c906c4972e7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771188005, "uuid": "89ff3602-dd37-4d31-a773-d79681684acc", "value": "196608:C14oWUoB9qLZBFslHl7dZgnRMWF3y99TisLkuorNPurH/P/XRLSq2KKeF:C14FSsFl7dCR1C99/LkuiuDX8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771188005, "uuid": "214ee596-a212-426a-81d8-e15fc53501b5", "value": 13412388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771188005, "uuid": "a1c28323-00ac-491a-a7c4-68066c091da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771188005, "uuid": "2a4e93bd-d12d-4970-ad84-b43ef83aa98b", "value": "041df33cd831ea3fc016739bec8ea5ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eaf395-0a06-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771115874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115874, "uuid": "e1de27c7-eb33-4e90-b908-dba00e5d5d1f", "comment": "Malware payload (Joker)", "value": "a6b913bb4d7afe24f81d666b52a7882f", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115874, "uuid": "4d41760b-982b-4099-acac-e8a4acc6ac1d", "comment": "Malware payload (Joker)", "value": "0f2487c4c3b7dea0ea98780b6b0fa77e09150f508e7a787910129144c86f6a6c", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115874, "uuid": "7636e581-9226-4dfc-b375-7264b2ab03a8", "comment": "Malware payload (Joker)", "value": "8c2567d2b9701c37b8a5b0c146f9f50c0cab283f", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115874, "uuid": "20077f3e-c882-4082-94cc-2bbf8953ac79", "comment": "Malware payload (Joker)", "value": "b51a2f2512cf6b678e1d480a6751de2d8057ba257318286ba5a64c1aeb1cd804f13d28e2501ab3ef370e4e1bad7fddc5", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115874, "uuid": "3bdf3cd6-05cf-439f-95f6-b6fbc3bf544a", "value": "T1CF2722C2F799E92DF8B7A53ACD5A56F0C2172C495E02DBD62424F70824B39C45F1ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115874, "uuid": "bb94012a-0d3b-4ce3-914a-c66ef682adbf", "value": "393216:j3GYtNEyrlnsQK9nap6NHqb5DhnHuXQ2u+W/kRAjFSa2R1:KYAUnrqAnHu5W/kiFUR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115874, "uuid": "751133cc-e49f-46aa-879f-ece81a1dc5d8", "value": 20583349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115874, "uuid": "c070d1b2-ec75-48eb-9168-e1b9ec24148d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115874, "uuid": "a437c2dd-af6f-40ec-bf67-aff1efe88453", "value": "com.extent.somewhat.bottle.findphone_1.06.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9a1595-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150416, "uuid": "d86716e7-f3aa-4b0d-b79c-eccc261cdb57", "comment": "Malware payload (Grandoreiro)", "value": "8589fff9293e222afb0359aaf227a9ad", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150416, "uuid": "f5a62040-3b3f-4fb5-9a72-f803249e72c7", "comment": "Malware payload (Grandoreiro)", "value": "0ff05ba091a9f9b51eb4556fbf015458b5d6fd332ca6fcee8ea457dae6f1b58e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150416, "uuid": "a8ed1f5d-c360-48ec-8237-605bc4dc16da", "comment": "Malware payload (Grandoreiro)", "value": "3dadcfd57b1591777ea42b6f20831f3b6c4658e1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150416, "uuid": "65d87b2a-4aa0-472e-8cff-2e5992d33947", "comment": "Malware payload (Grandoreiro)", "value": "91c36db84b40a1489b3698783da7159a8e0d72d0d82732aa66f8a3ad0dbfe61c426ba7769fd9a62971467a8fe49639b1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150416, "uuid": "c6a090d2-f163-4530-ad24-5bc4683c1b81", "value": "T19D563334FE956CEBC5A403B9702F3E213FAC6563C208909578BCA2522B87ED5ED2F455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150416, "uuid": "9933c38b-f9c4-4716-af41-99e6ae68cfdb", "value": "49152:rtxgjgDnKQtWH/dteV/fZZR5ZQ56UxU6wt9BO6IhL2quLFN0s3maq3MTwxQjBkwt:oad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150416, "uuid": "1ca78ffd-e969-4610-b3f3-5243218860f2", "value": 6203392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150416, "uuid": "1fb7f852-29dc-45ad-9d39-7dd6964d525b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150416, "uuid": "43972713-acdf-48c5-a62b-0742cffe8f54", "value": "Reg6BC7FS7826-GATID.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe80dfad-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193797, "uuid": "1c8ec8a8-1e76-4553-a23d-d6d0fa142c37", "comment": "Malware payload (Mirai)", "value": "f641bc11ad09d40f3e2b3da17639853c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193797, "uuid": "4e67a4dc-96eb-4e76-9b65-b26034aedf22", "comment": "Malware payload (Mirai)", "value": "10f6ef4fa82494ef2ac7c7a81dcabab57234b3d7f275f5fd216035b468d4ae6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193797, "uuid": "446ebad5-989a-40d2-b3ed-3a373f2cbc3b", "comment": "Malware payload (Mirai)", "value": "03d952476587ccab56ee97ad95bb8d66e754f450", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193797, "uuid": "45b96845-da3f-4b24-a582-3dd651748bee", "comment": "Malware payload (Mirai)", "value": "58692935f82e3c21b581c0dc5a9e99f5d5eef7bebd4adf46c883577539a513cdcd05a7ce995b8aa852454e04f99d3b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193797, "uuid": "86c83075-d3ef-4212-8066-e48c27f840c8", "value": "T18104A81A6F228F6FF269837047F34E30975976DA26E1D684E1ACD5141F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193797, "uuid": "c97a1d63-7ca7-46f8-9e32-2db34c59e8a8", "value": "1536:KSQ0IVf+rfGWCoP2qS0JO81BZUPnlXRhjiKA5eVZtnltrJyuWMTpRTA/2dT/JWS:KSzzf8qS41BZUvlXzjlA2tr0MTA/2F/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193797, "uuid": "1f7d3f9a-b707-4b68-aa04-2e5f81eab59c", "value": 177332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193797, "uuid": "4aafa401-dc34-401a-90b5-8b7fbf93b765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193797, "uuid": "57feb104-57b9-44ed-8af9-38854aae9d00", "value": "israel.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc63251-0a05-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771115332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115332, "uuid": "058bab4f-3a2c-49ea-9079-ddc0b6f0d0c8", "comment": "Malware payload (Joker)", "value": "155faed5129a0321e05f7a7298ca1b60", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115332, "uuid": "46ca5a38-ea2c-4594-b5b6-b99799bc1269", "comment": "Malware payload (Joker)", "value": "110cf99f4e796065b71aaf966e749ad6a0913919ec58cfc628b86aae84e24be4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115332, "uuid": "b01e9ba2-0947-4095-8f0b-5bbad6b905c9", "comment": "Malware payload (Joker)", "value": "1296c35a3796d51f8fa3dfb9b0d3e22be9aff714", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115332, "uuid": "c4dc0f9f-3c59-4b93-8d8f-256a00ef8276", "comment": "Malware payload (Joker)", "value": "c5474114006ad9f4edf07e8086abd1c6b22f8bdb16b395a5640b1cc18b2d66e0e5aef3be460dde146aa9c76001807283", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115332, "uuid": "9638aac6-5f47-48d6-91c2-4931935aba6b", "value": "T1FD76129AE71CA42FD47759B24EBE622141874C4781C3AFA3B644730C29BB5884F9EFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115332, "uuid": "9ecc37bb-bc08-445c-b436-31165a35b4a4", "value": "196608:8ShqOPWz42IYyapBDe+XWEqTFt4wJNKnTZjWr:8ShgNIDabDHaFt4wfSTZjWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115332, "uuid": "692a4075-eb57-490c-9c60-6471a9e435c4", "value": 7581203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115332, "uuid": "4c34095d-7409-469c-8ec7-2dfbc4531e47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115332, "uuid": "3d07f737-7a94-4339-9b40-b4893ae8bb8d", "value": "Swift Phone Cleaner_3.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e27c558-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150470, "uuid": "1341a8cb-79bf-4b09-86b5-93738c071a30", "comment": "Malware payload (Grandoreiro)", "value": "29188c9d3ca9f0f9c243dad9c85984ed", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150470, "uuid": "9843e60f-db0a-419a-8ecf-e8f20804712d", "comment": "Malware payload (Grandoreiro)", "value": "11eb0bedee3e00f18899a0051d241a26f07589a8a2ef8ee123af0ed809e4a82b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150470, "uuid": "026d3231-7700-47b9-a508-b6cffb8e286a", "comment": "Malware payload (Grandoreiro)", "value": "b9050118583645424d64c28474559b5f4f996281", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150470, "uuid": "3d6dfa89-14ea-43a8-a21d-0d566faaf51e", "comment": "Malware payload (Grandoreiro)", "value": "5eea13801df3edf276d585f6baeeca1b239680e6ebde672d0ad5351d171375a06d64f9d234d45970ac47a9edad4bb3b1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150470, "uuid": "346e41b7-c5a6-48ff-9e55-355d3cdc26a7", "value": "T1CF762330FE544867C9A04779302FBE756E7C3A83858DEAD3799C6182274BFD2623B494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150470, "uuid": "91329fa3-522d-4191-87d0-38bab5aa4ec2", "value": "49152:LRDzbGx6zgb/h4YnMtFn5Zm7bFpIOKSNXmSdZwZKQoes3jkK2BtajTTC8DZGJmMK:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150470, "uuid": "c2407ffb-b63e-4a44-a5cb-1ff121ec5161", "value": 7510016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150470, "uuid": "ae887083-f9d5-4e33-8e21-d21bca8d56d1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150470, "uuid": "be3b835c-5a31-4abb-a6ac-4fd0a63885c5", "value": "RctfMKPG50294L7RB79_219167.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce71c3-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118194, "uuid": "f70e77c9-aac4-42dc-bf70-7696816b5539", "comment": "Malware payload", "value": "3b8d72b225a0f515d5b36992dd34569e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118194, "uuid": "23f1c75f-7aac-4b0b-b431-a5a51753550c", "comment": "Malware payload", "value": "11fe6fba059c7656ebcceddab119c1be0cc728fb9d7df710405b5f8b174fd9de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118194, "uuid": "a7b26ee8-a10b-4fa0-862d-a7d764977c67", "comment": "Malware payload", "value": "6bad4d786615b4e203f3b8878fb3fcab93d076ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118194, "uuid": "792be6d3-8c11-4260-a79f-ed4cfc456513", "comment": "Malware payload", "value": "cf8e62776e8b9a0844eb1178532d3f53ce41cf14a044bbe4e682abc341485995d0fba76e1b25aec522960891852938d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118194, "uuid": "e13bde37-8218-43ef-9858-cd4fb106bad6", "value": "T1B532C517A7BBAE1BC4D037770193072162E95F916024472FBD0D2C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118194, "uuid": "6d1206ca-318c-4c01-99da-d032b1981fb3", "value": "192:xvrOR1CQOsz1NxfAzzH9iG0GhWaDpU/O7Q89AGSyb6qeif:xvrbCzfaz2GwIU/kwGSBUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118194, "uuid": "c7c81c24-2e10-49c0-a047-1ba6dd38c8d6", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118194, "uuid": "03b6677b-e3bb-4aaf-8ec7-8d4669b89e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118194, "uuid": "b4f41a6d-10d2-4640-be33-bf8b7a588dbb", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f3e086-0a7e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771167504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167504, "uuid": "1cbdbbfd-a772-469f-84cf-d374ed88c22e", "comment": "Malware payload (Mirai)", "value": "41ef44e0c5895d1d582edbc71f1ecf0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167504, "uuid": "54b39051-40be-4ff5-a9f6-fe7bb88a022a", "comment": "Malware payload (Mirai)", "value": "12144c665553ebe004a5f21d684c82ccfa16b2212387a1bdb61557c36cb6d6d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167504, "uuid": "c2905fd8-6ed2-4134-954d-1e811eae0c3b", "comment": "Malware payload (Mirai)", "value": "f8bedb2dca3a60ce971dedaa67800c4ec65febce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167504, "uuid": "1e2adc98-e9cd-4901-afc1-0d6e5cb5790e", "comment": "Malware payload (Mirai)", "value": "1ad9f4f182c0f96daf07efd08bd4b0c0ab7dce4a8d860121168a92629c2be2a2a6c4897f3b084384b118bd45300689cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167504, "uuid": "e3eb5c9a-f0a1-49df-9214-e55dc36f8626", "value": "T1C9A3E91E6E11DFBEF759C2344BB78A21966833C62AF0D5C5D26CDA041E6028E641FFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167504, "uuid": "f5a6db1f-df79-408f-885e-91ec271a8bc1", "value": "1536:CYdymg/CIwxiT6ob7JnqvLy9u+9ubWugMsXkEu+8Z08tEeZewnzg9r:/drNIwxiLJnqvLUXkEu+208OwnzgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771167504, "uuid": "4811a8f3-0fef-4bdf-9568-5ec2f7a5115f", "value": 102392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771167504, "uuid": "9c057b8d-cacd-48c9-bdd1-1e7000faa83b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167504, "uuid": "0a824fb6-9d29-4749-9812-79ba6e71bc5f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30c572a-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120199, "uuid": "6c1a63e1-49c9-4931-a956-c4f7e49b4e8e", "comment": "Malware payload (Mirai)", "value": "9ed0dbe042b412579bb9ae91e00f87b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120199, "uuid": "be987ee0-66cb-4ae5-93a0-265eb6aa0552", "comment": "Malware payload (Mirai)", "value": "1276aa4067fdffe6e279455f72424f737b5cb5c4108af5d27cf160e28d5f420d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120199, "uuid": "876adbc2-f7e4-4ab4-9dbe-c1c472e3691c", "comment": "Malware payload (Mirai)", "value": "b9478575b453769a64b0c8ce91c75296738ae265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120199, "uuid": "697e0cfc-ec4f-41fc-87b6-39ba163a24c1", "comment": "Malware payload (Mirai)", "value": "32984a533ee829654818830179d5297296c4f8b328b700992361cf9f4f069f406d00c47120a5ecc3a8bb18b57a404024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120199, "uuid": "0369d00b-385c-4a3b-b9e2-6070c40810b1", "value": "T1CF9329227E760F27C4C2A8F652F30B30B5B2AB5B28B8854A7D715DC96F646C032477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120199, "uuid": "dadbf959-3ff2-4ac7-b27c-951698a7a68c", "value": "1536:568MSzlPyzhCJuWsZIJXc7V1SYdJD5trAgENWq5O7M4XVhUtW7:560A2jM7/S0lxZENl/4p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120199, "uuid": "ae9df523-3444-46b0-8145-445de65cffc0", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120199, "uuid": "3b7e5a6b-7d22-40bc-b1c5-8d1c253bc178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120199, "uuid": "3e080f3b-a04d-4516-af89-e482a87622a1", "value": "manji.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee0eaed-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193878, "uuid": "33c36f0b-4d79-45e9-b85d-2d8ee9ded4fc", "comment": "Malware payload (Mirai)", "value": "795d58fff589b0fa7d78803be4763289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193878, "uuid": "bbb84bd9-4a46-4745-8d92-be3b25bf4f4a", "comment": "Malware payload (Mirai)", "value": "14ccef1acc8ccccc309d3ff0fa600f97af3f621e862f3351440770caaf665836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193878, "uuid": "851c8f4b-9eb0-4215-98a2-e728e6598052", "comment": "Malware payload (Mirai)", "value": "8ef8c50ec92b2e07f4781a21d37f8b855351ee70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193878, "uuid": "32d86b5c-a1ce-4185-846c-ce519186b9d8", "comment": "Malware payload (Mirai)", "value": "b5c50c60fd01427703e2ac942344143633eb28e2264a57885dce7316370c8b60bbc87b40668b8b009bf654086fa32715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193878, "uuid": "86d6b4c0-bb44-4c97-a185-4c23f6446839", "value": "T11DD31A07B98080FDC8E9C1784BFEB136D932B5AD127CB10B2784BE366A5DE205F6D615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193878, "uuid": "4cbd95b2-71b9-407b-9b54-bd0630755a0e", "value": "3072:rYXHUD0qgdHT/pqCxhQJfxc0Zi2u0M3QMoc:rYzzJx+60uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193878, "uuid": "f4aead6b-f8ec-4c25-a41e-bc36eb953339", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193878, "uuid": "d96da216-d58c-44b9-b0fa-0aba29b3e281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193878, "uuid": "87ecf442-8a19-40cb-82b9-7a3d1a789c09", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d3b700-0a76-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771163959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163959, "uuid": "0a52cd9e-094f-4e11-b594-9b2dca83e015", "comment": "Malware payload (Mirai)", "value": "a53683dec9dc73924fd8b557030605db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163959, "uuid": "d0af7a23-471f-43bb-9bd5-a6b4a3b111db", "comment": "Malware payload (Mirai)", "value": "16f0d321603dfc1a8010240f4ce0942b2b4beb39d28d6e21665f77d83970bf4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163959, "uuid": "a47be999-cedd-4962-bb13-e5e7e23959d3", "comment": "Malware payload (Mirai)", "value": "ac0387194724e6e6a3e7a3172532985a26a5a128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163959, "uuid": "c228cc5d-87df-4489-8ab3-a9701aa33c9c", "comment": "Malware payload (Mirai)", "value": "29fe48e5ee7546c42999bd8b89abceba54e46f82bf52791afc5a5d7553333c7e55838c7d1bb8f8c36d6f1d14795cc789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163959, "uuid": "bb4e7dd2-9b22-4ec0-bb62-757d84a5ac3a", "value": "T11FB309DABC818B10D5D536BAFF0E518933138B78E3FA7113DE145B2A638A85B0B3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163959, "uuid": "e1816bda-2bf6-45d8-a83f-6668045fd32d", "value": "3072:KIC8EVtNatRajOEhDf6p9QRbHPJs8TNYgiev8Eck134E:OSazGp9QRl/TNYgieUEckt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771163959, "uuid": "b0636023-ac1d-4db7-9388-3e27a5a61150", "value": 115448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771163959, "uuid": "fadd0441-4856-468c-81ff-c1fda4153626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163959, "uuid": "35287297-4eab-4a24-b0ef-bba3673ae66c", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51633c42-0a55-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771149697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149697, "uuid": "bda82d7f-94ac-4501-bbc0-f644597905b3", "comment": "Malware payload", "value": "17dd5889f6c478f7bb6dae426a4f401e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149697, "uuid": "6f6de53c-dff4-4c49-b2ec-8d36de9c2e18", "comment": "Malware payload", "value": "177408936ac2f11f0f384ba3a7ad70111ae16e2bd5d7ffb475254976e9a7d4b3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149697, "uuid": "1437a5f2-6dad-4eac-b16b-e109a7115890", "comment": "Malware payload", "value": "e9489f41855f53b40b3c78db70cc1ddb815f5a7b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149697, "uuid": "4f4e4ba1-fc24-44dd-84ac-67fa9ad33aab", "comment": "Malware payload", "value": "c5143eafa18eff63d0402b3313156e956c28a9eebb63b5e9f072989fbbbbdc7c79cc29e8063a0ea869ddbdc7e3499e2e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149697, "uuid": "b981e183-6b9a-4efe-80fd-3e769355874c", "value": "T17E431A6B634D0B2AFD6D24ABDE431D57A5FCEF9BD49318CCB942A547388DF893808160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149697, "uuid": "79523df9-22df-451d-880d-8dcaf7b3c8a6", "value": "1536:5DcsEmLlcnlmTgeeXmeDkSodT6S8ULCk+nnB0Qxo1shELNlxOP5pd1pr:5D8mLlcnlmTgee2UkSodTT8ULCk+nnBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771149697, "uuid": "9b488043-872a-45c9-9e07-ea2256fead40", "value": 60288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771149697, "uuid": "35ad9fc2-6c6c-47c5-811c-a7db4274ed2d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149697, "uuid": "07cf93d7-971f-4c15-a3d4-2f46b8790f23", "value": "SystemUpdate_8869.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd15c66a-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193794, "uuid": "89343907-495d-4034-bbad-a642ed3351a5", "comment": "Malware payload (Mirai)", "value": "19cdfe59839572132eff53a9ec196c7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193794, "uuid": "c07b7013-071a-445e-bde1-02bf4e443591", "comment": "Malware payload (Mirai)", "value": "180a7d0cfffb7bff2531e594bf9027e4fa69d8513292ceae0f731cb6a13a83d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193794, "uuid": "778f1a01-fa48-4894-8333-9d3609851fa1", "comment": "Malware payload (Mirai)", "value": "2e1948c8bdf00d819e787da37b91d7ab2e48976f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193794, "uuid": "7560beff-7123-4fde-8529-3a553494dde2", "comment": "Malware payload (Mirai)", "value": "f1115ddebfb358525a8bb307054b20eb8daed265ab11e9bc8e50b5d1fe24a74f5027b5003605af7d8aaaafe05388791a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193794, "uuid": "bd06b75c-78c2-49b9-acac-438446cadba5", "value": "T1AED318037B82D9BFC49BD1F44BEB9536DC32FC2E1935715A67A0BE921B48DD02A19720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193794, "uuid": "eebd7f83-c801-4f57-aef1-80ca9309a8da", "value": "3072:DvIyrBuRIH42zHVQrOSIFFlB6S5htx2IP9:8yN3zaSPMfS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193794, "uuid": "2a6f70c4-56d0-464d-8f9c-62fe17f3fc51", "value": 141512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193794, "uuid": "7086886d-1110-4467-ba47-80171d419c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193794, "uuid": "c32e6580-ec2e-4e28-a66b-d865e3172365", "value": "israel.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05709c1d-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159019, "uuid": "61f936ab-eb89-49ee-8ce1-fc570a052303", "comment": "Malware payload (Mirai)", "value": "6dece57c3f9fd410fb6e587e3eb16642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159019, "uuid": "66c6299b-96c9-4cfa-b268-3060e779a92c", "comment": "Malware payload (Mirai)", "value": "18458eb304f6d26674fa8257f10f0407ab15e255070167b12abf048baec04b01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159019, "uuid": "d79fa7b1-26f8-4ae5-a424-21d296a6cba0", "comment": "Malware payload (Mirai)", "value": "06e751ff38a7094232566cc49b398929a8713613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159019, "uuid": "6ba0f660-c431-4f50-b54a-ce280616ca9a", "comment": "Malware payload (Mirai)", "value": "c0daeedb49dd608cab7af6e61b227d8653a64fc0601df87db374607135e8b9e7dd3d74b76b90faab66c0182df0c48ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159019, "uuid": "042744b3-372b-4c4d-8177-fcdd9829c910", "value": "T1F7E30A06E9419F12D1C211B9FF9E415D37137F78D3EE72029D24AFA06B868EB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159019, "uuid": "7b8495cb-5de8-4344-b6e9-7f4b5e92b289", "value": "3072:84wHQmrIYfwrq1akDa7SMT6RPfb1CVY+MHkUr:8BZnfwr2aPl6RPhIYJHkUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159019, "uuid": "15ae1f29-d64a-4a1d-8368-ada0bd2abcb5", "value": 147448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159019, "uuid": "bad9496f-1bfb-4ea3-ac3f-31dcfe96dff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159019, "uuid": "caee2012-f758-4b74-94e2-da5fd97daafb", "value": "israel.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92e02f8-0aa5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771184312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184312, "uuid": "331889ea-4549-41f5-b7d4-dfcdbd0a76f1", "comment": "Malware payload", "value": "72660086ee8658e11f9c358d8b2971fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184312, "uuid": "3b54af9d-5489-4e63-8af3-d3fbbdba8842", "comment": "Malware payload", "value": "18d949b6b7c9f4a72c7bf6f18a28e179e5153b1cc0feac4cff580705212dc4e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184312, "uuid": "f4374e1c-5efa-44e8-9316-26c2e8744b2b", "comment": "Malware payload", "value": "1eeb920854967309eb63ecc1363241f1db0adac4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184312, "uuid": "99c1441c-7d88-4760-9fcb-5791280eb348", "comment": "Malware payload", "value": "b95c0a8619ebd161322e40d904a6e3d1563844e3a4f7626a99324cddfe36f108bf0a7148237d6d53242124906c5db700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184312, "uuid": "2d429886-178c-46b2-9994-4713a8e87a60", "value": "T147E3F787F900DFB7F40AE3B648A30805B530FFA60C525A77726779AAE9391C51463F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184312, "uuid": "6bcea93c-4037-428b-87e9-4c602f267a0d", "value": "3072:1YJgU712miH6w5ayFNNNgZ1+sWF/Gkj2IMVEjbiWL0Z4SYWs1:1bAwayFvNgOsT42ILL0ZZs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771184312, "uuid": "4fcac4bd-99d1-4197-bfdb-386261bcef77", "value": 147424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771184312, "uuid": "ae4537b6-dc4c-43b3-9e93-f1f39a8c62af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184312, "uuid": "ea693323-0dde-43ad-8852-41885f7bda24", "value": "israel.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b066ec-0ab9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771192891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192891, "uuid": "846846b3-478e-4fbb-bd13-864c8f4f0f99", "comment": "Malware payload", "value": "ab5331e23c97456f93486bfd8aafbe57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192891, "uuid": "ab07824d-73a9-4533-9971-c894e30d0f31", "comment": "Malware payload", "value": "1b057d51d712a0e06a1eafc45411269bd416fd7fd387a7d72613816f7b76f5f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192891, "uuid": "fc4f495d-cbc8-438b-889b-38ce7a9be82f", "comment": "Malware payload", "value": "df1081137135f0534bbc7d7a6d4e1cb7d27f608a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192891, "uuid": "bae7ddbe-5f03-4ac1-8b71-b1aa72b510bc", "comment": "Malware payload", "value": "bb1c10418d0d14c9f87f7124eb6ce650a1b94bc4efe9f42c77f57a09d24320c3828022325693abf9e68faa46529c9a21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192891, "uuid": "9c9a29ff-92e4-41a9-9cb2-99e2057acac7", "value": "T112335C4CF787F0F0ED4E0A71116BF77E86349E025024DE6EDB94BE729E32A026557628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192891, "uuid": "9dbc4f2d-1fbe-4a7f-989e-78a068c59a65", "value": "768:o3kvsZR1JMJ5H1I146pD3/OVXoHssVpoibIIYQ/UiojV0UI031AMxjcPRI9qD5Or:oLREXSfpZPpDzG0Up31AMxjcyCejr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771192891, "uuid": "6d10d01d-99ab-4081-9a54-6e4e701858a2", "value": 54412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771192891, "uuid": "d1a81434-9f58-4034-a5f9-5ff724a70429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192891, "uuid": "63bc5bb0-913a-4e59-8b08-528401f82e96", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d85c8b4-0a06-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771115707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115707, "uuid": "34c410d3-b272-4ed2-9b5d-c048663b404a", "comment": "Malware payload", "value": "619ad01eec6cd3bdd42cfe8d159fd890", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115707, "uuid": "c34219d9-df42-4c20-8484-ef05b3c1f826", "comment": "Malware payload", "value": "1b8fbef370182226c063b20edb4a4c5a2c52e733bc6bf39b58a6b12ed5a0c14e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115707, "uuid": "e59801fd-1c00-4e16-b9b1-19d595ef9788", "comment": "Malware payload", "value": "85a2e2f685109fe996c1c339602518398f075812", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115707, "uuid": "4ce9d883-9796-43bb-8c3f-76a86261f688", "comment": "Malware payload", "value": "4e67efa6ecdc2e11c8218c6338bfdbb998b0486ef6a7cab1c874ed06f5072f88fa786e2569432172b72aa3fbd20ae47c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115707, "uuid": "542c2945-cecb-4ed3-9708-1840c65ac95a", "value": "T1E244E16D54BCDD57E85E75F4CD14399007BA23A0E1AB259B02A313DF5E2EFBA90C8306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115707, "uuid": "585dd433-0a1d-4a6a-95ff-d92f3357dd59", "value": "3072:kqqm908oqm908Dqm908wqm908Aqm908zqm908Fqm908Rqm908lqm908xqm9089:kq3Kh3Ka3Kp3K13KO3Kw3Kg3KM3Ko3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115707, "uuid": "1714850f-d8e0-46f7-8d49-e941171db98d", "value": 253843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115707, "uuid": "3fd50db9-67c8-434d-ade7-57cd6d4ae51d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115707, "uuid": "4b63d6b7-0212-4115-9793-6f4a64942cc5", "value": "\u0444\u0456\u043d\u0437\u0432\u0456\u0442 \u0437\u0430 2026 \u0440\u0456\u043a.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf25803-0ab9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771192933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192933, "uuid": "5d1c34a5-e78d-4eec-930b-1f3172ce4169", "comment": "Malware payload (Mirai)", "value": "9bcccb37d4236388bef3b7ec4117fa6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192933, "uuid": "436edfd8-e34e-465f-8ab2-ff279a0b09ab", "comment": "Malware payload (Mirai)", "value": "1bd633ac85bc3afcc57d0e0d850af03dd3d0a37632d8cf0d1a106bca9a88e5a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192933, "uuid": "66d606e2-9d8b-4645-88af-9debb4d3d0c0", "comment": "Malware payload (Mirai)", "value": "e02f45eaf5bc3086c4ffab4f2c5a4f72cdae4b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192933, "uuid": "215673c5-472d-4429-9ada-d11cfd26abfe", "comment": "Malware payload (Mirai)", "value": "fa6672f428915eee330d0c137665fd1ff3c5596355a70121fbe2f45298c431ff5d2919fa9f0b68f291cd82afb38c24f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192933, "uuid": "58711b0b-bb22-495a-8cb4-ecaa1d5061ea", "value": "T121A36CC1F643C5F5D8471571203BFB339B32E1BE2119EA43E7689D33AC516029A1ABAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192933, "uuid": "8aa3b937-c48c-41d5-ae4c-6108a2d898ec", "value": "1536:r9sJShjCt/+h36PBXITHtFE5p384lMe7dnHywKqsW1qElfSSbkIb:JHfh36PBXITHtFEbHjd/Kk1Xagb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771192933, "uuid": "45b65b55-71f6-4312-9123-a3009cb25775", "value": 103624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771192933, "uuid": "832a0c52-6a84-4a68-a602-55d12ddd8011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192933, "uuid": "f272f1a1-fae8-4c50-8e9b-2dae2c91bd2e", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66f0e1c-0a72-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771162322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162322, "uuid": "78df5ddb-cb5d-4366-88d3-bbd420749c0f", "comment": "Malware payload (Mirai)", "value": "f2b3f627459670ae950985a081cadd31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162322, "uuid": "97bd0b56-6833-4a44-b9c4-472310956a9d", "comment": "Malware payload (Mirai)", "value": "1f8080e52d6a3a5e3b51f0da10e612f67f961cb0bc0d0af01d83f91504bb1b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162322, "uuid": "285141da-4406-4a37-b78d-ed69f53f7741", "comment": "Malware payload (Mirai)", "value": "75ea9a21d8891d77372dfeb398e0be88b99a9c75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162322, "uuid": "8748e7c7-dbdf-4c77-9c99-3f7fd9f28926", "comment": "Malware payload (Mirai)", "value": "424e7329e19001a7559ca0d2d574befd4c5fd3b27bba0cf771596d0a064afda11eb5109f03af5333f3b9c60ddd487f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162322, "uuid": "0bf97873-2021-49ea-b256-620671a79652", "value": "T1D2A30B52BD42CB13C5C225F7F7AF06583B166BBCD5EA3102ED20BFA127868DA0D27651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162322, "uuid": "7239288d-5c74-4d04-8188-f4f6d1cd0d0b", "value": "1536:cdBBHnSmc6o25/MJ5+kgeMF8GSdTjdpu86aaAkdxUOwBy7qUbf9JpW4MSZDrO:mHK6bM29eMFa5ppu86aah3nblPPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162322, "uuid": "31824491-10b4-405c-9d4f-0610686d5c96", "value": 99244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162322, "uuid": "570b8b6b-b248-47ad-b5e6-9b912e877d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162322, "uuid": "793448ec-e529-44c4-a3e8-c66179562b9d", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c73ce98-0a4b-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1771145528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145528, "uuid": "8b0673ef-9b9e-4e29-b2d1-d6225ca53634", "comment": "Malware payload (ConnectWise)", "value": "568ace515bfc510f490af7d1644cdc92", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145528, "uuid": "b73f0b8f-4427-46a6-9a08-2e8fcd29b17b", "comment": "Malware payload (ConnectWise)", "value": "2119aa4a4a3d41288b98590207bbbc87dad732db15b97a23a3f245cbd24dc853", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145528, "uuid": "1b76821f-d969-4e48-ba8d-1624947245c3", "comment": "Malware payload (ConnectWise)", "value": "7c7193a7fe868011e5d253f346e8526a0aa29f7d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771145528, "uuid": "69fb6fe7-2514-4812-a22d-f12a208a48cd", "comment": "Malware payload (ConnectWise)", "value": "67d21f267cea7abdf6d0a72dddc105941f8c43df450acfd05d54b02404b717a6b4577e587d1b4019820ea0b9b833e8bd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145528, "uuid": "a4fb2662-1062-47aa-861c-2c0f18716b3d", "value": "T113C6237127F98425F1B79F39EE7A89A229387C64DE26C05F0B74380E1971E509AB1373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145528, "uuid": "c2d7d820-90c9-43a5-ad41-f6ead5afda76", "value": "196608:kKaLNkbgii4QZKaLNkbgvKaLNkbgnKaLNkbgNKaLNkbg:aWgiiH9WgHWg/WghWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771145528, "uuid": "1ca52a60-0a1e-44fb-b62c-6ba74ae21aff", "value": 12251136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771145528, "uuid": "f8790cdd-889b-4a61-8ec6-58ed372692aa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771145528, "uuid": "4b994faa-527d-4253-a224-90a69224332e", "value": "AcrobatReaderupdate.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c637759e-0a7e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771167503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167503, "uuid": "c5704ad5-71a6-4756-9387-9a946967d907", "comment": "Malware payload (Mirai)", "value": "684730dc6abe661507904d3f07fe18d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167503, "uuid": "6774d383-b9f1-4b6a-af8d-6fa3268322b6", "comment": "Malware payload (Mirai)", "value": "2155a25a53435682a11b378e3a9310d51d481a5598dbe4c4ba092dc5b3314cb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167503, "uuid": "663e2004-25d0-4dbe-aec3-2972fae60ee4", "comment": "Malware payload (Mirai)", "value": "277bb4b470fbe670c5fef8d5f6089a771405336c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167503, "uuid": "4d22de51-ecd4-4ce1-943d-5a932f159ac7", "comment": "Malware payload (Mirai)", "value": "e3f13bc471f0130f635cf1f9145abf832b3d6dc8ce5c5c06c1cc3086a10ed71e4276f1520e524c3cf5f8db1a57b2fdab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167503, "uuid": "68f17257-55c1-447f-86da-d5b2f7441aa2", "value": "T1B9F33A46A6405A23C1D21777FADF42463322DBA4D3DB73059928BBF43F8769E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167503, "uuid": "294d4b4e-1781-49ed-a979-0c61aaed92a8", "value": "3072:7jGDiJp9Nss21M1B6HywadywW977OTuhCPPqKqOnzYWigZQM/9VpJS95:7uiJpUmBmfawwW977OKhw7YWigaM/9Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771167503, "uuid": "4989b0d0-64f8-4a90-93b5-7f4b3319f8f2", "value": 168370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771167503, "uuid": "a8ed6e3f-4949-4759-95df-8e203383a2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167503, "uuid": "951704d9-8023-4944-badf-1f70a4773dc0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7dee8f-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150496, "uuid": "e121e773-2a2b-45a7-bef9-43e9c5039ebf", "comment": "Malware payload (Grandoreiro)", "value": "15a687180fc6034fb5bcc6300962735b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150496, "uuid": "6ba3b0a0-e0cf-43c5-bf53-4d534e839fdc", "comment": "Malware payload (Grandoreiro)", "value": "220c69f7da5a2e2f072838c279f29d352d484d11df39a6cf1927f56d0cb2831e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150496, "uuid": "81954c61-e2c3-4f86-a120-07aef38d2047", "comment": "Malware payload (Grandoreiro)", "value": "bd7620be631a1390be2ff010fbdc2ca911099be8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150496, "uuid": "5f94086f-064c-49ab-852b-e6de4a68faf1", "comment": "Malware payload (Grandoreiro)", "value": "df8725371c7d8841601f10dc5728819bd8ca19c8ab8b47735df569ba30bbd086206bd67bb513a7fe0fba54f21a4929f7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150496, "uuid": "d4114eab-e149-445a-9753-336c6d006ab4", "value": "T101762330BE912C6BD6948B31702F1A313F6D3B43268D91E199BD92422B5BFD2D63F419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150496, "uuid": "06be7245-9807-4f74-b6b9-aeff6f3831d3", "value": "49152:2lOCRBrda/nJP0jW12edY0oUAnaA7StNGLkp6m6CNE96ki5HgmVStMreYcVSexJ2:6eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150496, "uuid": "e28fd6b8-d97c-4bf9-a686-fdb392fd4acd", "value": 7526400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150496, "uuid": "918115e5-8ab9-46f0-a95e-d66f1effcdd3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150496, "uuid": "369809da-6026-4ff7-9476-805812365b53", "value": "Prvis953268ATCCX4Y8TH_53597.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2296113e-0a71-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771161645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161645, "uuid": "e8aef0f0-30a7-44f2-aa35-52250c87456a", "comment": "Malware payload (Mirai)", "value": "c75cad44494e42a3d0c51734463993a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161645, "uuid": "394a38f3-9a5f-4e41-b248-e6c1aeb5296e", "comment": "Malware payload (Mirai)", "value": "23694ed81863f217b6e105ff3673a2918de10433ce1ef985c141976d54cc85a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161645, "uuid": "4e473a8c-3564-4aa4-9531-a33e1486fec0", "comment": "Malware payload (Mirai)", "value": "b5de4276e620e4611d69cbf2ff2e0f3896c687a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161645, "uuid": "c0652157-6ae9-451f-8fe7-bc2398a8b97c", "comment": "Malware payload (Mirai)", "value": "440b97f217484bba316c25da4965853034063c462d39a1a6b2a56fd3c6758f7fcb798163cc37d37ccad085c7234533bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161645, "uuid": "5707a45e-8649-440f-aac9-6fd6c3d6ba80", "value": "T11A04A71A2F228F6FF269937047F34E30975876DA26E1D684E1ACD5141F202DE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161645, "uuid": "364da3ef-4260-4ded-8291-a9489b0758f9", "value": "3072:DzmFrD/UBv2Wf9VNkDov7RW5YVP21lvNOmSf2yfVI7:DzmF4Bv2W1VNkDotqW0vFSfjfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161645, "uuid": "02aaa59e-a3f2-4c7e-a21e-fde7d260a92a", "value": 177204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161645, "uuid": "79d75a89-10d1-4f3c-8cda-575086bfd6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161645, "uuid": "2f86d417-8ab7-40a7-9db2-fd080b8a3a2b", "value": "israel.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b8f4f5-0abe-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771194668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771194668, "uuid": "db49b9a9-04dc-4187-9dcf-cd1a50ff502f", "comment": "Malware payload", "value": "e8a704676c9126c14c906daf05c253f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771194668, "uuid": "069b2f7e-926a-4536-acca-aeabc8dbc215", "comment": "Malware payload", "value": "242141d9d23761573731b5f0a0f2a5039a6b8bb5209e167d93ea804802f15762", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771194668, "uuid": "a18f2580-1c38-4549-8c5a-1c1ba1bdf86b", "comment": "Malware payload", "value": "e2b408fc48bec20c291debe57106da86b701d694", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771194668, "uuid": "497dd557-f562-4b12-9225-85e396d7cc43", "comment": "Malware payload", "value": "7d8070e8ff515aaa9cb1b739cffb90211a4ea9a768a44d32d69e345d522db25ed510032108be3fbcbae06a1d4207b1d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771194668, "uuid": "52490ab6-9c2d-4126-b8c6-edb884e38bff", "value": "T15CB6CF15A3A80071E477C730CAA68733CAB17D665B34C90F0699F2522F77D629B6F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771194668, "uuid": "5065f3dd-fdf6-40d3-8909-ce5cd943bbc0", "value": "f9733d815c562b4051f00a897b1b84e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771194668, "uuid": "ba5d4132-ddc2-4ab7-946a-c1bd60429bc5", "value": "196608:H5CVjjpa2WFV+UK+9Nn2/7pFVZsB/omyGVZqzQqyGVvnTDQimtpIVr:H54jcDFV9Nn2/7pFVZsB/ombVZXXQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771194668, "uuid": "2c4c96c4-ec95-49c3-bd5b-639ca9d69438", "value": 10594122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771194668, "uuid": "a8249dd7-bb41-4a28-ad73-bbc4b468f5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771194668, "uuid": "da42862b-4234-4f0f-b053-714bb6f2ac63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a487606b-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120202, "uuid": "61b2da7b-cf63-49ea-b16b-172d567f691c", "comment": "Malware payload (Mirai)", "value": "a9277357d0709fb34f667dbf7c6da039", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120202, "uuid": "16b9a2f1-a272-4a23-aa68-c92d6a584a4b", "comment": "Malware payload (Mirai)", "value": "248b54a02ff55f77ea682ad663929d999b3c6a05dccfcf09e3fae5c29eca7727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120202, "uuid": "d8bb4faf-a855-43d4-bea5-14f6625803f4", "comment": "Malware payload (Mirai)", "value": "a56a637dccdd5fd4753f999cc09deb804d77530a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120202, "uuid": "5a33dd77-6b59-4c9c-a064-024f6eef7357", "comment": "Malware payload (Mirai)", "value": "f28c9f624cfcecdbfae9c81c9e49e6178a98dad141fd48d3ef2d94a49acf937c62403b09446cddcd7818cbb4bb0d488d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120202, "uuid": "e1822af9-564f-4ed7-81cf-6639b2b37cf5", "value": "T1D6733923EA16AF46C14761F0A9F64E740B12FC2A8D671EFAA564EDE881439DCF1053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120202, "uuid": "a5d4ca97-c2fc-4f11-b32c-fcc314317e01", "value": "1536:upwtq/0FORx0SFXaRwtjniiorx0cCnKc2Hf7cuG0kKCuWUbdg2X:upv0QRxJUucruHKcaTG0kKwwCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120202, "uuid": "a4719f81-5ce4-4db4-b4dc-d7cd67a0db32", "value": 79300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120202, "uuid": "643a6fb4-66e3-4a64-b223-89c8fdfc54e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120202, "uuid": "91f88e42-9340-4596-97e4-4c244a829904", "value": "manji.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62a4b73-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120204, "uuid": "9b9dba31-62b0-43ae-911b-c98945d5efb8", "comment": "Malware payload (Mirai)", "value": "5fe04b18acebf8b7a8fbf7927694b41c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120204, "uuid": "1713563e-01dd-40f2-85da-947206be025d", "comment": "Malware payload (Mirai)", "value": "24c60c9e43332c6db84fecd7b5f28a431ac59b71510de7d3fa9c5663f22eee47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120204, "uuid": "9909f58c-bacd-4324-9e4a-25aa1a90ad10", "comment": "Malware payload (Mirai)", "value": "efbf7e00c9020ed0364d6ba2f99e62f0dbb4e18e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120204, "uuid": "fc8803f4-87b4-4f6d-bcfd-bb13e1cf4037", "comment": "Malware payload (Mirai)", "value": "504a6739d805f4df7122e4274b93e9b477f40372acbc967ed784521233c9b184a7387b4d6a610fc2b1826bfc70a539d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120204, "uuid": "b32e90bf-656b-4e98-9501-6d7bff4a1406", "value": "T13483E942BD429F13C5C221F6FBAF019837166B79D6EB3242D931BFA023868DB1D67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120204, "uuid": "94d7d429-c84b-43f8-8df6-b1460ead1719", "value": "1536:/KDLhQ3BlLywjmConIxqPONv6GKBJw3y2XKPrL2tGwUbO2j0An6TfkTa:/KDqXjmConIxq296GKAXwrL2LA6oTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120204, "uuid": "0dbd7896-d889-4e7c-90a9-61df0b8154ef", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120204, "uuid": "8833a56a-d85e-4e60-9a5d-158509657bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120204, "uuid": "e4c41eb3-b2a1-40f0-9b42-4a30f6558b81", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10460b5-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120196, "uuid": "b74a97a1-23c3-40f4-a0d5-98f955b45f9b", "comment": "Malware payload (Mirai)", "value": "865a50d78ed9f89fd885c624f2908110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120196, "uuid": "2e18153c-e155-4de0-8f70-bbe7d1b70ff3", "comment": "Malware payload (Mirai)", "value": "26352d1862543417a192ea76729d499c7e2fb286920482960d4fc6213b40a100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120196, "uuid": "35dcd4cc-ab2c-45f9-823b-10297b7d667f", "comment": "Malware payload (Mirai)", "value": "52edd220a94c996bfdc5e2b7391062dddccd450a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120196, "uuid": "2291bd8e-ced5-4b3b-9846-ad3b76427b36", "comment": "Malware payload (Mirai)", "value": "9b06a20e307f497523f910ae121d5ebc746d323b564fb80d81eaed9902c29ed91ce251cf67be1b077616d845f5bb9cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120196, "uuid": "4a996e1a-d0c2-4c5b-a96c-847ca46c0f8c", "value": "T1B1B3F946A9429F11D5C631FAFBAF414933136FB8E3FA7111D9206F6023C699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120196, "uuid": "691c5bbf-d237-4018-b5d2-14de9a2673ba", "value": "3072:xqiaFqVnpOFnIfG/7/0qZYFY92nylaJl7xVPrqArkfJJ/0kkih6f:xqiJCdIe/7/0qZYFiCylaJl7xVGArkfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120196, "uuid": "b48b8450-802a-481c-8c01-c8c6761f7a4a", "value": 112664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120196, "uuid": "8320f47c-38da-4a2d-a40a-3b31111590c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120196, "uuid": "1ebec4ef-390d-4e33-ad3a-25029b62fd5b", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08b821d-0aa8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771185613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185613, "uuid": "2a65749e-c183-493b-9991-35dfd3c31c22", "comment": "Malware payload", "value": "f714b4dedaad2741d9657eaa1a79b1e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185613, "uuid": "6a03d7b7-efb8-4bca-9ba3-f443d7617419", "comment": "Malware payload", "value": "28c305cef7fe8ecee5456d2539b7087415f74eec843b1c748849bd10ddd54cff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185613, "uuid": "cc7850df-844d-45b9-a61b-2e2315bf9e5f", "comment": "Malware payload", "value": "b46a9affffd61b36ffdeebca52575ce8e7d63d90", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185613, "uuid": "09626ccf-d172-4855-a10f-2fd7083a366d", "comment": "Malware payload", "value": "5e1637da323bf6319f6b2d6eabed2a60fcad8b7c93dc7f2974392c2f034284b8c66345985e511892bd1744baa1104be5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185613, "uuid": "bf882fa5-b1f3-401b-ae98-d640607e38ea", "value": "T13E710F17A01490DED1B37B10E2CB6A4EFE4F447F80169312782C82891FF35A6D7D9E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185613, "uuid": "295714ae-1046-4828-b516-d26a286b4f0c", "value": "96:H5Z1GbTEbTqbTDMbTiJD6SeIhxG4v6Ulq78Obu:EbTEbTqbTwbTi0wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771185613, "uuid": "b84b48af-66a4-44e7-b134-b8c61c1452a8", "value": 3701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771185613, "uuid": "ad5d00c6-e4b3-459e-9c41-b710fa181b53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185613, "uuid": "8b59053e-fc6a-49d7-a1b3-7d1385455afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79e070d-0a7e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771167505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167505, "uuid": "323da6d6-6632-4067-8caf-f63c7a7f7670", "comment": "Malware payload (Mirai)", "value": "38f0e49cf4175c39d40db7e77e032626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167505, "uuid": "7631ba39-a447-4acb-a172-f7c9d4642fab", "comment": "Malware payload (Mirai)", "value": "29fbf26b6d1ff197bd9483d371709c50ad49383c0b0920b3db515d76a8aded14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167505, "uuid": "80c448c5-0864-4ff3-96eb-f353425f0133", "comment": "Malware payload (Mirai)", "value": "edc42f14b3c5f944c72956eb74e399cf8952a6a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167505, "uuid": "dd043d83-1a58-4c75-ab24-1dddcba2bff5", "comment": "Malware payload (Mirai)", "value": "a0e88571f82f128cced5b4c86341a5ff14d9d79ee22bed4319136d0cbfd84aac0c16a5d08cb7a3b642633b641b4114d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167505, "uuid": "ce48caf2-47fd-47fd-9dc0-740b639d35f5", "value": "T1DA834B85B9416A26C3C106BBFF5F018D331597D8E2DA3312CD281FA5778B85B0E2B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167505, "uuid": "5928de72-ec3f-4e9e-8632-963ddd98c50c", "value": "1536:gHdijeJXcWR9zzLaRUMermtmGOelbzh8t4lzlT5r6hBT1lEGON3mJm0uv6nzw:gHdiSJx9/LWmm5bbzh84n5r6hFLRu6n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771167505, "uuid": "2b27a16f-d60a-44c1-b38a-463afd1d6442", "value": 84884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771167505, "uuid": "d4a17029-b24f-46b6-a1ee-1655b7d6b305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167505, "uuid": "b3d9127d-6b5f-4fdd-a1c5-81c255ef31ee", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8d7b17-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150520, "uuid": "2c6ef4ca-c8ad-4aac-9791-7df21601924a", "comment": "Malware payload (Grandoreiro)", "value": "39ab25881a83182fab80d0eb6e726166", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150520, "uuid": "6aa1dafa-83d6-44e9-89d4-02d3b87b8ee8", "comment": "Malware payload (Grandoreiro)", "value": "2a8f3ada69c07420e87183d79a40e833b216465af51fed00b825d24aa92b2ac8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150520, "uuid": "2ce8735e-e8d9-446c-86d0-3732c74c3ec5", "comment": "Malware payload (Grandoreiro)", "value": "7c171d163f1c2fc076abe28e56f2a47790d534a7", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150520, "uuid": "adde277e-34df-4c5c-8208-b608ac640dcb", "comment": "Malware payload (Grandoreiro)", "value": "8d9d6157507fae4afbd3e9bd452cc1a8529c5a4fcc37619119ef186403661722a8609b94df5992f0f80579ebbd1c0a27", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150520, "uuid": "01f1ff83-cc43-4026-aee9-7c8551769133", "value": "T177462330BF656C67C6918775706E7B223E6C09234A4ED0C0747CF286779BE92933E8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150520, "uuid": "9f28145c-1612-4bde-97b1-ff544de81781", "value": "49152:fOV68fGb8WUbCmKhW2rzQb5Er1m6D/+IHuCGVIpfl1jCQBtW:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150520, "uuid": "e5c72dbf-13ab-4f46-81dd-6f6f8331c466", "value": 5423104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150520, "uuid": "c4ea4824-40d4-493e-808b-3d4128e44d59", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150520, "uuid": "452a5a10-a802-45a9-9e2f-94246228b5d4", "value": "Prvis541668DGJZLY18Y7_80828.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4414ba-0a70-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771161285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161285, "uuid": "d06b172d-ae29-4c6a-8d92-9cd1170a55e7", "comment": "Malware payload (Mirai)", "value": "446f2847fa55330ed3aeebeb6ca11ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161285, "uuid": "75125da7-8bd6-4f0f-8506-129f4e2cdc93", "comment": "Malware payload (Mirai)", "value": "2b762725fe032315fdb8e3ac2451060dad259e175be86dea340228ec57377e11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161285, "uuid": "52122ebe-219f-4fc5-b321-425967eb5b07", "comment": "Malware payload (Mirai)", "value": "7084fc490dac922cf7a0321f24385e9fa42b6304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161285, "uuid": "2e16617f-13ca-4847-8de5-00810d6ac1f3", "comment": "Malware payload (Mirai)", "value": "cda15b5bd26f1902d3065f1689098cb5f9a83435d9e7d80da44ab1a8a86aa2d9ce38d9c141245a1e3e5ef2c85d63874e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161285, "uuid": "1acacc08-e7f0-4960-8363-613b886a4cb8", "value": "T13C833A85B941AB22C7C116B7FF5F018D331597D8E2DA3212CD281FA5778B95B0E2B70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161285, "uuid": "d1ed7fa2-5f07-47b6-804f-5c59ce978a5c", "value": "1536:rzU6wS6ygK8s7lt3Dg648jJClbz6E/tU63x5W65xKZEGO9bcmCixMA0nzwK:rzUJ0R7bB4C8bz6sUk5W65xYugid0nzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161285, "uuid": "9d287e9b-e819-4f5f-94d9-96f47c8390b9", "value": 81836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161285, "uuid": "520ee32a-69dd-4c95-930c-1d8790c36574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161285, "uuid": "156ebf6f-f855-40e4-9efd-5f0c271f021b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37180868-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150512, "uuid": "0ab26f76-dd04-40e3-9934-829b761c3363", "comment": "Malware payload (Grandoreiro)", "value": "0d14ca11cc51e4cb01db3347f8dcd5aa", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150512, "uuid": "f05716df-b985-48c3-b279-00dba4853d5f", "comment": "Malware payload (Grandoreiro)", "value": "2cf4ecad05337a1371c509f6980559d20191bac1068239c33aef493d541f57b7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150512, "uuid": "dba6b9f5-00cd-4386-8628-200ce5e7ada1", "comment": "Malware payload (Grandoreiro)", "value": "f543a39aba9fccf95162a04f471dfafb96ec70f3", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150512, "uuid": "b76dcf42-673a-4e34-8fad-4a6834f64f47", "comment": "Malware payload (Grandoreiro)", "value": "53e95030fac189b65bb55fa9ec566b69a990268b6e3817d061ca74d7928491f918ddf92dd1702b0ee802714d3728c5df", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150512, "uuid": "361ee8ef-e498-49c5-9e73-81d966fe5652", "value": "T194562332F69518EBD4904B39B02F3F252D3E6643438E51D3B8BCA1867B8BAD3913D552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150512, "uuid": "6bf2b829-1e5c-4aa0-bb42-3f776a7c1fd0", "value": "49152:8O+jjvf9nae33zuf4DBOMksfytk8unwKpiTiBTLbcLdwfUWhXnpXnwoWTCJA:TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150512, "uuid": "552833aa-c693-4797-9499-cfed0119936f", "value": 6098944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150512, "uuid": "8c564e8d-c170-44fe-8b3b-828188fab4de", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150512, "uuid": "0151e63d-3d1e-4942-ad94-e6a77e8f15b6", "value": "Prvis87384BECVQMR3OM_51512.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a230f48-0a55-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771149685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149685, "uuid": "2a54184b-54b7-4e2d-afdf-c80c4cfef204", "comment": "Malware payload", "value": "c404efd4a49ef679cfebbf7a48ed244c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149685, "uuid": "ff7bd263-ef03-4307-9127-27ccefae2695", "comment": "Malware payload", "value": "2d581e29cf16110040e3931fc34f2bf1b151ab99902bebbe3db11943252964e6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149685, "uuid": "9276b486-c4f1-4b83-80e5-c067ad7d17d7", "comment": "Malware payload", "value": "5c3f45081d37ae92fef1819e22aa7392b0af16f1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771149685, "uuid": "f7e1abd1-f88f-48f2-aa64-89a91adcee19", "comment": "Malware payload", "value": "e978968e976df82cb3de26ed13af7e65ceb84d3283b60ff48ab2e9ddb3bc085be488dcb2cb828b7e7f91351a06f7d2ea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149685, "uuid": "85c26c9e-d36b-4510-9f2d-b8f47eb21eb7", "value": "T19DA22B1B8D133E608BE885575EEC25E92E4E438B22530ECD314FCB9A97D84DAA0F50DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149685, "uuid": "594460cd-06d9-41c9-9be7-c365eda00f61", "value": "384:GG0dO/mHu+bL5lPcLPutZPhEQjCa7PY/YboeSfIPH:IeCbL/E7mBY/YboeSfgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771149685, "uuid": "2fc5c84a-0d46-4028-83ad-ce10588e874b", "value": 21551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771149685, "uuid": "72e82624-7963-4892-8533-7e6a0eb3acde", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771149685, "uuid": "3356158f-31b4-4806-8727-7b1b8244b78e", "value": "Debug_Installer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d707522-0a78-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771164696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164696, "uuid": "8946e8c4-6344-4a40-a3ff-84c4c37d066c", "comment": "Malware payload", "value": "a0f0ecf62dd2e9de2420161242e9ddfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164696, "uuid": "fe1f501b-b02f-42f8-89b6-9780127ddd67", "comment": "Malware payload", "value": "2df731ccffaac8a175a9c410f0351ba537771c6873345ccc14090c7c10bdfc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164696, "uuid": "c51e4d71-0cd0-420b-9d8a-c33dbc69b496", "comment": "Malware payload", "value": "dabc77a7f2a39498906e9a16fb2369edb74fcc23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164696, "uuid": "f74c85ea-3a8d-4c37-8bcb-2d4577956ee9", "comment": "Malware payload", "value": "b0877f2c15b49b5dcf3c6186ad107f13686dde0b54321176a2ac6f2787050e4358f5f205eb666bd28714007de2097751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164696, "uuid": "935892e4-238f-4d54-865b-37d4e9e2ed67", "value": "T1ACD3971A7F228F6EF269877447F74E30A75937D61AE1D684E1ACE5401F202CE141FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164696, "uuid": "889ae684-5a40-4a63-8d0a-141c520bc97e", "value": "3072:jCea3EgQCUTiYH7J+hyOJlVUkibOsQnS0Kmug:jCeEEgoGRVZUSsj0Kmug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771164696, "uuid": "8050a15c-aa03-447a-8cc1-33a9329ce91d", "value": 132108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771164696, "uuid": "5897b9a9-e1ff-4557-a470-69114c253247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164696, "uuid": "be865165-0d54-41f5-8f62-320d81fe9a25", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91a68c0-0a66-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771157146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771157146, "uuid": "8746f741-f402-4621-a1e9-7cbcd54e9705", "comment": "Malware payload (DarkTortilla)", "value": "6379e69da9eca750cbdd1e2d57dd8241", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771157146, "uuid": "dc318cb0-51bf-478d-87d1-13013739dc8d", "comment": "Malware payload (DarkTortilla)", "value": "2e0f8114e6f73774c9747a81e78c71cf1cda2f2f74b554f603272358f34717da", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771157146, "uuid": "0a2340cb-b142-49aa-8ae0-9df262a234f4", "comment": "Malware payload (DarkTortilla)", "value": "5c933c8577766d585c5c15998339fe5fa4e8d0d1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771157146, "uuid": "8e2a8128-fbe4-452c-b1ed-26937bc9ec25", "comment": "Malware payload (DarkTortilla)", "value": "e9aa8a142939b22e09de1a0df7ee4aa3028d2a21e20fade56a7be69e19c6ef927859e194cddf65e00ba9b734e34998e4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771157146, "uuid": "b9aac906-a386-4693-b0b7-36ce399d99c2", "value": "T16C3501256E876758DA994FB9C07A04E823F0CE5B5296EB6F6FEC01F09FE7B41C901421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771157146, "uuid": "035c373a-ca45-482b-969b-bccf6a4b09f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771157146, "uuid": "cc1cd428-24b8-4114-b039-38dcb56b5ab9", "value": "24576:CgSFJynPgKzfjEXfmRyl/OZboXng07ehFqpnz:ChOPgufjEXf8mgGeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771157146, "uuid": "c1898802-176c-49ab-aa8a-bf08e7bf412b", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771157146, "uuid": "a955c649-32c5-488e-be6e-ff43330b8ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771157146, "uuid": "e01d6fb3-9817-4215-9335-bdd2ccc43cc3", "value": "quote.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5fceae-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193793, "uuid": "687db739-56a7-4be5-a21a-440b7e387f58", "comment": "Malware payload (Mirai)", "value": "02c7fef14fdef5db470de1f1d7cdc702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193793, "uuid": "3a4008af-bfa9-4f40-b48f-3dc17fcd55f0", "comment": "Malware payload (Mirai)", "value": "2e21aaa00cda821aa5d847366c7d005cd71be3fb25435d22c87d0bfee44babaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193793, "uuid": "be49f09d-fe6e-4a0d-a65b-3a07e42b99c0", "comment": "Malware payload (Mirai)", "value": "f5528af361958ac81e7416cb550c157b76e4011c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193793, "uuid": "206fbeeb-2d24-4358-ab56-79d9f1e5287a", "comment": "Malware payload (Mirai)", "value": "6144e08e890f6f6f53d2a706bbb88b9206408248ff8a85d6817b7e6a6c4769e67544c92c0724729d6d7f7e0adc3dcb46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193793, "uuid": "ee2c9fdc-fd42-44b1-9294-ed57a5252ec9", "value": "T137C2082306BA5D07C0C5627520E35323E8AEBF694624434F7E995C8E6EE13D03A3BBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193793, "uuid": "8f4ef3d9-714f-4a44-a7d2-cb29c486a49d", "value": "384:a7s2JK7ryAwYxRhCvdGxr7Wt7Lba9Jbb+LsyiGyG:ag2JK7ryAdfhCvd2utLCTy6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193793, "uuid": "3e0b00df-bfbf-41a6-ae49-462e3fded461", "value": 27248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193793, "uuid": "bc95f5da-57b6-43b9-853d-8257fe1820e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193793, "uuid": "138816bf-8a2e-4e9a-b948-ae75866ed1d0", "value": "israel.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1de012a-0a05-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771115607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115607, "uuid": "858d87f1-016e-4fc9-9dac-620a1ecb761f", "comment": "Malware payload (Mirai)", "value": "698ea50088657a42320aa0efd2caec79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115607, "uuid": "3fda3a86-2ffd-4f69-96c9-b412ce06db2d", "comment": "Malware payload (Mirai)", "value": "2f8774d63d3760c6868ddf57206c69369bf470988f413a05c0198c7afe155bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115607, "uuid": "8a0d5f92-b23a-4105-9eea-104240934f68", "comment": "Malware payload (Mirai)", "value": "7e3cbab6ff089de3245285ce1238ba778da8590a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115607, "uuid": "07550074-f6fa-4b39-a9b4-05ab15a9656f", "comment": "Malware payload (Mirai)", "value": "7986a97146a642303c2a480ed31e9e7ff6623fd302dbfc70bda942deb4baf8cb8457b7a37841ebe0e6621fd48ab21535", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115607, "uuid": "fb13e4e4-a369-4bc3-adcd-7f5f7c6d2ee4", "value": "T1F3B309D9BC818B10D5D636BAFF1E518933138B78E3FA7113DE185B2A538A95B0B3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115607, "uuid": "d6377c8c-a6d9-45c8-bd3f-0c71c76e568a", "value": "3072:g6oUV565NnJEgER7fuuVDzjDCkoU1NkBvuyYuAgkL72PMjX:bsJqyuV/jRNkBvuy/AgknS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115607, "uuid": "1befd36f-d5cd-4bfd-9ac4-fb634395b1e3", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115607, "uuid": "4b66bcb6-6a51-42f3-a0b4-f8d12344056e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115607, "uuid": "b8efd8cd-2850-4d63-b201-28afd571011f", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1f5e01-0a08-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771116669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116669, "uuid": "02cc431f-9c54-4b32-8031-7f240c4af478", "comment": "Malware payload", "value": "6a7c14553625dadcd69711cb1c703fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116669, "uuid": "4db219df-3246-49e5-aa96-7c3c05603afc", "comment": "Malware payload", "value": "30a0af0a664e2830ad2f2d15695a764bb7b24e0f813141280e0acf795c92e5ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116669, "uuid": "f51f50bd-ec9a-42be-b67e-16cc630e80a4", "comment": "Malware payload", "value": "1b6ad5d73f40be2cae2c3f8d7b1623bfd81d54fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116669, "uuid": "95170527-3f08-47cf-bc9c-307e087ec646", "comment": "Malware payload", "value": "e51c377746c99539730f29801298dcf076028ab0b99d91b50b966856d93a3d903e0fb8e6277a07f21a8a869ec23ea5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116669, "uuid": "476ceca3-f7dd-452e-b9d2-745aa2dacf2b", "value": "T11AB37295E123809AE41E65F15FEB1DF67BB46AEBD604C9210CCC728119329F5CECB4A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116669, "uuid": "c7765881-1878-4809-8500-597d2350b03a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116669, "uuid": "12411c7c-c16b-418f-adbc-0c8fb1f54e33", "value": "1536:uT/rli65yO6J2ImYJRQffbZ9bJqzkefdaKWVo1GclvLMQd1:uT5qO6JHmEQfft9bJIkm7r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116669, "uuid": "bbcd0a8b-89ab-434a-8f4b-99d621cc6e57", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116669, "uuid": "b6f59503-6b81-430d-9d0a-a0eb997e6eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116669, "uuid": "f0a76e37-0a64-4580-a8d0-8604ca77d50f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.89757418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71010d41-0a0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771117538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117538, "uuid": "025fe1d6-77de-4477-b622-aff1135d18e6", "comment": "Malware payload (Mirai)", "value": "7e16b8350c9d3caeeb1ff79ec8b18bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117538, "uuid": "188ba62a-1a4c-4dbb-8ef4-9eeb72edd1e6", "comment": "Malware payload (Mirai)", "value": "3255625ffa643ae2580b27195e9e070baecc53addccaa2e125a4eaaeb440e167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117538, "uuid": "59c4d379-2cbb-4362-9cfd-18eb4172491f", "comment": "Malware payload (Mirai)", "value": "4a3578f2045afb798bf3fc77e524dcd35b437ae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117538, "uuid": "13bb5fcb-e75f-48b0-b322-224a5566a18b", "comment": "Malware payload (Mirai)", "value": "2dc80f64e2b5ef45e510f690e763c5980f7ad9dde0aa8a8d35a6dd21a5627adeae199410e7c40de207b2ff68fa00c48c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117538, "uuid": "88adc523-41ad-451b-b100-ec5b5ef275bf", "value": "T1D8B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117538, "uuid": "239c2056-67a7-414a-8b47-4da6994693af", "value": "1536:Y7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxe:+zPqF41OUBljSIxecUtCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771117538, "uuid": "bf212197-e603-4484-a4d1-02bd135120a3", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771117538, "uuid": "3f44f242-0aed-429b-8973-d062d0da5131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117538, "uuid": "c0d2414e-4b3f-436e-8365-ee90e815bd4c", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8520d73-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "be79f56d-bc18-4135-b0a9-3dfd5da411d3", "comment": "Malware payload (Mirai)", "value": "4f464a9b411790d7635520127d159d08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "d32f317c-4c2e-4181-a4ce-def311f2fd16", "comment": "Malware payload (Mirai)", "value": "33f83dc5555afc3222686934a3d4fe0c227e592fb7a40c2b2155540dd2630746", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "448bfd67-7893-4aff-9501-da6bff24fe0f", "comment": "Malware payload (Mirai)", "value": "cf8cd22ccad5bad50a4d827b403e07349b190ff9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "7e2c6496-e940-4d83-96d6-fadb90e577ea", "comment": "Malware payload (Mirai)", "value": "dd7eb964f814488aad9a7b8b5f83a7b811952093759aa1a3e1ca153e2046d28fe830af10ed25117cc84942433da1cee4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "96b21a09-3b61-4ac9-9c63-5be4c9e9d9c0", "value": "T11651B1A5E2814232AFB9A59379B681447182DAE25CC97D13F2FCBCB885CDE0475817C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "d85ffb9f-13b5-483c-92b5-e30548e418f1", "value": "48:ipMvMQzLpMVM0zLpMSMwzLpMaMwzLpMMMszLpMuMEzLpMoOMzEzLpM9MEzLpM6MX:iO3g3d3N3b3R3VE3k3t3M3j3N3x3C3Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193786, "uuid": "671a8d8d-2ad9-4c5c-bf7b-6fa82368065a", "value": 3064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193786, "uuid": "50917b82-1f0a-4076-bba1-9c8844cd2c30", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "fee29396-3bc5-4f39-9003-603cc5cd0844", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcb11e1-0a0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771117422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117422, "uuid": "c604c666-a2e1-4e32-ae28-6799571e246e", "comment": "Malware payload (Mirai)", "value": "3ce8a714552d621ba5bb10edcb838078", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117422, "uuid": "3e7e4d1b-2109-40c1-a870-b60189f46332", "comment": "Malware payload (Mirai)", "value": "353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117422, "uuid": "7fe6cfac-574f-425d-9f79-1ddcad2ce0a9", "comment": "Malware payload (Mirai)", "value": "93fd0de510b0bdcb6e329f2d69f6214cb7cec5ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117422, "uuid": "456e8bd1-7eaa-437c-93ab-f916ad78601e", "comment": "Malware payload (Mirai)", "value": "e62f70a02b10febd4435daed2d37c3b4f64b5f6a27bbae606b2d6e1acbf5b36c98b8f1eaa90478bd4037c9de3883ddc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117422, "uuid": "1e734d29-7a26-45d0-ad91-6001c1645852", "value": "T1D43115CE60F4A143C5DCCE1070F5CFC8631A959261DA2A3AEDC12E67C4C9DE47429B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117422, "uuid": "af317d0b-b672-4d2b-a88a-d1c68737df62", "value": "48:s62UG7nqsg1l7w5/XaYu8GnCQio78xfqiaPO47:ic12BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771117422, "uuid": "9f94edc1-9835-4e5f-9361-b9eb9296ae46", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771117422, "uuid": "26aa290e-374a-4f52-9dc8-5a43ba553dbb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117422, "uuid": "165f83db-ec66-48d9-9c3e-e0cb05d7a63b", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975d7d89-0a9f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771181598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181598, "uuid": "f7a9a0ca-a889-441c-a421-ef6fb0d5f837", "comment": "Malware payload", "value": "e2885a353f8b6acf81cc04464964970d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181598, "uuid": "a4e173bc-cb7a-49d9-bdad-2856f1e986b1", "comment": "Malware payload", "value": "35da258e88ce760cf947b49b4369ec3fc9f4b4cbed21335d851886ddf49287c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181598, "uuid": "6ddbac96-d68e-4c9c-af5e-c6b05d65fe63", "comment": "Malware payload", "value": "ce9b288216a695815c494a247291570208efa2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181598, "uuid": "c90b6e38-c9aa-46bf-84b8-6b234f10c83c", "comment": "Malware payload", "value": "905c4574ed46b955812b8fd2657d623d9b411d27fa68f0eaaf41f9488f754b1a6ba7ebe27fdcbad6804b580efa86bdff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181598, "uuid": "05e54968-a807-44ef-9bd9-5af8a6e3cd2f", "value": "T1A0F3871A2F228F6FF269837047F74D30975976DA26E1D684E2ACD5501F202CE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181598, "uuid": "546ca46e-7b6e-4816-9458-303db60f182e", "value": "1536:Jh70UQaO/voPGR2r/gcgIIgyeW+VQ20JVeoT7ZpUS2x9sFtt0J000000b2b:Jhu+G4r/XgIIgpQ29SpUhx98te2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771181598, "uuid": "4d771f28-6a85-4e2a-a183-c5b6010f22e5", "value": 163080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771181598, "uuid": "26edcd33-58ed-46d9-887c-67b850e51611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181598, "uuid": "68751cee-bc56-4789-8610-25fd40f8735b", "value": "israel.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ace96-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120212, "uuid": "f96706ab-5469-447d-949b-8ba0fe65cb84", "comment": "Malware payload (Mirai)", "value": "9f3b7cea82a537d6fdf4fc74c6b164f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120212, "uuid": "db43392e-9415-405b-9c87-d622e7448447", "comment": "Malware payload (Mirai)", "value": "36af22ae73713a9de8f3475ad971fb34eb61055ef74221ea5a9db8d81ff17314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120212, "uuid": "88fc9ab4-ed9f-4b42-a651-8e55b313bc81", "comment": "Malware payload (Mirai)", "value": "a662a2acc54947e683005110bfdf90a2c7b59774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120212, "uuid": "a8b2f28d-1a84-4004-acd1-eaa6893a5dd7", "comment": "Malware payload (Mirai)", "value": "640649e4db18dad4417abf23309bee9172b924fe2fdb12f743ee62b3e6cc00e794a64f23fef7efc9dafea889da4ad00d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120212, "uuid": "ff44cd97-ae35-437a-9e65-635e5a9df0ad", "value": "T140730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120212, "uuid": "5ffc543d-6007-45a7-bd6a-e33d6ab29d41", "value": "1536:Rcz8Mfl3USRL+r97S3TlpffUr4ssC1qs3vLJ7LZaA14B6Kk3u8Hg:RcICl3USMsTlpHUrg6qs3TJ7LYK4fQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120212, "uuid": "0eb762de-f49c-4835-aeb3-f3a47721d833", "value": 75592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120212, "uuid": "e92da639-c26a-4393-b275-55fe0492bf5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120212, "uuid": "10296b55-a08f-4705-8fb6-8a777b11b46c", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52748358-0ac5-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771197803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771197803, "uuid": "cc3ea972-1cb3-4af6-a4f2-9f5fa571084a", "comment": "Malware payload (GuLoader)", "value": "9e2680ec218149172b907cc2cea317d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771197803, "uuid": "68420735-2fc1-42c7-9d92-8a620d59a9fb", "comment": "Malware payload (GuLoader)", "value": "39956757770b52c819454aa6cf995788b0a0936fffee040840190a85dd216b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771197803, "uuid": "b8e85395-8a25-4f38-bebf-4d0226a2d46e", "comment": "Malware payload (GuLoader)", "value": "12917abafe923dca6d8330a9fe26e68f24464ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771197803, "uuid": "0b875ece-eea5-4574-b410-e6754ddeb0d7", "comment": "Malware payload (GuLoader)", "value": "3cbeac3be16007494d4991d4805e33bcab7aa399bd84b45be13ee905ada51a327e8a1ec2b39727aed5acf87ee4e3ac0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771197803, "uuid": "ce7c0523-a583-4ef1-8ed3-a37ac52614f5", "value": "T1164412167260D0F6C5B22F316AF67AB98AE79902038587872F51BE9F7C71302D81F271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771197803, "uuid": "84e6aa28-7d27-477e-be37-8d4fd785a552", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771197803, "uuid": "a9101cc1-8981-46ed-864e-c3487ea3245a", "value": "6144:kcBvWb0GavVtDfX4Al+Vpq8b9oDmTG8gk4bSVU0XBLaJDAV:tO0NttDwnq8yQgk4bSVU0XBLSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771197803, "uuid": "23c135d0-c159-43ac-9d24-476f2641998b", "value": 276060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771197803, "uuid": "f1cfbf36-2cf5-42c3-9bd7-7534fc49759d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771197803, "uuid": "402a5b63-13df-4ae4-a848-43c19d88f00e", "value": "PR-000032683.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4158c1b1-0a95-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771177158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177158, "uuid": "be6118c5-d5fa-48a0-a0e8-ad55ac67d0b6", "comment": "Malware payload", "value": "9fa54568bacaf0223c0364ad4b111ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177158, "uuid": "3999e568-5436-4b66-ae8c-046f4671a095", "comment": "Malware payload", "value": "3ae3dd48565975a3283d4c362a96983ba899ca5eea167dafab6e3aa553597427", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177158, "uuid": "2c2b78cf-fb2d-47d8-afe7-e6b298ee0991", "comment": "Malware payload", "value": "085f2885c571b07d0f196c73681cfff211b70338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177158, "uuid": "93353bac-0dc1-4dc4-945e-7d1da633d1dd", "comment": "Malware payload", "value": "9e652de6fb7cea0647cf14f64ee3c6cb1885e7a6fbdab34432ba63944e16cbf46fe544f943ce8d6b15a5e35dd18c68ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177158, "uuid": "02992479-78ff-444d-87b7-ff18e922bb84", "value": "T1E3E56C09ED248B61C3A003768AF805886371AD031BCB571A9739F778FDFBAD4DC85696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177158, "uuid": "1b784bbf-0af2-44eb-93e8-a4ef623b88f2", "value": "24576:Y/H8Uyb7bspzFOuCeY2tBE9v3EljntvRohexPPRa1kYqU2hpdIjvxo7:Y6beY2dRnPRTXdIjvxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771177158, "uuid": "fa390d28-2348-4451-b3ae-2a8df39dc216", "value": 3286527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771177158, "uuid": "eb8a482b-4d17-48df-9607-aaf23c006b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177158, "uuid": "6fe1ccaa-0362-4d87-b951-103c1cbc9c73", "value": "bizy.riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f06f25-0ac1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771196327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771196327, "uuid": "de1e1bc2-6501-4c6b-ac38-9349b78bff41", "comment": "Malware payload", "value": "bc4c0ce8eae6f204f43463e68e0ec9a7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771196327, "uuid": "5319c49b-82b6-4176-939a-27a7421f2080", "comment": "Malware payload", "value": "3b93465de33b87e03e1932381c60acfd13f461e6ce8cc129b2ca0d04680321f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771196327, "uuid": "c352f709-3326-4d0f-a606-af0b46e8d0f7", "comment": "Malware payload", "value": "8c073b2130029047738696a02ba8dc86f7eb44fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771196327, "uuid": "b2c71244-a294-4857-b1ad-24320060c45e", "comment": "Malware payload", "value": "9851b57e745129110b6aad599dd6882a9d7727c6afd2c0184c33b14333dbad4f28d4ad1f8ac3b605a609186933069eca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771196327, "uuid": "16257199-2734-4c54-b1c3-99a4858fee6f", "value": "T1C4B6CF15A3A80071D477C630CAA68733CAB17D665B34C90F0699F3522F77DA29B6F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771196327, "uuid": "179e8fb8-714e-4e66-80fc-d89f6274234b", "value": "f9733d815c562b4051f00a897b1b84e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771196327, "uuid": "917fe3e5-6ff9-4d90-ba59-357dc3ed9f5c", "value": "196608:H5CVjjpa2WFV+UK+9Nn2/7pFVZsB/omyGVZqzlMw0r9JP8G0xyfoEA:H54jcDFV9Nn2/7pFVZsB/ombVZX9uGMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771196327, "uuid": "d909d7ee-36ec-4799-8a4c-f9bcb682a75b", "value": 10630652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771196327, "uuid": "b4d5df09-3fcd-4556-ac2d-9aa4460253aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771196327, "uuid": "db9b7ce2-1056-492f-b655-e59333a3cf0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27feff34-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150487, "uuid": "27be6c7e-aced-45d8-91a1-74d83aff9242", "comment": "Malware payload (Grandoreiro)", "value": "e29c4708bb64eada2d6384532173477c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150487, "uuid": "f9f71bb9-9539-4b89-afb9-cc6cd4ef5ce1", "comment": "Malware payload (Grandoreiro)", "value": "3c28d7b616bd4c39adaa25f6dd966c2e9718e277d1f86fd6ff4ad75f60ffbdf8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150487, "uuid": "3dae8a68-10f5-4cdd-8364-b566a5a57dad", "comment": "Malware payload (Grandoreiro)", "value": "e028f5963da69522eb6a6ca5023e3cdc02b6af6c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150487, "uuid": "7bf3e33b-2656-49ca-89a7-e5e23ddfe257", "comment": "Malware payload (Grandoreiro)", "value": "1376ffa12fb45c426b730ec4bf664667906bb843085b0a2f3600fafd40dc93f39be5e1024b543a94d3656df078d30adb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150487, "uuid": "4947a78a-6dc2-44da-9d75-e9507bea7130", "value": "T1D4562332F9912C7BC6A00335B45B3F357E7C72135E4C65D2A8EC7B82370AAD1562B58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150487, "uuid": "653c90a4-f8dd-494b-816c-bc9dd846c2f4", "value": "49152:K7N3Ur/e47dAcYhWrTBG2B7y8er8+KZA6f0wB1Wu/9YKoukmHMku2NnT2XUkE57:ZkXUvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150487, "uuid": "8f6f51c3-4516-42ee-ba10-570b65e7037f", "value": 5961728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150487, "uuid": "bcc74881-dfb7-49d0-a75a-a82050654bd7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150487, "uuid": "6239884c-150a-4bca-82cd-ab0bc7a6c736", "value": "R6SHSX631492Fch_LQEP673449UL1FQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7628d34-0a73-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771162780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162780, "uuid": "af83886c-017f-4f74-8684-7c5b8ce18959", "comment": "Malware payload", "value": "720f24ccd125816400d7f2036255df15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162780, "uuid": "62d73c68-0511-4f8f-973e-67441d29bc92", "comment": "Malware payload", "value": "41b45799bc85d2c743a2ace4fd9407b52eeafb0d9a9b765d9c18d2cd41f38435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162780, "uuid": "c77d4dbe-d45e-45b7-8f95-a962f5aea24d", "comment": "Malware payload", "value": "edd276276617f4a0e4891071ff1b53b74fa871bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162780, "uuid": "fa3d2cb7-122a-43a1-af0f-3fdf4b2f3c14", "comment": "Malware payload", "value": "3f01afd5a73fe1de7e8755917a2a67c8fdde55d9b4d4dd7231e179eaf055cd03d5750fa54ba5adc5c0af3a81234d6140", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162780, "uuid": "bf966d24-990c-44a6-8986-ffe99efbe6fe", "value": "T198043C53BB324FA0D365D6720B738B195AEB11811EE298D1935CCE103A207E9689FFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162780, "uuid": "1eac6946-bcac-4622-8c90-f6ac5a2bdef6", "value": "3072:KvT6wHPACVGqfIBO15gLUoG+lRDvdLpn13:KL6QP1GeII/8U0lld513", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162780, "uuid": "d864233a-0478-4ea9-84ac-56fa2c4b3252", "value": 184888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162780, "uuid": "6e312e54-0acb-467b-97a5-82e1efe03920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162780, "uuid": "2bcb91ce-bcc3-41ff-8668-a388decfd4c2", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b6e637-0ab7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771191797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771191797, "uuid": "50a1f828-c6ba-431d-83e1-e019b30309b8", "comment": "Malware payload (Mirai)", "value": "a3a6b2810fa525c6b764f361207ebf5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771191797, "uuid": "bc51973d-6c12-4868-8483-ac3d6d7980ca", "comment": "Malware payload (Mirai)", "value": "41c085314a6f78cb8222442e1e13bc0796fd3c8fbde1686d877bf1297bd5be87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771191797, "uuid": "de75cd28-1f70-4b41-9836-5df1b6631679", "comment": "Malware payload (Mirai)", "value": "6d67a58aee5e68926f895b129be7501357eba802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771191797, "uuid": "9b08ca9e-0916-4046-a258-c69a19eb3d1d", "comment": "Malware payload (Mirai)", "value": "054c49745ce4392f8ad217652dcb3d0ec573b60bbf784e77b62fea8589723d2dd5996044201d433884802992c69f26c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771191797, "uuid": "0c493a07-7dcf-4753-a727-f732c58c3355", "value": "T18AE30945FC404E27C6D612BBFB5E428D3B2A17E9D2EE71039D215F21378685B0E7BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771191797, "uuid": "4501a280-05da-40a0-91ae-b989afdcd8f3", "value": "1536:pFc6Lk9dqXabb6TXzOjtbp1MJp3uQLYUasllJLzg2HAXv/4VEr8TKj4Slwz6kzIj:pFZLrPpHYUdFzgb4e8Y4SezYAAbc+hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771191797, "uuid": "15c5b174-72ee-4acd-bc52-2f54f5fab795", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771191797, "uuid": "4535146b-69ba-45fc-8e49-9fd7db6fd03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771191797, "uuid": "c79386e3-ec6a-44c4-a62b-22467c74ed31", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0894cf-0a05-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771115572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115572, "uuid": "d4ffde2c-944b-4f55-8f67-f5a0a7647c82", "comment": "Malware payload (Joker)", "value": "f038bfb28fdc3696081452aa35b531f4", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115572, "uuid": "a0782d7f-1307-438d-86de-891f85e6ac86", "comment": "Malware payload (Joker)", "value": "42cbe04faa3b55016d5881f54db30e502c27191faa9a9c00ff3fc12ff39976ad", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115572, "uuid": "de748c5a-463d-4873-b2f7-c201d572fa26", "comment": "Malware payload (Joker)", "value": "a96084938190c652ba57d5404e28de7c4e51337b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115572, "uuid": "48eec23c-0929-4d62-a8fb-f80b57e8ea47", "comment": "Malware payload (Joker)", "value": "afe67240137590c99d815445abdb1426a933090b549736c729eafa9415c5407f9f32cd8c6ffcab67cae613d0fe2f0210", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115572, "uuid": "4c0c4c40-13c3-419f-97b2-fbe2c13a729b", "value": "T16FB60127E75D992FD87B6030CDBE2131D10A5E07CA466B93A824724D24B75C1AFAFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115572, "uuid": "e375a845-5dcb-48fc-97d5-331d6f3ae2cd", "value": "196608:T+ke7FjKMivhPQwyGLKTAF6FjQLkMH+BwluL0fVDz6jD19NB97:Skh3yGkjQLkbBAuwlehX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115572, "uuid": "5d049361-4871-490e-a860-440e6437a084", "value": 10777622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115572, "uuid": "d8a24291-10ad-4ede-baf1-cf2a646c0530", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115572, "uuid": "496f74f7-c1cf-4b8c-9cde-b0fdd4e64750", "value": "com.powercheck.batterywidget_3.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f8d137-0ac7-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771198888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198888, "uuid": "1fbed255-2af7-4f46-95da-a00085fadbcc", "comment": "Malware payload (AsyncRAT)", "value": "49e9af3d4585bd4260a10610109d9413", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198888, "uuid": "85e8858d-c5b2-4147-82eb-567a97b39d42", "comment": "Malware payload (AsyncRAT)", "value": "443250c909c83c83d1d83ca3cbd2a78d733975846bc1a37070ff35270b15fbbd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198888, "uuid": "43db0496-58d7-4a94-a959-2f8fd895142c", "comment": "Malware payload (AsyncRAT)", "value": "f8fcbbc72fe2802ea01742184e085b2aaf2ca9cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198888, "uuid": "84492a30-2887-4c04-8ba9-a49350119430", "comment": "Malware payload (AsyncRAT)", "value": "a669e4ad59672a71f5993f2c2ff055128fc022f247fc52545dc60bf629dca09e3d424b10f088346dc904b0ced828db33", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198888, "uuid": "dce7b121-69a0-4a76-89ff-54cfbbc8ead4", "value": "T190235C403798C136E2BD4BB5ADF3A2458275D26B6903C649BCC810EA2B53FC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198888, "uuid": "3b6678c6-cd84-422a-848b-3ffe990804b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198888, "uuid": "daec6669-41fd-4440-ab8e-2eb87ad5bebd", "value": "768:MvUQgNIL4+M0+Liw+hhQDXKNZi2JYb+gegUr1htWvEgK/JDZVc6KN:Mv1gjs/hhyXiKbB0r1CnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771198888, "uuid": "cb638810-1e05-4be5-be05-6edd630ceae1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771198888, "uuid": "d7b3f079-62a4-4015-b712-29df6fae8bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198888, "uuid": "fe868864-36ac-4310-8c09-ba15658b2239", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fd17ff-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193784, "uuid": "df45d539-3014-41f3-9bea-797dedd2f6b8", "comment": "Malware payload (Mirai)", "value": "f066da97eb2ae9b01efabe897a667935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193784, "uuid": "60bb6edd-b3c6-4f46-8732-e79853265aa9", "comment": "Malware payload (Mirai)", "value": "489af9ea1ddc006a3e0b61dce08ee453688eaa91fd98e9818d891c0110b7b226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193784, "uuid": "3a851452-cead-4fd4-90bf-d48e332352a6", "comment": "Malware payload (Mirai)", "value": "446a4a19ed00477827123d092498b2f37484a5cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193784, "uuid": "caadf238-5f74-4152-ac2d-1e363076974a", "comment": "Malware payload (Mirai)", "value": "cb45d1c8ee11ee9a04a0370e3d4cbc44444976764996b9625d61e75f5436763991770f66a4d34ca5ee26b8db14d726aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193784, "uuid": "be51b16e-3754-4d80-be43-ac617e531e61", "value": "T1CCA3D782BA43CFF3D80314F141F76A398B31FC2A5836D586E729BDA5CA175D17216368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193784, "uuid": "a40cdd7d-28c6-4551-ace9-99b8c3e2b0f0", "value": "1536:olgE+vbD19xmvXkfWmXDjWRQSbhoJuuZ1JHfoskftti7:0F+dmvXaWzGSbhoMYmtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193784, "uuid": "90f1bbe2-eb75-459e-8949-be17c7a9cc05", "value": 97836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193784, "uuid": "b868c80f-9791-4b29-912a-42713971ca70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193784, "uuid": "580f071f-057f-406e-ba12-e2a7ec6853f6", "value": "israel.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb009dd7-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193791, "uuid": "e73e8bb5-d35f-4b6f-b5a2-2e83f771ca14", "comment": "Malware payload (Mirai)", "value": "97253a15b0867e82703fe78ff7a2e02c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193791, "uuid": "dfa589fa-e897-480a-9c14-e8b0558f2de9", "comment": "Malware payload (Mirai)", "value": "4a4793f97f1b492d648733fbab1e560b0cd4d4e664701733a7e97d0b6042556d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193791, "uuid": "b8faf2cf-4510-4266-9ec6-ea42fe568ef9", "comment": "Malware payload (Mirai)", "value": "cbccd42241b09bcc103a1612bdc9bebe4f356811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193791, "uuid": "f155eb10-e236-4e8e-9fe7-c5c749affb27", "comment": "Malware payload (Mirai)", "value": "144379e576081f7fc5e03d936a23df6504ae017f75a8b892f839f5d83124eceb0bdfa7aa3e6ba540d09e557a7b92560b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193791, "uuid": "89d8d0d5-0b1b-47c7-9b4e-c721e43f0f83", "value": "T18103F14C00D79218C96BF1341ADCB31647689759EB0D2398EEE331396651F5C77AC7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193791, "uuid": "0ac599dc-a4e8-4085-9260-980325996492", "value": "768:85zGYSTbsVsuS4pYnfCKFcH5+kjqX6SN5975vRJaI3y2QawSmnbcuyD7UHQRjq:eGe6EefXFaYHV50Oylawrnouy8Hym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193791, "uuid": "627c8e10-3757-49a2-bbe5-dfecf718bb6f", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193791, "uuid": "91879690-a6e0-499c-9783-bf7af816397a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193791, "uuid": "98e35bf4-602c-460f-b5fe-4f8b4836da1e", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81f71c5-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "d8339047-5ae5-4fe2-a73d-6ba7511bd32e", "comment": "Malware payload (Mirai)", "value": "14a8c49995b33b4b1860a172e755605c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "566d3d23-3ef7-48c5-b596-53b5df43195f", "comment": "Malware payload (Mirai)", "value": "4abcf6d15bdec8f46ecc9433c74981c43203fba32eb2e734e13f2a98d1dc8935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "e3cecbc8-1e46-4913-9744-8b9341e353b8", "comment": "Malware payload (Mirai)", "value": "b3d20ed71f357be1c74b12881d8f6486acf62029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193786, "uuid": "b4101489-5391-4a0d-8654-1064213dac30", "comment": "Malware payload (Mirai)", "value": "844c83ff24e1aa755ab89abf68b0145fb04390b26a0b9b21c992afb7b1a4a8cd4514198fd669d5a9aa1776e98f72c3c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "38feee64-3e1e-43df-b75a-a7096ef0cbe2", "value": "T1E0D32905734C0847D2673EF43B3F27D193AFDA8222A4EA41254F9A8E9172E730589EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "58cad480-fbb1-4f82-819a-4552368ddb50", "value": "1536:iPaE8nkZCZxzKrdeV4KYmvAMgKZXbRzWhOb166qNq24CVz8IN1y:iCE8kZCZxKeuKMM0O4F8IXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193786, "uuid": "1aa8e50f-9b17-4cd4-b3dc-0da89122db34", "value": 131412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193786, "uuid": "dacba339-9159-460d-b274-d806073ebb23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193786, "uuid": "642a4ca8-4187-48f6-bec2-d8dffb9f642a", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cade10-0a09-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771117310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117310, "uuid": "6b9980e5-216e-4476-87db-de252c4b363c", "comment": "Malware payload (Mirai)", "value": "99f244b4b103ed5ee512fd3058d8cd2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117310, "uuid": "0d89662b-b7d7-4c90-bc40-4606c2fef257", "comment": "Malware payload (Mirai)", "value": "4eeeb2ebc9d6cb31eb72b1cf428698bf77e182bba6e1fb0ae9f293998f1f78a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117310, "uuid": "1d502e0f-c846-48e8-9adb-c8303a5e4c14", "comment": "Malware payload (Mirai)", "value": "48ff4b01dd668eed400461b3b2ddd718e37e689d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771117310, "uuid": "f707c308-7673-4a1d-bbd4-87125cf58d53", "comment": "Malware payload (Mirai)", "value": "889b2f4a17a53edac5678abcba9a5a8edf88e2a1eea43b7b526621f90bef69abd742c2567ce8133f0fb7dd2ddbf9a4a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117310, "uuid": "bf77bd7b-2192-43dc-bd0a-65fd98d479e9", "value": "T128930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117310, "uuid": "b77c792c-a779-420f-8593-e1893083ab48", "value": "1536:wqnZV8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yan:N8NUv5nTacgzafVAwe4BNRIbT2gX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771117310, "uuid": "1d3d3ca1-c00e-455d-9470-4011e318ab99", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771117310, "uuid": "081d2624-6a04-49bb-93ae-483ce054cf55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771117310, "uuid": "58b30d21-e716-4b4a-ad61-5fae7a0a030f", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb69da0-0aa8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771185284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185284, "uuid": "96c22beb-8052-4ae2-bf28-265e7d921a95", "comment": "Malware payload", "value": "dcf61b6d98cc8f8c59d622f27219e20e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185284, "uuid": "fdceb365-01c3-47f4-97fa-319bff8c8042", "comment": "Malware payload", "value": "51db00a07f92d39622967441eb67b1456f6fd4b7a2e7f6bbafd45aba19231b2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185284, "uuid": "cde6ac53-13b3-40e5-a1ee-1e2bf1c6615f", "comment": "Malware payload", "value": "24e13671a466559c351bdc9db284672756a00d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185284, "uuid": "46e5a7fa-4ac8-4f50-83aa-92657edea8e4", "comment": "Malware payload", "value": "9cb269fc42c894182b428012300474b170c673b607349268aedcf79eb5fab5c662b12a527a8d94646deb5fd1b258c10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185284, "uuid": "904f5aa4-419a-40af-86db-f8261c97d539", "value": "T12DC3F946FD418F13C6C321F7FBDE42983A166F6DD6FA32029925BFA037864D6093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185284, "uuid": "1cc3981d-02b0-479b-a994-0849608cc85c", "value": "1536:NGPpAsn9834k4VRKzTMw8nWEO21vK4o0X5kl46wywHQwmw1Qoos6L7E4v+tlv:MBtn9s4mzgwsVvoebw+tlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771185284, "uuid": "5ee01d40-d76d-43d2-a065-c9c5dbf487d5", "value": 126432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771185284, "uuid": "5d0133b9-c822-4c66-87e4-f85a8bbd69ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185284, "uuid": "66f20559-f03e-4d52-8cd4-9c08bf45e7dc", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f160a94d-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193775, "uuid": "2988131d-f454-457f-a578-b016de25d4c6", "comment": "Malware payload (Mirai)", "value": "4f6c7c26e1f0c457df6b97ec86b9fe74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193775, "uuid": "89d09234-f2a5-4a52-9107-dd4ac47c473d", "comment": "Malware payload (Mirai)", "value": "520e1e931a87fa4df3a7fa7698ac8d98725ccf17c9cc33fe1e1cfc3702faa39e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193775, "uuid": "8399bc42-9acd-4662-b74e-de59cb062adc", "comment": "Malware payload (Mirai)", "value": "8fa6d8fb8e51488446163d0a31552f4d54ec15da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193775, "uuid": "8d3f0724-cb72-47c0-8d2d-dc76f4a03527", "comment": "Malware payload (Mirai)", "value": "d47272a3d54f646f990c8878512fd022db98a33ff83e2e7ba1fb4db6272618f99cfcf1992f82785cdc5a773c621ac02c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193775, "uuid": "84cce87d-9cc5-4d3c-a97e-90c09f7edf82", "value": "T16523016CD08F0C56EAF6D5B528E547E1E7950F7C3AEAC1C32181BFA00352E5341A8F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193775, "uuid": "affe90c3-eec4-46bc-8cad-896681017928", "value": "768:xW0VVsNSR1kK61r1mcklV1qfnqfN5ydD2CpvtZZB1wobTGG5J4uVcqgw093:4S0/97kn1qrdaWtZZBLbTGGD4u+qgw0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193775, "uuid": "44f03128-8080-41cd-a28c-2d08668a5588", "value": 48124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193775, "uuid": "24b46da8-9efe-4490-8d2a-efcb2e16d558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193775, "uuid": "b4a5fe76-29da-4b3a-9ec3-c07dd3af3575", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fe3714-0aca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771199909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771199909, "uuid": "4556593f-0d7e-4aed-9317-b47c236a7b14", "comment": "Malware payload", "value": "a68b9bd5fa5702c121bcb68243113813", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771199909, "uuid": "5f9ac2c6-d5b4-44d3-b789-4cb39b5c47a0", "comment": "Malware payload", "value": "5414e0bc0edd5dfb010f1a8fc6dc1c9f5d2c9682f079506fc32bd255900cec08", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771199909, "uuid": "7fd70f14-590f-415e-995d-27bedb613826", "comment": "Malware payload", "value": "bd87bb63d5ddccc33dcd46ebad6a0e41fc7d54e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771199909, "uuid": "a47211b2-6abd-4f7a-8b40-a49550b1953b", "comment": "Malware payload", "value": "04d6caf651668b3bdd9e879100165cd8cc69603d8e41812e181d7125e36134ec1a5ed83d4afc80257b1fa733e1e1107f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771199909, "uuid": "8517cc7b-8544-4ae9-9f06-ee43f6897774", "value": "T15A442337AA0D943ED4DAE5B7B4D248E4DCFC742E037A3F2A8410A74A5531F6D9988E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771199909, "uuid": "ba4413b6-a34a-44c6-888d-0105eaa575b8", "value": "eb7aacb5575d7e2e3d2a3002627414c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771199909, "uuid": "7eb8ba08-b35e-4f66-87eb-2deb2260eaff", "value": "6144:ZrqdSiM6mO9IUHQ8KmPvrkyjPbFCUKelp7COb4Js9C:ZrqdSiMVKnw8brBPBd/Ci4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771199909, "uuid": "bf8e15b9-e313-41a3-a0f4-e55c756a4366", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771199909, "uuid": "b094b4ca-283d-484b-acf5-78748b504775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771199909, "uuid": "25ae2a0f-c54f-406a-ab2f-49520da1ec16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80f03a7-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150380, "uuid": "b6a99ab6-86f5-4256-85d5-77a7b0cc0c43", "comment": "Malware payload (Grandoreiro)", "value": "1f1e259e5653abe60fb490dfa18ec301", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150380, "uuid": "687b7e32-4bba-4148-9930-0968bf14bc02", "comment": "Malware payload (Grandoreiro)", "value": "55d2345930cc02fbefd239c9bbf06754c09272b43789b076a37bda43ac9e2219", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150380, "uuid": "afc77f28-310d-4e0b-8f75-a30162561e20", "comment": "Malware payload (Grandoreiro)", "value": "0969ea806285bee2113af313ade0f929ed1779c1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150380, "uuid": "26e84db2-554a-4ed9-a6de-64503baa6a26", "comment": "Malware payload (Grandoreiro)", "value": "02a788378c6fb858a1b4b13343ab979cf2e1d0f34dec70654bcbdb9cac859745a63b54cca5527038b15b0f98766c6ba1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150380, "uuid": "53c16556-105a-45fc-95ea-76e0c25cad3e", "value": "T1FB362330BD440D27C1848375B42F3E397E2D770785CF95E0A82DA29B7F829DA9A3E591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150380, "uuid": "4291a841-e1e4-42f9-a722-41351f044e64", "value": "49152:YwI0BM36rpubshBzBsIsU5u8tUIzF42RCzRlp/V2sayieErbZUt5E72:Q5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150380, "uuid": "a7d9ec27-3195-4f43-a2a4-cd771bcd6824", "value": 5040128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150380, "uuid": "9f1daf60-1526-4d82-a42d-94eceb1ee478", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150380, "uuid": "c3fcef1c-1078-462c-a86d-391069781257", "value": "PrdcIX0S2T_418311OQQVJ8T6XCkrrvb.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d59372d-0a06-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771115760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115760, "uuid": "d766e077-92d0-453a-bdd2-ec72d19ab9ac", "comment": "Malware payload (Joker)", "value": "406b1fe0daae945d5f7afc99a957b048", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115760, "uuid": "822b8f01-6019-470e-9291-4e3b6381329c", "comment": "Malware payload (Joker)", "value": "56d62f982b0cf0135ff1f0373a2cf72a87e976ad3f8c4783f3e1da4a72397c11", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115760, "uuid": "d03dd020-1eee-47a3-a8e1-ec3030677944", "comment": "Malware payload (Joker)", "value": "83c357999f6129ce1c020873797f0bb364022367", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115760, "uuid": "339a8ff7-9aec-4cf8-9f4f-a12f6947cd35", "comment": "Malware payload (Joker)", "value": "1cda4744a17d08ec0006b9eb8809472ec2dcb2e2dc0f2ea7659559b60d17bb212cb3dd4b8ef278f15b37cfa47572cf97", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115760, "uuid": "e9b962d6-2b68-4127-b72b-9a02edf00e12", "value": "T143D6239AEB2C902FDDFBA0364DB60721221B50978A43E7576914821C7ECB6C44F6EFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115760, "uuid": "44f75b04-b872-40a7-bb89-873245a9c467", "value": "196608:dy1SqZWqjOuBl7zGOZIm8lfQbPBD7hDbB6bnnvJp5zsRSbWr4ITXcg/P7CC9fO5P:wbBl7zG1mIfQbPV16BpxCCgF9uuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115760, "uuid": "fe3225b9-8663-4736-ae0e-e2f516f88b2b", "value": 13147730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115760, "uuid": "9494a434-6c0c-47e8-9624-6e9b92dad2b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115760, "uuid": "259264bf-0cc6-4ead-a771-97e969645cef", "value": "com.decned.budaiclean_1.06.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fe0dab-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193787, "uuid": "da85e0dd-8cd5-4538-bfe5-0d9f77b72cc0", "comment": "Malware payload (Mirai)", "value": "2020f9ff31c5bbe3817c842344ad5fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193787, "uuid": "6ff0440a-54da-4d7d-bf47-abc34f1eb0d4", "comment": "Malware payload (Mirai)", "value": "58ef677ddfe8c476f236176231880ec76c00f019a5bf3c85e4c7a60eb457cadb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193787, "uuid": "ef2a174a-3fd7-47ae-aeb9-6c83b4251358", "comment": "Malware payload (Mirai)", "value": "cc2b8e30e1bc9aca6c7b706529cceb43e0b62e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193787, "uuid": "6fefaff5-6533-43e8-ac6b-8d9f1c850806", "comment": "Malware payload (Mirai)", "value": "4e92867472cbef8d1245b234b2ad474017c5e98745aaf6d9d6fa91689094cc5893b4bbcf2ed59c58ba980b61921d8ed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193787, "uuid": "7cc51c3f-7c5e-4a14-a6b1-1d066b6c548c", "value": "T1EF03E11FF1E65819E02F20BA85DF69508919A60FCB5AC7B0B5D630AA2497FD4137C7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193787, "uuid": "cf8bbf83-f779-4011-a1c8-694261037b6a", "value": "768:yS2NnmEvRenE516Z4tN23Qx6lb9BO91+bBAfEFgtkW0OnbcuyD7UHQRjv:ylmEv8nEC4p6lbjOWsSynouy8HyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193787, "uuid": "e5ea426e-5e21-478e-b317-f5ffca9b8220", "value": 39260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193787, "uuid": "03cb7225-73dc-4976-9f24-a397136a1f1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193787, "uuid": "9b956248-cdb2-408e-ad1c-16f2a27a91bc", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf72ce3-0a75-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771163675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163675, "uuid": "551a53b0-46ef-456c-bef6-9ad827afb208", "comment": "Malware payload", "value": "91ca1464b6f3b823f785a9864f21dd70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163675, "uuid": "030c8e79-caf8-4cee-b336-8a13972ad1cd", "comment": "Malware payload", "value": "598f8eee7ec2822c9ebfcdd75debc7b014b19a70954e9d8e8767594a7d2d585e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163675, "uuid": "7be984c6-3fe0-4730-be80-4c9cd7a4a325", "comment": "Malware payload", "value": "3bed6bdba35bd13878d7d5bc119b436f3d56f779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163675, "uuid": "291a75dd-cc91-45dd-b72e-1fd2bb93326e", "comment": "Malware payload", "value": "08fe6c9df951919454ea131b977fe36652f454b1f3fba34b054fb04558f0cbb5e0040f75df5c7a74fee198411b1012b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163675, "uuid": "817ef7de-a1b9-4dc1-b0a3-36bc6513a47f", "value": "T12EB32B16B992CB11C5C211BAFA9E514933136FBCE3EE3202DD206FA467474EB0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163675, "uuid": "977c5846-35c9-4c02-9572-a1ad3681b423", "value": "3072:4z3aKMT94dcYOiwSbouaPwPfmgNChlquXd36Oj:eaKMTo9Oifb/aY3mKCh1cOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771163675, "uuid": "ec384bc9-0159-400b-bd37-88be41a21ab2", "value": 110724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771163675, "uuid": "39a4f345-e1de-4c31-9374-0dbb78671550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163675, "uuid": "a7e2992d-f29b-4499-a7b6-96decc95f7be", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb398925-0a76-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771164156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164156, "uuid": "0e1c213a-31ab-4efe-aa6a-160edbeda69f", "comment": "Malware payload (Mirai)", "value": "405ffb2f24887c14f96f3b67200a38ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164156, "uuid": "00e35e2b-85d9-4305-afdc-b9383b90f603", "comment": "Malware payload (Mirai)", "value": "5c999731aa9e0f72fd0a11434b6dd4d3a169ca83f02f930420dc6236bbb84f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164156, "uuid": "cf7f53db-b6ed-408f-a31b-10bf8ffb71dc", "comment": "Malware payload (Mirai)", "value": "745a8744329f8a8ec9bb65376e2bd25dacc40523", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164156, "uuid": "8b7519a4-13f8-44dc-aedb-00d1982889ac", "comment": "Malware payload (Mirai)", "value": "4f7ce3c02992e76a9fd5c4b6488a2a5933a5d90e447fb69a0db4297adef1f044b1ef33f5501a1abb3de2d8732d154073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164156, "uuid": "fe22df3e-c42a-40d9-8b4f-a48a5cd4fd81", "value": "T19183E68ABD815B1195D526BEFA6E408D33531B7CE3EE7112DE201F2463CAA2B0F77506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164156, "uuid": "01a2ddc7-52cf-4a62-b692-26b1df0d0ec7", "value": "1536:+Snd1MDiMUS9l3EVMgpOFnMRfG/7/0MJsDZYu4Y9YzngmNasoF7h1aVDVd2l2YiE:bqiy9qVvpOFnQfG/7/0VZYPY9On5NaBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771164156, "uuid": "4b2160b8-221c-48d6-a0bc-1d3e41bc7833", "value": 86880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771164156, "uuid": "adfb0a53-8796-4dd9-8d75-6377b5f84f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164156, "uuid": "2a02bf5c-c155-4a5a-b3cf-5aa564beb471", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b322e9f-0aac-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771187134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771187134, "uuid": "49e4c5d0-cb92-4f7c-9c77-4842153392d6", "comment": "Malware payload", "value": "d4ac4d684aca924c9d532c245c016c2a", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771187134, "uuid": "9e5671f4-db99-4cb2-9dcf-30e0d92fa3c3", "comment": "Malware payload", "value": "5cdfb23517d671d3b2c0535b23d80dbc8b053288e881b4f5eb2f1221f1e7a7fc", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771187134, "uuid": "88c102cc-1e45-425a-a007-1b7f9834fa51", "comment": "Malware payload", "value": "09a92d46171ab4e1ad66e2b3e55d852b136d8a48", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771187134, "uuid": "49d3cdd9-fb90-4812-9ea4-6b6e512fd263", "comment": "Malware payload", "value": "7f6fc88654eb83639897f064c20f3101bb6e7d471bb0563653135e5eaedd51496bde4581daa7e575c05ccb782d8c708f", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771187134, "uuid": "72d15244-1dfb-4a77-8633-6bf1606444e4", "value": "T13296339993B40CEAD877693F19A56153D3B1F42507A0C8CF1BA4832A2F9B2FA3C35355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771187134, "uuid": "e0aa8adf-c3f0-4628-b045-72219e758b8b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771187134, "uuid": "0defe80f-64e4-4a8a-8243-d434f9f05f1b", "value": "196608:roNnnBtbW897GXPHMe81SF2RPUewq97BtKZ2sHsMRqubRgFtDU:raB1wPsZg2KezxK4sHsMRqubYtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771187134, "uuid": "fa61a20a-2277-45ce-b422-e383abca5e4e", "value": 9385117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771187134, "uuid": "2517aec5-1d96-44f9-af22-ed60bad405c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771187134, "uuid": "a77e492a-f4f7-4014-a932-7e5b33a26d5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa0b60f-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120193, "uuid": "f95542da-2af2-4053-b795-bd57324764ee", "comment": "Malware payload (Mirai)", "value": "5c3552662fa2f3da43199d6c16ae61f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120193, "uuid": "bf5b7024-fc02-4cfc-8851-bbd24038a001", "comment": "Malware payload (Mirai)", "value": "5d5739f8042e3656e520866dd2226e0fcaacc6f38f284d5d7eb66d464d3ec35f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120193, "uuid": "bdfbed5e-6e7f-4e6c-879a-e55dc4ced070", "comment": "Malware payload (Mirai)", "value": "0b3bab5a3404416ae65e48c20287f35457ce3c9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120193, "uuid": "746bf5c2-ce7d-4612-b5c4-f4000d735963", "comment": "Malware payload (Mirai)", "value": "3b6ce855ab1348b2e79b44c93d795e8a69d38b11b0c6d7ba34d741df6376989a582111d2cccbb55aa263cf46218006b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120193, "uuid": "6a9e8046-5198-4b77-bd78-91bdd6dc70ab", "value": "T14573F842BA87CAF3D41704F041F7B63F8E31FD3A493285A9EB65BDA2DA235C16116358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120193, "uuid": "707b3da9-082c-4ecb-af08-5ca90d598a6b", "value": "1536:cfGl11IuDxOIX9GtkxBP4nIj33Dr3FPrCWD8ZM6iwHvbi3aGiE3uM+qA:YGl16uDx1XPBP4nIjntPXQZM6i2ji3X0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120193, "uuid": "a62dec0f-1ed2-4ebb-ac61-a05802740272", "value": 80392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120193, "uuid": "cb943cc6-9db7-469d-b047-23f53acff373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120193, "uuid": "afff0aab-78cf-4a50-873b-c9518144cfa7", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ef59dc-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150423, "uuid": "ace9e967-263b-4d78-b60d-dacb46b975bc", "comment": "Malware payload (Grandoreiro)", "value": "b2c072fcd11097ae15f2ded6022ca762", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150423, "uuid": "f44376fa-c1ad-4982-ba90-b2eb550c1094", "comment": "Malware payload (Grandoreiro)", "value": "5fbee33ec1439dae0062664f3e8874c3e45ede5b92cca47d34b6003cc08226e9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150423, "uuid": "7da4baa0-51f1-4425-a762-8ec1d3f81ad1", "comment": "Malware payload (Grandoreiro)", "value": "3a7347528baf61dd0c10d4d71a146f8376106309", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150423, "uuid": "52e06369-635c-4c2c-98f8-ec8b3659e385", "comment": "Malware payload (Grandoreiro)", "value": "89c6f09a4cb9a7b656ad5224a46e812e3b74f9b9620c9efdc85fad3bb2b71d1fd8c70d1a7979d9e43b35d0a55d8d273d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150423, "uuid": "edded974-cabf-4938-8907-86d542b35296", "value": "T1AA562372FE512D53C6904B32B03A3B387E7E32438ACDF9D264B965837B855C2193E916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150423, "uuid": "c4f21ef8-aa04-4167-965e-2bfeeae4b8c1", "value": "49152:cHOKtXP9oKq9usGNtabVyj/Q/Qt43Xyd4fd56Hn9RZHgLevIoubU1jhNNfgHU:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150423, "uuid": "1dedbdc2-b61a-4917-a013-c1ee3752b379", "value": 6205440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150423, "uuid": "7e11bb3b-4dcc-4e2a-a74f-bb3ec69ab746", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150423, "uuid": "b7fdd77e-6238-4809-bf28-ee403c3f2219", "value": "RegLI5UO0967-XYJXSZ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0133fe08-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193801, "uuid": "e4cf7348-94c0-42a4-8aba-ae20fea61348", "comment": "Malware payload (Mirai)", "value": "73d40b01525a88840ee90aac4c7996e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193801, "uuid": "8be1a653-6859-40b4-9a7b-c4698fba383b", "comment": "Malware payload (Mirai)", "value": "600faf848961f1fbf87550c34f63926ef63aa916c461a0be745edcc964314ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193801, "uuid": "200fe0f9-ad9f-4719-af92-1e17d7be3ce6", "comment": "Malware payload (Mirai)", "value": "ff414c85ae4d12637a64cee957d9fcae8d05ce48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193801, "uuid": "6de0cddb-72e3-4121-988a-4a1269eead42", "comment": "Malware payload (Mirai)", "value": "c3f68f70bf68ee66e35fa4cea5e766bf1c8222543f9e6841b3ed6df968719d08c458e98073cd55d6980037b0bb9b0548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193801, "uuid": "b7924092-152a-4d35-9576-c8308071a3ea", "value": "T18F73394AF793E4B1E90705B002EBEB794A34FD620520D95ADBA4FFF19E216C2714672C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193801, "uuid": "a0bba6f9-49e4-4dfd-8f33-9fcdecf4f0b6", "value": "1536:W1+KPEkB8poyhQwWeUg31MLZoomRfAqovwlfcmr:TyE48prfeaomR0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193801, "uuid": "09dd5be4-128c-4980-9d50-39c144b17039", "value": 74036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193801, "uuid": "035c63fb-7064-47e9-a3de-d57feb6db250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193801, "uuid": "4d402f50-d8f2-4644-b217-d2fbcea0bbd6", "value": "israel.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90e54e5-0a72-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771162407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162407, "uuid": "9724eb94-e421-48bd-a2e1-329b61f4cc3a", "comment": "Malware payload (Mirai)", "value": "39d4354044b368148dda0cebbb0e0166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162407, "uuid": "488ab140-fdbd-41fb-8043-45b57c7af817", "comment": "Malware payload (Mirai)", "value": "6070a0957b93f251ef52cddf519a3d69c603290720068f1592af6827148689e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162407, "uuid": "60544ed1-65db-4f26-8113-97e5c909218f", "comment": "Malware payload (Mirai)", "value": "e389cf609eef3b5828dcd7f12b21fe14d4ca7ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162407, "uuid": "afb555b5-c086-4eed-a49c-6cac5f1d9f87", "comment": "Malware payload (Mirai)", "value": "46799c7517f33b53d230c56d8a7c57a088d58d572b51d039b9446e6dfc055f5f0609dc9c9426909abeeba2ed6dcb6386", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162407, "uuid": "f87201a5-2f65-400d-9750-1fec7e0b6eb9", "value": "T1C804C70AAF520FFBD86BDD7302E90B1129CCB81B26B53B753174E924B60A58B59D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162407, "uuid": "6eeda073-f4f4-4424-a50f-32804a57d94a", "value": "1536:QA24hj4jSJR6aZ3buA5g6ctQka8b6LKfd9KgJzT2Z6okkpbwjfwpbNgPL2a3jy0v:+jSvp419KPRb8cgPR37Ki0Gld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162407, "uuid": "5e07826c-da92-4f13-98f9-cf020fccffe6", "value": 179060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162407, "uuid": "433c949b-8268-4360-8528-eeee0a796592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162407, "uuid": "1a14c2df-76b8-4ce1-8216-44bf9fd63d44", "value": "israel.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129e4817-0a07-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771116091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116091, "uuid": "48785ead-55c0-402b-820c-6b24d3ec1240", "comment": "Malware payload (Joker)", "value": "957403069007741a0391c4fd61f84691", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116091, "uuid": "1005c6c2-4eba-40ce-9421-280307e92f29", "comment": "Malware payload (Joker)", "value": "62a5c750548f1369120d5a5314ed325aa832f9b46140a5b71865d4a8bb6cea5a", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116091, "uuid": "c46e0f43-c449-405f-91ec-ed252ebb035d", "comment": "Malware payload (Joker)", "value": "253400ea61d757a41e677de95849f093613d5ca5", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116091, "uuid": "cfb42c11-a99a-4def-b47e-79a2208d8adc", "comment": "Malware payload (Joker)", "value": "8a3bffc593d45ae22979bdf4fa5a25d264ac67d637b5ce571a827d3d483aa8eae99c8fa365547c6fef45270698609994", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116091, "uuid": "3c6623d8-7cb5-45b3-a2b5-3f1b8e021f2a", "value": "T13647120AEB0DAD2BCEE7F4B98F7A82536129E4881280D7576815C11DBEC37C54F26BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116091, "uuid": "ab4923fb-52c1-4a4c-ab37-d15711006278", "value": "786432:H5svKk8lKAFgMyWDMUAPe4ZjjdOeESwlmzY:H5szfMnhEZO7lm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116091, "uuid": "738123ec-f117-4448-a850-1f3804f5b0d4", "value": 25666035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116091, "uuid": "94fa1193-8363-410e-bd2e-31f0797b265d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116091, "uuid": "c6cd2d41-c379-4bcd-bd03-cfb4080f2127", "value": "com.ricard.pyrrhic.cleaner_1.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2322a8a1-0a45-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771142748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771142748, "uuid": "62986c55-9cf7-4258-ae91-f72dcc5273a1", "comment": "Malware payload", "value": "9f550a681679875b46a68f816f5aeb88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771142748, "uuid": "42335234-2b68-48c4-a252-3ba7ed25c183", "comment": "Malware payload", "value": "632602482c4ff96d7b2b9bd9bc3e7fc553c9549d339aba0a59f1d7b1cc95dea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771142748, "uuid": "e1e36edb-8c5d-4b3b-a0e3-ca3fbec05499", "comment": "Malware payload", "value": "ec332021ff67b0cdd775314ad6528d5c270f9449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771142748, "uuid": "60553137-bd14-4ece-8f0c-03075ea13041", "comment": "Malware payload", "value": "77c601663243cf34a677c14fadbe35055e8210819b9e1662c793e4654e338dd1654f814dbd6d6f53bcfcba66e598c2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771142748, "uuid": "bd8b03f7-ab08-49cf-b3df-d48b120bdb71", "value": "T12E74F661ADBFB553D5CEF6347731A6D9302F7284D0E5A035CAE1CA9846F9BA48E13032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771142748, "uuid": "5baf065c-626b-412f-a0e3-82faf04387ba", "value": "6144:Sld0eWZ3XmYWpZPXVLQb28MHka4yegeNMok2/saPS/9HIUsirkh7p2GCDhGtRZE/:Sld0eWZ3vWpZPXBQSHka4yegeNMok2/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771142748, "uuid": "8247081b-bdaa-435c-a0e6-c6470b7a3b30", "value": 361740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771142748, "uuid": "89f8222e-c247-46b1-acff-749c32813987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771142748, "uuid": "3b8850a8-3657-42cd-a931-220cca4b4790", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fa702f-0a90-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771175133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175133, "uuid": "720b907a-ab72-443c-9ef5-efeb6819b6d0", "comment": "Malware payload (Mirai)", "value": "e3ff4f8ba9c3643ef4eb170c202f5d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175133, "uuid": "7019505c-c23a-40a5-8486-93aea1e3be27", "comment": "Malware payload (Mirai)", "value": "6585ea24e2c64da44c1a33dd7bb625cc8b5513dbc0e4e3f286903aa3d5f2267a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175133, "uuid": "394bbbc7-6bc8-40fe-a6d0-e8216197f8c6", "comment": "Malware payload (Mirai)", "value": "866a57128edcb0a3ca8a8c3d100c44377a7c7886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175133, "uuid": "9c575a27-fdef-4b03-ae17-2f0b49a92be7", "comment": "Malware payload (Mirai)", "value": "45fd89239859f76d8cbb4edc48a791434e294be670785c901e211b019245505ec153d25cf558b176885066dd1f69a599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175133, "uuid": "117c186a-7639-4268-a152-f7a9c3878443", "value": "T1F8B3D91E6E219FBEF359C23547B78A31A35833C626F1D685D26CE9051E6038E241FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175133, "uuid": "a74a8111-08ac-49b9-8ee8-68a23bd0e8c7", "value": "3072:gxuWkO/fUfJ+/NDnvTa14l2HTWgXVnTBnz3u:gxsaUx+lPayoTrXd93u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771175133, "uuid": "2e4c137e-8904-49ab-8926-d45f94bdb5c8", "value": 114072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771175133, "uuid": "6b8c9791-6872-440d-b621-02d532c9b08a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175133, "uuid": "fa562e11-cd79-4216-a4b1-a22eecc6f5b4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c6d6e5-0ac5-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771198053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198053, "uuid": "62e08ef1-d53c-4d8e-aec1-7ddaf9880260", "comment": "Malware payload (CoinMiner)", "value": "20a6ed775055079fee7b4ef38feb0953", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198053, "uuid": "0f88686c-1d52-4fee-8d1a-408bf343cd37", "comment": "Malware payload (CoinMiner)", "value": "661c4da0df6414e3cf7855d47a142cc9858c1174cc992f29423e48ce420585e0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198053, "uuid": "619684b1-e8a1-4a5e-8a00-191a1cfb1976", "comment": "Malware payload (CoinMiner)", "value": "7259f95f38eb75a041931987b4ddc085ec305c95", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198053, "uuid": "f0aad354-f592-4953-af86-c880c6d128da", "comment": "Malware payload (CoinMiner)", "value": "2cbc0027a9906942cb27ee7a9892657363234f1a12e2bd5d97cd58a78850e1627abd29fa6e323a3332266da307eacb8a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198053, "uuid": "431f684c-1df2-4437-92ff-afff25484419", "value": "T10BB6CF15A3A80071E477C630CAA68733CAB17D665B34C50F0699F2422F77E629F6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198053, "uuid": "4659d32c-afdb-4158-8021-7ac923b0389e", "value": "f9733d815c562b4051f00a897b1b84e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198053, "uuid": "56868cb3-427f-4ff9-8aee-767443d5ad85", "value": "196608:H5CVjjpa2WFV+UK+9Nn2/7pFVZsB/omyGVZqz2aXbNyTkrbmbU4:H54jcDFV9Nn2/7pFVZsB/ombVZZaXb4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771198053, "uuid": "3013005f-c1fa-4135-b3c6-ac35a48de24b", "value": 10593941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771198053, "uuid": "0fe87255-cbf8-49f6-adc8-58d37254a3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198053, "uuid": "805f86e0-7154-4da9-a95f-98eb8bac0e39", "value": "SecuriteInfo.com.Win64.MalwareX-gen.41796829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708e38e5-0a74-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771163064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163064, "uuid": "bd850c0d-3874-4a54-8174-25ed4fb61435", "comment": "Malware payload", "value": "f4b3124c92ed9d2c295daa38ce6f8437", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163064, "uuid": "0c972afb-8a28-4e94-bf6b-ca56bbd8a501", "comment": "Malware payload", "value": "68b1f532d9891795738336ee51f5f4eee8c6f2ec8e03980ef00f397828f3c120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163064, "uuid": "2f5440bd-8417-4624-81e5-3b6fb0505cfa", "comment": "Malware payload", "value": "7d8d2d083d1f321f910f3a51bfb39502f3aac8c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163064, "uuid": "647887d8-24e9-4dc5-a87d-5d3ef7518c32", "comment": "Malware payload", "value": "bb38c09c4ef45166aac6cc20615163e0375fea207e89c8eb4f94772cf26a5ab159760e5d970956fc79cd5e418b5d747a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163064, "uuid": "99a0a529-9063-4e9b-91ce-56be5e52cd00", "value": "T1FA93E74ABFB11EBBE4BFDD3309A60749389D560621B92F3A3674D81CF60A64B05D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163064, "uuid": "c2e95776-6c4f-4e59-92db-fedf99defd47", "value": "1536:RUu6oiTfFusg+n5/SGo7/GEz3C/0khqZYCJlbps81GMH9+LTlJBeZfqFX39wu7rV:RGD2/GNTBNFdEjeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771163064, "uuid": "2ec091b8-55d7-4c18-b2ed-1ef42c6499ea", "value": 89812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771163064, "uuid": "d13aef72-eef9-4458-9fe4-f8eed2e94c41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163064, "uuid": "350411bd-e042-4b40-8dda-7da7b0ff4338", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a09b25-0a73-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771162702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162702, "uuid": "b4096a9f-694f-40db-baaa-d50053fdef06", "comment": "Malware payload", "value": "238ada9fcf33267c42b21c0928265ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162702, "uuid": "23687569-f7ac-46a0-a5c4-066fcc21ac22", "comment": "Malware payload", "value": "68ecdd1eb9ab0caff1227717b21508d64db456aeebd7552f6efc515ead7876c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162702, "uuid": "ea810e31-4d41-4650-b1b8-4e9f1531d9ac", "comment": "Malware payload", "value": "e5db65665119e150742d4cfdb7b8234c445a4047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162702, "uuid": "b4c5c596-584c-4985-a3d5-3c25985fe824", "comment": "Malware payload", "value": "2600ab0404b9e966dd976e1d1e06df9ec4d9d2f2d327b709276bed14eca19a4b3b446b6adece869b774951eaa79a8dc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162702, "uuid": "17904c18-1bbe-4e23-bbb5-e1b0c12fdd48", "value": "T10ED47D9CFE5E3C42E2D7E2789E4987E1732771E4D32391A33982434CD5CA9E98BB1512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162702, "uuid": "3ce4dd1c-66a4-492e-a13c-cc37ae602c81", "value": "12288:M9Itm6ipPtRMBM9LC3szgPKczh0E/3lFHAayaxDNw5nzUwRo:pYhpPtRy8zgPzzhl/JzI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162702, "uuid": "42ca8576-82f5-48b4-ac4a-e977d07a06ec", "value": 653472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162702, "uuid": "5f0c2314-b5e8-4cc7-824e-bab621e832f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162702, "uuid": "bda9ee62-a810-4227-8606-56e8ac593e65", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91c0d6c-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159374, "uuid": "608195b4-563a-41ca-a368-1400578e73cb", "comment": "Malware payload (Mirai)", "value": "a115767a73327e203b11255e19510c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159374, "uuid": "3332b594-17b8-4db5-b45e-31fc9122475f", "comment": "Malware payload (Mirai)", "value": "693ec4a5a2bb0b80b88944826aa8af233f2146e4f740ba0b8c5b8f8a8c258224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159374, "uuid": "2f1cbea7-9987-4cd5-99cf-8d7cac9bc08a", "comment": "Malware payload (Mirai)", "value": "9abfdc9a1c0dc5171b785289516c5c2abbeb2a6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159374, "uuid": "4171f3d7-93a7-49fa-8ff7-653163da83d3", "comment": "Malware payload (Mirai)", "value": "8472f5c6b6146e2c27ecbb4bfd4bbdef25057fcb8741cc2c29818a8c2a0833cf165ff8312b33a1ba86f933e2fd7bc03e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159374, "uuid": "8a6b0df9-69ae-4811-a3c1-c15b67a2f001", "value": "T152A3299ABCC5C702C9E061B6FB1E51CD371643B8E3E6B107CD19AB29674B89B0E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159374, "uuid": "42c72136-dd9e-4c45-bbc4-f4a0ed86412f", "value": "1536:45heWMz4vfXk3dSwHr4gSWJCiZg1YflbamPQrSqh5RbYTBQ+Mmv:45hedVNSB1WfZgOflbamPeSqh5FY9mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159374, "uuid": "9b6fb3ef-0ff1-451d-bcf3-3e09d65dd443", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159374, "uuid": "20e640df-041b-4d4d-bb2a-9867a957f9ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159374, "uuid": "db915bae-e466-4ef2-9984-3c6d6d4c372a", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1c0963-0a07-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771116297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116297, "uuid": "a9640f25-64d3-4f91-83be-a9dd804347ef", "comment": "Malware payload", "value": "f0105a03b3963300cdd77966c108e7c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116297, "uuid": "e5dcc102-60df-4f42-bd73-47048deb45f0", "comment": "Malware payload", "value": "6aacf7be1802b6a7d7d9c8c2cd42a5f20ae72a2214dbcd55f9873c953de0f005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116297, "uuid": "d1e2efc1-622e-43a6-9980-d162134b3977", "comment": "Malware payload", "value": "f5158e1e3b05b045a62abc9cd22124064b910fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116297, "uuid": "ccfb7a05-7890-4e90-be13-ddca3344f33e", "comment": "Malware payload", "value": "4baef239ecc52c7a71a9d78b391c6cc91b98c3c83b984b89291b9aa8f939a13a7d9a7cd00b5fec7552d97228ca811f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116297, "uuid": "d6f2a3d2-4a60-4a45-900e-0f26b3d7e295", "value": "T15EF43377DF078F63CE0B13F5D548646C3170BBA5D25DF86E2B500FE66A092062EAE544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116297, "uuid": "a79f837d-3151-4745-8177-ad5e6a4f5fe1", "value": "12288:cFh82akv38Q8lRZ8Cf7Chg/HGvLcxKu3ArleIBnOwKWEIRwz/f6znWJVI2:Ah5aS/EZ8Cfs8HELLualLI8EI2bsCO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116297, "uuid": "e8e58a9c-ca35-455a-80c1-39b60c77a64d", "value": 777309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116297, "uuid": "3188bb50-f1da-40cf-962b-1ad3b946d85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116297, "uuid": "b3fb2bf0-c4f4-4a82-961d-5421e69e4c01", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36954deb-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771159101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159101, "uuid": "e044e4a5-f146-42f0-8c30-421fab3690dc", "comment": "Malware payload", "value": "cfef123d7ff6870d2462bcc087d29141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159101, "uuid": "f25a709c-04d9-4cb6-90f2-b24bb607c24f", "comment": "Malware payload", "value": "6c6db7fabf43b3b7d926414342072db1cfeb9596c62c9448a1ad38c3ab991ca4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159101, "uuid": "e995ed1a-61ff-4cfa-96cf-e2ab7344f1ea", "comment": "Malware payload", "value": "91d0eaa02e691efea7d2cb35d2d09eecc441457c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159101, "uuid": "fcfc1990-0b57-4625-9385-fd7ec0f2e928", "comment": "Malware payload", "value": "656babf6a9b5d38663ce877579110fce415eaaacdee949bf21d33876aac29d257cbc32adece4012aaf0a04d2eca86a29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159101, "uuid": "13a4cf5e-0cd4-44d4-bdfe-8f974afc257d", "value": "T14D056C1BB2B374FDC557C43443ABCAB2A935B43902226E7B65C8D6303E16E701B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159101, "uuid": "aa58ac66-4627-4d33-8490-7951dcb940fd", "value": "12288:xflgkQCpfI4sE0D/PkxPrgztim+vyEvuhnrt2L7Vwb79bzhlldzuFz+Jyk/lqS48:tlDnQ4snkxPrgpGqE2hrt+u9BbB4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159101, "uuid": "656a428a-3dac-485a-a486-63a5cbf72094", "value": 850568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159101, "uuid": "93803f48-d4d8-4fdd-8490-7d945b0560ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159101, "uuid": "ad507967-c1c6-4884-b65a-1659ce194c57", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a262286d-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120198, "uuid": "fa72af1a-d156-4aca-a0ce-ad3c8ef6654a", "comment": "Malware payload (Mirai)", "value": "077f08674579668b8f57a7608594f46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120198, "uuid": "562a0e94-16d7-4650-a534-46a471690c53", "comment": "Malware payload (Mirai)", "value": "6d03ef912a5d17f4e794fc3bbf8c759f154693927b97908049d45c213712403a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120198, "uuid": "0bf7163a-8740-40c5-b0e9-0994ba845218", "comment": "Malware payload (Mirai)", "value": "0863c9599dfb9d2d69db44767a950fe6c6f2a518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120198, "uuid": "c3f61524-3e6c-4680-80de-984e7d390aa5", "comment": "Malware payload (Mirai)", "value": "3faf36ef0f311c7ad4d25581fce1d7869b0c855f19d5b861acfd8e4989a94441e0c22c6e45eea1558fa1593b9159911a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120198, "uuid": "f47cd1be-454b-4075-beec-ebeaeb5f3c3b", "value": "T1C0C3B81E6E21CFBEF65A827407F78E31965877D72AE1C585E16CEA400F502CD241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120198, "uuid": "88992590-2cb4-4417-8a86-c97e178af11d", "value": "1536:Nw4lPfv7d7Y/YL8dM416VcwS4ziMN/DIs1ISWlaH6efNHDhLA:blPfDdM3dM4qcwS4vN/DIsC8HDhLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120198, "uuid": "c8ebb1c4-1a0e-44e0-a5f6-7736365950bf", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120198, "uuid": "0189c2f5-85cc-41a5-b531-29f208d05023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120198, "uuid": "ab28a0d5-099f-4f50-a228-ba4d13dd61c3", "value": "manji.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b614b5-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120197, "uuid": "ee1b85fe-221c-4a88-996e-3c7494c3c46b", "comment": "Malware payload (Mirai)", "value": "86145c4aa18c7ed65399c14758fc8f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120197, "uuid": "9017964e-a2f3-4c66-be2e-b4707eacd8d9", "comment": "Malware payload (Mirai)", "value": "6d8775bdc307130bd36e7cbaf2776a48b19d2c8d5534e9826d7abe75e9bd737b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120197, "uuid": "08f7efe3-ff04-4699-8dd5-3ef322024425", "comment": "Malware payload (Mirai)", "value": "c10004b755822bffbcf629f841286d29805cec85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120197, "uuid": "fae50437-c05a-4780-8a9d-4d679d6a0c19", "comment": "Malware payload (Mirai)", "value": "d3cf7b7413b7b0ba3892e307c87cefdcdad87c54bf403c73b983963f35cc9c5dc972bac10f2946f8939673ce629b7db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120197, "uuid": "0f68088d-a869-4b50-a5cb-0b0093790360", "value": "T1EF932845E393E5F1D80705B001ABF77A4930FD331624D96ADBA4FFE2AE315C2A196329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120197, "uuid": "112a7338-2b08-4f62-b059-f15926340b3a", "value": "1536:NJaUfdQD/bb2sxL9I3eQYmUi3100x7u/o1rOgLMRYrI:NJNYn2SxIL6kp4g4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120197, "uuid": "d3ffa1ff-5503-4c72-a2b0-b191c60714f3", "value": 90476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120197, "uuid": "b223da39-7c81-4cf9-97b3-42c108a05040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120197, "uuid": "4c8cf0cd-f1f0-44be-98a1-666d7bfc9690", "value": "manji.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2dedd2-0a7b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771166248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771166248, "uuid": "d9e3ae6d-acd8-444a-96af-dd5d8e3d980a", "comment": "Malware payload (Mirai)", "value": "7b4226d4a8325bcdd24c05ac1892c015", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771166248, "uuid": "238d9f28-e015-4d79-ac4a-5390366edbcd", "comment": "Malware payload (Mirai)", "value": "72900668fde35494bd8b6e6e26e2f7903dc17e2087906658d408b0f672752771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771166248, "uuid": "782b92a8-8ea0-4720-b401-e8c0fc47c9a9", "comment": "Malware payload (Mirai)", "value": "a2d084877dd80474844e99e293e00791a1b19be4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771166248, "uuid": "5fb6c82e-9d7f-4df7-acb6-81f52d50111c", "comment": "Malware payload (Mirai)", "value": "c235fd7ada927eb2e0896e3c8e63cd6890d0c8779a24ec1550cf9a36f6767e654b2215a670dcbad8c16eb422250de3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771166248, "uuid": "a53882aa-4fdc-4783-9578-c2f2354eac8c", "value": "T12FD3E846BD518F13C6C321F7FBDE429C3A166F6DD6EA3202A921BFA137864D60D36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771166248, "uuid": "78329e49-1bae-4bac-b902-898dfef58bd7", "value": "3072:i6jnpcsqT/QyISTzxP9ASKHQ0AXBViyzJq:vKlz1P9ANH9AxViyzJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771166248, "uuid": "2f770c89-45c2-409b-9954-8fdbf0504a1b", "value": 135016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771166248, "uuid": "450e68b7-69e4-41f2-a31e-2847e71d78be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771166248, "uuid": "3ade77d8-fb50-4019-b57f-427801140784", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db78e17b-0a74-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771163243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163243, "uuid": "58dabf70-62ee-4a4a-a562-4a687a0d4483", "comment": "Malware payload", "value": "a07b9a4bf7ada69a2665f8362ec16215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163243, "uuid": "117cf66c-4bd2-4a2f-94c3-bcc55a12450b", "comment": "Malware payload", "value": "72d8a99f5c4753b3941159a545bbd4e5a0912919b9b829b791af6177095f2c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163243, "uuid": "d131b124-56ce-42e0-a90a-a2a7c4131172", "comment": "Malware payload", "value": "e18e989b89d92fb74864933eb06914fd62808585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163243, "uuid": "1606c20e-dd4b-4e95-94c0-4381eecdc184", "comment": "Malware payload", "value": "1fcb52e26bc4bafe1da0cbe89217d84bce1ff5574d23046c20e9e669df0a58cb58bfa135076f02020815e1d7a61034fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163243, "uuid": "e21e5aee-303d-4712-9a64-d74cb996d39c", "value": "T1DB3533712707C7728EB1A735B8C4D8445EB94239317936C2D5702DE0F7ABAB8E7186E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163243, "uuid": "d097db6d-594e-4ebd-bf4b-f145a989cb5d", "value": "24576:eWN5Ba1c/XeF1CLTyGbR+iFkVvE9PyGN93yer3sZ/3S7dYNBgdDd:FNfel2wifAGbiHGdCeDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771163243, "uuid": "11b91e1a-6b16-4da1-a8d3-efa9c66e9cac", "value": 1064271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771163243, "uuid": "76bfdd49-5102-4239-8f54-665e839c1ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163243, "uuid": "5883cc0b-45e9-4642-affe-c177115ec274", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1928e495-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150462, "uuid": "49ee466b-4925-4c6d-b589-f9d010aec52e", "comment": "Malware payload (Grandoreiro)", "value": "eb511a65d5d9dc37c65eefd950bf4b75", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150462, "uuid": "cca01596-41a4-4bcb-8227-cfdc659369e8", "comment": "Malware payload (Grandoreiro)", "value": "7519b1af4d9f7e39c5bd26ef6e749a52e0cf8c48c18e7cc89bf405d869d1fada", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150462, "uuid": "3cb88547-3016-497d-b79a-82d240599efb", "comment": "Malware payload (Grandoreiro)", "value": "08f88bcac3e8ab6fa934599058b4f5342ed99ea6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150462, "uuid": "18b1dbaa-a9ad-459b-a314-7ccd8f4d74aa", "comment": "Malware payload (Grandoreiro)", "value": "5ccf8a6281db8ef2eb22e1616f458329b881d56b72ead650ade3def5a5e750b2de8f5ae9fb08e6efddfa047ef0a60bb0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150462, "uuid": "09b1a1b7-177f-4d69-958c-50a9b780b725", "value": "T15826233AA904495BC84087B2793E3A361F3D731707C805D368AC9657378BDDA9B3F896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150462, "uuid": "b711df03-d5be-4286-aaf6-5cb61004fa2a", "value": "49152:oF+HhK0OAD05UBT0rHqr42CKBFt36x1XVR2QgmnLo2G7kGx:A6ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150462, "uuid": "5bff6a6f-ad1d-4bcc-b9d9-09de061e9034", "value": 4595712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150462, "uuid": "956400d0-8a47-478e-b5a4-2f3558cf0271", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150462, "uuid": "5634a2d5-67d8-448f-94c0-f44dc9744c84", "value": "RctfQHVO7039KLCT_55712.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c3232c-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120210, "uuid": "60081251-638b-4864-a467-35fa48ae8845", "comment": "Malware payload (Mirai)", "value": "64b931a464927a76136378e46cfe676b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120210, "uuid": "64412207-19f5-4ff5-b3fa-c5dd3d3f49ff", "comment": "Malware payload (Mirai)", "value": "77f0080e8391808c1092964e9e6780bcbbbc9b00ff80bf8d2d3e450db203f9a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120210, "uuid": "4c7ebc1d-2413-4466-9446-25442b830d6c", "comment": "Malware payload (Mirai)", "value": "cd61806afb13cacc6557b6d90e02d174f96b54c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120210, "uuid": "9bc17e13-66f3-47cc-aa32-c622afb952dc", "comment": "Malware payload (Mirai)", "value": "8caf2727abd5e72c78dd2adbd45133b5e490b4d42e17294b32ae1839af2df9079da1ce0aafcb0fee33fb24c2225c5102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120210, "uuid": "aae170a7-702e-434f-938e-83ddf2a3fb83", "value": "T12983190377094F03C16329F026BB1BF097EABDA119B5B584752EBEC59271EF22181F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120210, "uuid": "c01a7e9d-a5f3-4dd6-8f1d-9fb70bf98fcd", "value": "1536:tL79gT+wtHfOoGtQZ1duycy4ze2iKjqgCamJax32aMAEaLsp6uR:tqfWoGC7uVWim/a/huR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120210, "uuid": "635361b9-e335-4aea-87eb-72d574e9b70a", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120210, "uuid": "8d9cacb7-015a-4d25-a4d3-4b42db17c55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120210, "uuid": "ad274938-c7fc-45f2-9c24-9ff2ad34fa08", "value": "manji.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dd41c1-0a6d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159907, "uuid": "9172daf4-70df-422a-b24a-f6cbededa38c", "comment": "Malware payload (Mirai)", "value": "68458699e22d3cd6dd6920a8cd69c6eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159907, "uuid": "e5457797-bfcf-4d49-8fbd-813ffbc6c800", "comment": "Malware payload (Mirai)", "value": "7b1ce96b6087fc5c227f5963c15a6e421dd43c70faea6aabf63507d4a6579daa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159907, "uuid": "842ffda7-3ceb-4bf3-9a45-e02c37a1d75b", "comment": "Malware payload (Mirai)", "value": "fd3d23103c9b3ddb00e9fb5d59abdcaf0abe690c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159907, "uuid": "d2e7dceb-a9bc-449b-8c6d-9342a22c9692", "comment": "Malware payload (Mirai)", "value": "472e9ce0cfc945abe61121fc5e460830bc57759ce10c2dd60792837ef64a4217db710d8bfa6355f299b0621a6ab99430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159907, "uuid": "4f8ee65a-1f52-4452-9f99-c5d74659ce6f", "value": "T154833B85B941A626C7C146BBFF2F018D371587D8E2DA3303CD291BA0778B96B0E27756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159907, "uuid": "a9e66541-440b-4487-b5fb-ee9b950ad591", "value": "1536:tU6fchUtqY7BYV9TzU6Yat5Xl4dhQlbzt8t4lt5rY4kSd8MO/Wy7GbwvQnzK:tU4cqtM9fUmQubzt8435rY4kU1Y7QnzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159907, "uuid": "ad97b979-d7aa-47d8-aa0a-e1d436117978", "value": 84748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159907, "uuid": "bd82f949-17ac-46b5-986b-f744c8faf73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159907, "uuid": "9278fadc-6b34-4f64-bfb4-f31d34179152", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c659992-0a9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771181418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181418, "uuid": "69095396-04b8-4978-b282-2492b257a5f1", "comment": "Malware payload (Mirai)", "value": "d8c2199105e3726f4f43f6b31bc98085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181418, "uuid": "44104387-234e-4d05-92ce-b037d5ae9db3", "comment": "Malware payload (Mirai)", "value": "7b4fb33ebd901223b53cdcc7ccd6e2b83e26a10fa5c40626a3497ad841482dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181418, "uuid": "e6b129e2-03d0-4815-871a-87c6ac2924d2", "comment": "Malware payload (Mirai)", "value": "e8f0c69d0feb83f0e87caeb61f9b48b53033223b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771181418, "uuid": "a7889013-c3da-4d31-9bbc-3c0956e4b647", "comment": "Malware payload (Mirai)", "value": "5de68ed62535110cbb85c7d117b1e1d20d5c263918392970ebd7228862ae42f914d046ccceaef52f86a3662b877c6b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181418, "uuid": "07c91deb-9466-44a9-81ca-d90834e433e1", "value": "T174D3D706AF650FBBDC6FDC7706E90B0235CCA85B15A53B757534E868B60A1CB0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181418, "uuid": "f4935760-cd86-4edf-a0cf-200d0ef9c8bf", "value": "1536:DR2V0MPdsq3aYBf/C2Gv0OSkrSbYsnjtpnj93S4XugsrXRKZ1ZKSUkp0dzXwm+zs:FisHg3CFskrSb1tug11YKffSPPh86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771181418, "uuid": "15700f6f-d5c3-4a39-b8fb-f1db34dfeb50", "value": 135900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771181418, "uuid": "009420cd-3ab4-4d9f-b82e-605181dac099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771181418, "uuid": "233faf71-3f0c-4006-9faa-dd98a4a5daf0", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d65ad9-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771159286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159286, "uuid": "b1a59034-dc4d-4c5a-acdf-8d2220a82afb", "comment": "Malware payload", "value": "2c9fc6860578acf1c6e8d0f391f49825", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159286, "uuid": "7ffd704f-a747-40c6-badd-7da0077ec20d", "comment": "Malware payload", "value": "7b86f1e1139d7f15e0163c1b1a96bceff557613454a1cead677b28f922370956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159286, "uuid": "e738015e-9c6c-4b66-9a42-285f6adf55bd", "comment": "Malware payload", "value": "d2193f43f21e5223406559146f362109169a568a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159286, "uuid": "8f7668b3-936b-45a2-8256-130eed0bbf99", "comment": "Malware payload", "value": "4c1c0122d791cc6f7e7f756b409a4a21f7efb2da3adae09e0e1811d94409e0d10877146e7f2589d908833662cbbcf89c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159286, "uuid": "f98e4580-786d-4827-80ce-5d40bf594739", "value": "T129A31A56BD428F13C5C265F7F7AE02483B126BBCD6EA3142ED247FA127874DA0E27611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159286, "uuid": "2a311d9f-3964-4647-a7d3-2b7a6d333067", "value": "1536:lojQp4FlyVLkKgEdkaN87+RvidFlXCwfEKnwVxZOa5f1Xttlc1BEkTSf1O:AqclyeATN8qi3VCwfEKqbZJz1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159286, "uuid": "b64abaa5-9d81-4ee1-8c87-89f1ba079e07", "value": 102800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159286, "uuid": "335c2e1c-0358-4b08-9055-ebc3e65608f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159286, "uuid": "a7c4cfd5-a937-4294-839f-d9577f5c7cc5", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac815e1e-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771118068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118068, "uuid": "11da94af-d10e-49dd-8076-d7bc14e62da8", "comment": "Malware payload (Mirai)", "value": "28b9952a440f9aef55c4d8cf68748a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118068, "uuid": "15570aae-1b46-431a-91bb-53ed3169d577", "comment": "Malware payload (Mirai)", "value": "7c83211d24fdb1b813f17067a44ef5880194c042d2547d61febeea8a9531e845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118068, "uuid": "6530bdd8-0eda-47ad-bbbe-30c8c7edd1da", "comment": "Malware payload (Mirai)", "value": "56131b80bb48e898295bbf2980c8546f79c33b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118068, "uuid": "172386bf-1538-4dd6-8815-6356b489e871", "comment": "Malware payload (Mirai)", "value": "c87760cfa2475a6e287b3cdb12200a21803b4bb7d9891c8efe5bc89667ccd824bb2314aa2b5ea95f587522ef5a4091c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118068, "uuid": "da6d7457-26a4-4170-8219-df2db928f960", "value": "T184333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118068, "uuid": "ccf19e5a-5504-4ea0-a144-cea21adf82da", "value": "768:cwzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV980N+s:cwdt3SpOzwLMU431ANA0BLBC4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118068, "uuid": "9fcabb6f-c0a5-4335-8c8d-47dca780dac4", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118068, "uuid": "777b4d5f-c33c-46ba-9a57-9125d6dbf153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118068, "uuid": "7e5e2b93-ce2d-4012-8224-64964d074a56", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10505cf3-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150447, "uuid": "49adf9a9-3010-4880-b5e6-4c38182fc015", "comment": "Malware payload (Grandoreiro)", "value": "b61bae1fb798358e52546c81785641b6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150447, "uuid": "815a5a0b-43dd-4903-830a-391f9615e9f4", "comment": "Malware payload (Grandoreiro)", "value": "7d2470fb608d7d106508fec28f1c8a865f0121845992e3c7691266fb0e9d034c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150447, "uuid": "bf51576f-b917-45d0-bf78-0cce00a4be96", "comment": "Malware payload (Grandoreiro)", "value": "311bf0a17b05a8e334578c6d717d6c93ef925c89", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150447, "uuid": "540da598-30e6-4aad-9531-c00193ee050c", "comment": "Malware payload (Grandoreiro)", "value": "2535d7fa670f51a7b1accc3ea98ebfee10a5707c703a57e98c11731c982681c43171920b89d767acf0bb78f578871d5f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150447, "uuid": "bb94fcb8-a19c-4878-8091-c6b8f701ffdb", "value": "T11D8633317D59887FC5984735B0AF2B296E7C5A034B88DDE378AC71832799BC1A23F056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150447, "uuid": "ee729947-45a8-4a01-a179-90487b97d506", "value": "49152:uE02vH+6zH1o5c2w3Rc6yb0nyNXF0AMbE8URqZGBW/yBUQuhXMQBx8nkPventFxb:mker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150447, "uuid": "1de1c3f6-9039-4cd4-ae55-07a316ae5fd5", "value": 8017920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150447, "uuid": "020255df-564c-4920-8454-589e465a2aa2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150447, "uuid": "c146cb9d-4abb-4a18-b4d7-5f449692bdde", "value": "RctfHIFGUG473070I5DKC_201027.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a528a6-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150372, "uuid": "585f881d-caf0-481a-9991-ddefbc23b97b", "comment": "Malware payload (Grandoreiro)", "value": "52f962f9ca69b8480896dd10c2959425", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150372, "uuid": "5983827b-6012-4a22-a631-9044736448e0", "comment": "Malware payload (Grandoreiro)", "value": "7d3d19efcd26e0c3a08c32dece8f21146ec2d6d129c14fe4b17c403990b35684", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150372, "uuid": "82246cb8-61a2-471f-ac33-b37b832ffda9", "comment": "Malware payload (Grandoreiro)", "value": "661d27dcd61c75355c76c7d486020ee6ab4377d4", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150372, "uuid": "66766fce-0f68-4fac-9eef-31b1ea3a8d1f", "comment": "Malware payload (Grandoreiro)", "value": "b46fd3dd19cdb91c6653c71d858fcb0f5cd8847382aa94e467bfd1f82f6c9eb82ba871277454a1ad065bca8d8553e55d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150372, "uuid": "9df778ea-98f9-4585-80d7-cf035776ff92", "value": "T15F562332FE412C97C9944772B03E3B31AE3D764345CEA688F85DA2967347AE3662DC50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150372, "uuid": "e22c0ab1-071e-4704-9cc4-aee52f8f1154", "value": "49152:Ev91sDaCTV2pfGh6VYHCkvht0bjufr2e7dhUyNFlHRrLwjZFcdLuA+2GLRDbEoo8:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150372, "uuid": "75c41722-207c-4e6e-a92b-b108afb7d2f6", "value": 6006784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150372, "uuid": "12bc8a20-cd3b-498d-93ee-5c36827b8203", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150372, "uuid": "2f51cba1-22d3-45c5-9b56-7910e332b2c7", "value": "Reglm17046642M-OBQBH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6202009c-0a72-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771162181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162181, "uuid": "a4f24ce2-5033-487b-8e44-febb4bac9be1", "comment": "Malware payload (Mirai)", "value": "f4bf3d66ff3a053ec170dc96dd0501ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162181, "uuid": "23285679-c86d-46f8-aaeb-0d0d94dc74fe", "comment": "Malware payload (Mirai)", "value": "7ecf6ab0e161520f2359ccd1519077bcd50c640b9d682c3ecb68afa87fd022b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162181, "uuid": "a8b6897e-f6c2-4ea1-ae4c-ccb8b96c8fbd", "comment": "Malware payload (Mirai)", "value": "5f66331b387f5a2c1a2d6e9679afe3f5091e8475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162181, "uuid": "36936984-15c6-4e84-9c97-d9279cd4ea24", "comment": "Malware payload (Mirai)", "value": "a73e5f4eb809853831de2388b7fefd6f620f1ab038570be09a88437459ee88fd855208e75a07260af865be23fc96a3cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162181, "uuid": "01916745-08d2-4272-8505-06317065ae80", "value": "T165F307C7F901DEBBF40BE37644A308157530FFA609921A73722779AADA3A0D41467F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162181, "uuid": "56e290ca-2a1e-4b6e-b93b-98dabeef00fa", "value": "3072:H5n22nt/Y7GaGeSWypTGmJFKgrWgnb46JmbrwVjjbiDLAkixvI:x22nJY7ZRypKmJFtrvNmbr3Lf2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162181, "uuid": "821616a6-2d95-4422-87ed-b7b1219210ad", "value": 157384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162181, "uuid": "c5008ac9-8b8a-4ae6-b1f7-d2e0d2a3253a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162181, "uuid": "9ffe360d-77ff-49a2-9a49-757ddbee433f", "value": "israel.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5398ae-0aa9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771185924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185924, "uuid": "0b09220a-35aa-4ff4-9ead-3569dba244e6", "comment": "Malware payload", "value": "a2bd65e78324a5be5ab14353afe70820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185924, "uuid": "c6c5e12d-0157-43de-8b47-7bef9339ae3f", "comment": "Malware payload", "value": "8439c0c3038d03dea121b8cd41ceb2b6c8556ad96891cf418827b741b4020123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185924, "uuid": "f3d0b0ec-dbe1-4ed9-907c-be5ed092b3a3", "comment": "Malware payload", "value": "9f981db73f10e480ed18a385e5f7cf9da5bb2274", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185924, "uuid": "86979fbb-7959-4ef0-8b3d-dd3384ef57bd", "comment": "Malware payload", "value": "ae74dc905a154e1b1b9466d957fbb796e4e73fc2d3e484c871ae534159e7d40ec54dc8ec49fafdb1bcfbf320af2dc8ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185924, "uuid": "ec1f83e3-8cb9-4c7e-a1fb-348883f2405b", "value": "T14AC3E846FD418F13C5C321F7FBDE42987A166F6DD6FA3202A925BFA027864D60E36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185924, "uuid": "3b0f4082-0c4b-48a6-92b3-2bf426e82a3c", "value": "1536:MstIbAPj8a2q4VFJ1T9ByWqfanO92BHbXVmKM/0lxwwywBgJVrxYxnXhx1ZGQ8Jv:MAIkPjt4J1LvO87l3Mhcv8Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771185924, "uuid": "9d1b6128-9639-4e40-8d71-3263e9792fbc", "value": 122336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771185924, "uuid": "cbc9819e-bd5f-47ef-bbc3-7f4bcce5f4de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185924, "uuid": "dcb1411c-98da-4b63-a0d9-3b21c6228e6b", "value": "israel.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32911268-0a72-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771162101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162101, "uuid": "2b8b8778-7b28-48ac-a0d4-6ac3178d9fea", "comment": "Malware payload (Mirai)", "value": "ae3eff17caa25e809e346319e4c1338b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162101, "uuid": "c8ce37a0-3102-4d72-b730-cdaa1d2a15aa", "comment": "Malware payload (Mirai)", "value": "84b0ddf5462e970a0c4ce0d7963b4e159f61c70c6d1287dc045f932932d6245d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162101, "uuid": "d3e54350-e4ae-4e3c-971c-882378688f86", "comment": "Malware payload (Mirai)", "value": "2b400696c64e5be4c713d7ba425f7c0202a10252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162101, "uuid": "64a804eb-734d-48a0-bb43-562ce2eb76f6", "comment": "Malware payload (Mirai)", "value": "6d29859d53b915cd721962e653c9d215a466c026ca4dcd471dc231d44e84537fa373ab718e871ce3c7a81b6d093243ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162101, "uuid": "9d17cab6-397b-4c47-ab4a-4b7ea23bb362", "value": "T1C1D3E946BD418F13C5C321FBFBDE429C3E166F6DD6EA32029925BFA027864D60D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162101, "uuid": "1682f1fb-3906-4567-a24a-ef847f63053a", "value": "3072:HHPjPm23BISEPDHyWAloaHsOAOPVLee3Dq:H1Bk7H3AZH/AqVLeeTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162101, "uuid": "63d07118-79c9-439e-91f3-ebdceb95d8af", "value": 135016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162101, "uuid": "73d22e2e-8bb9-4041-9a49-882e6321fa11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162101, "uuid": "ca92ad3c-770e-4325-a725-5f30f70a1316", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e7ec6c-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193802, "uuid": "63cbdf79-a8f9-4156-aa2f-e27fc84687d6", "comment": "Malware payload (Mirai)", "value": "52dc963317663d3a6afad56208b5e526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193802, "uuid": "3543b8d7-20b3-48ab-b7fa-ebf256a86ffc", "comment": "Malware payload (Mirai)", "value": "84b523dbc7bbdcd99346142487a846100b364b11a379f9cf4d8885045ebf04df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193802, "uuid": "95d6358b-92fc-48a2-8c1e-152798582cdc", "comment": "Malware payload (Mirai)", "value": "53b3d99057f43688e60c604fc221da6e47dffb5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193802, "uuid": "df4e8654-5267-4221-a0a7-c19be601c00b", "comment": "Malware payload (Mirai)", "value": "9ff8735ad57933aa1a6d1f0b32a5ac1f9550a0d26025b728ed4593f42036343aa49d4711927c19809579a46c33e0694b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193802, "uuid": "f52597d9-5a7a-4587-a755-36b4af36bfc5", "value": "T185F3F7C3F900DFB7F40BE37648A308157130FFA60D521A77726779AAAA3A1D41426F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193802, "uuid": "5f47c394-75d4-46e0-ae3a-2efa395cf51e", "value": "3072:q8rT7idTYhzymDyLfHqJFfSlOxTQZg54NVzjbiAL/IJ13/4:NvK3YyLfqJF6ltC54TL/Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193802, "uuid": "dc127b81-49df-49a1-b804-408f9c1a5fd6", "value": 159768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193802, "uuid": "b7f6ad3c-2efe-4e17-aaea-611312d25151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193802, "uuid": "e90b883d-dcc7-4168-9215-24ef0e576d15", "value": "israel.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcd6f01-0aa6-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771184749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184749, "uuid": "178ef7ea-cc5f-4cea-844a-9e752aae962b", "comment": "Malware payload (Stealc)", "value": "bac6d07fdf0af3be55f59cfec3b81ecc", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184749, "uuid": "c5389f0b-5098-4f82-8892-961c14143f12", "comment": "Malware payload (Stealc)", "value": "84bd20bcb88426402c4a3c96d8012396f83387a84b7abc1a6e90c2babebb42bd", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184749, "uuid": "1deda7fb-8035-402c-a1f5-0b8d73b226be", "comment": "Malware payload (Stealc)", "value": "8f3f87f8124226e105547e25354e7e9a7b47e581", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184749, "uuid": "35c1e36e-f8d0-4347-8002-e564fd61bd3c", "comment": "Malware payload (Stealc)", "value": "df6ce0442d0172c5a410c80ea220e54831c7e2c3441c00dc1307fd0df329219760630c2294685bf032d141a343b0c7ad", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184749, "uuid": "c6cd1c3b-c905-4fa9-825a-112646057ec6", "value": "T1DFF47C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184749, "uuid": "8d9976ac-460a-48bb-8490-f54177eb60a0", "value": "f456face36cfa724bf01290dd8927512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184749, "uuid": "40f14968-c5d9-4dc6-987a-e10a94aa84d3", "value": "12288:NzDhwo1qqr/aead+W3cyMzNP8WTopMRWd38yxBlDetAqxSva:D7NaeRW3P2k0WWQsybS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771184749, "uuid": "d816150a-a9d8-4850-b4c5-589ff6db2310", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771184749, "uuid": "dbcd3285-8a22-4039-ae58-4cf63760d4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184749, "uuid": "70fff84b-798e-4946-b66c-af85e41335b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8df74fb-0ab9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771192848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192848, "uuid": "ecac6b3a-525b-47d5-a176-515e1431d715", "comment": "Malware payload (Mirai)", "value": "d919397f8ea290f0f4bbf5bee2f970a5", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192848, "uuid": "1c0496a9-e56a-49e2-8110-ca28aa141c10", "comment": "Malware payload (Mirai)", "value": "85ee5a8462d16eba9dc5e86b7cde565936b505a681cc4646e29af2bc85bcb189", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192848, "uuid": "300fee12-b6f0-49bf-b6b4-7030ae522c0f", "comment": "Malware payload (Mirai)", "value": "24fe707def65d6af97cb017584c24b900e0159df", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192848, "uuid": "d8e22b7e-04c2-473d-ae7e-a017bfcdf0ef", "comment": "Malware payload (Mirai)", "value": "3d734303941a4c8e27fa95dbd8d4246c8d7e53586989fea48a1ae0d4c28645ebb1d5bc419d721864592d4fc70006a482", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192848, "uuid": "987b7c2a-6380-4986-b15c-5e740fb468e8", "value": "T1D623F183C062F2B4EA3E52F5E71D00D87A57A917A28B177BA89C26BFDD365001D9F211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192848, "uuid": "1df52bae-5aa8-44e7-8ea8-a1756b453785", "value": "768:O5poQX6rbdAJmtGmfpOXvBfS+1Dekc15cn1uqWrkcTlcX:O5pVX+dis9xOpfSuDekrMqWY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771192848, "uuid": "fcefbaff-963c-4e6c-af35-c17a50146ad0", "value": 48156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771192848, "uuid": "ccbbcd51-d4bb-4707-b18f-8e3be41af3f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192848, "uuid": "10e7b7e3-1cff-45a2-811f-57e14a0053f2", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939296a3-0a71-11f1-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1771161834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161834, "uuid": "badcaf47-a365-4e94-bdd5-c3208aa3f11c", "comment": "Malware payload (NanoCore)", "value": "2574588dc5f9fc55953c58e3a54d339a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161834, "uuid": "2b60a564-5327-4941-b404-710c9c9cbcc2", "comment": "Malware payload (NanoCore)", "value": "8663882b652358d4fc75b8051d9366dce18e188ee7c02679a526c063832f704e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161834, "uuid": "25771be1-f703-4767-a308-4a6d8dc42519", "comment": "Malware payload (NanoCore)", "value": "832b0c1715c94ad8a0b321572e63699e872a5d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161834, "uuid": "0f07fb34-d416-477e-bd18-9971939cfbe7", "comment": "Malware payload (NanoCore)", "value": "b035ae0dafa864ff0cd256cdf1a4391b2a8ad8862dac0cb5d0d874c2f5546e3ee53bdde22449eb0a1e43b1ad8901ddbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161834, "uuid": "a0dde2db-987f-4e0c-b6fe-9285a8a0ec5a", "value": "T13128C6A3A6B48E01C14F6239788EDAE2D753BF7A7611070632D3779E987A2CF8F51501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161834, "uuid": "8db33e5e-01ba-4f4c-bc19-2e3cdaa9bcf2", "value": "393216:ceuZT6owyV7Pio+6LxjnwtI5ZuPiLTsfJbY2ove3WlNR:ceuZ+PyV7Pio+6LxzwyohYRlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161834, "uuid": "c478e1ed-31de-42f3-bf3d-28f38e2140e7", "value": 93459456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161834, "uuid": "836b6b2d-2413-4490-bf5f-92a836408457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161834, "uuid": "a4880a13-c9d0-45e7-afa5-19fe741f289b", "value": "8663882b652358d4fc75b8051d9366dce18e188ee7c02679a526c063832f704e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1493be81-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150454, "uuid": "68e65286-ac64-43fc-877e-672d76d81d03", "comment": "Malware payload (Grandoreiro)", "value": "4bc6747d96c1d7aaf51f77e949317452", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150454, "uuid": "8f4979db-2c99-4b45-a2f9-c37bbfca0734", "comment": "Malware payload (Grandoreiro)", "value": "8957320c543f70d5c7f79728904c7e871b4c3b8ed66e0d0004be32e67e43de47", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150454, "uuid": "51e1b591-9c05-4494-82c1-7f8b2b0685c6", "comment": "Malware payload (Grandoreiro)", "value": "4247172d313e7f22802cbd395548c695cdedc150", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150454, "uuid": "58a50b78-9fd4-447f-8b9c-67743ca78d53", "comment": "Malware payload (Grandoreiro)", "value": "3afe1bf7c23300711c178243393ef5453a0badd1d0c09c1039f247f60fe077752c7728dfddc3236579d6a914385e3aab", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150454, "uuid": "84c5baae-743c-43ad-ae16-bc993d989639", "value": "T1D0562331FA861C57C7E04776B12F2B3A2F7D1A83084DD59264ACB5C23747FE2A62E461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150454, "uuid": "801fae64-3a7f-4b19-9b6f-cb546a53ff5f", "value": "49152:/OWOKhj+OrCS6aQcxfI6xgHdMu5bPwl+rH0BZMQk3K1PGB7zAmoMrXq51zn0vNJx:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150454, "uuid": "3117cc20-a4c6-4d5a-be1b-cb7dbefb5e0f", "value": 6064128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150454, "uuid": "818021b0-f2b1-4317-875c-b4becb3503e9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150454, "uuid": "0b03b81d-9ea8-4544-a919-b78d54200d10", "value": "RctfTJAI771400CL243H_69268.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56611d84-0a04-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771114917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771114917, "uuid": "3e5f7871-ad65-4500-8700-82a241f3d19d", "comment": "Malware payload", "value": "1122715b983f4b96a3de0b361cb61561", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771114917, "uuid": "574295cd-f48d-444b-90d9-465be6151bd7", "comment": "Malware payload", "value": "8990ccf727a140d0a7accfc2465974b337add659db55bb82ec30bcf809222320", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771114917, "uuid": "581ed367-60c8-4f2c-afe3-18bdab527c39", "comment": "Malware payload", "value": "1c4ad61e369ccaf165f60b2cc4bb30d768261842", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771114917, "uuid": "80b989fb-ccdc-48c0-852b-7333d28fc4b8", "comment": "Malware payload", "value": "fd4796fa984b878838c02dec45e0f614a48304745f70c04ab1a6441f31550814ac8c7f6f46d0c3a47a3b2b496ea97f10", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771114917, "uuid": "e192b2f7-108b-4c30-b106-59e4fc3b432d", "value": "T1E744E26D54BCDD57E85E75F0CD54399007BA23A0E2AB259B02A313DF9E2EFB690C4306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771114917, "uuid": "7be620ef-23bf-4fe6-9a6d-491c6eb18033", "value": "3072:wWqm908oqm908Dqm908wqm908Aqm908zqm908Fqm908Rqm908lqm908xqm9089:X3Kh3Ka3Kp3K13KO3Kw3Kg3KM3Ko3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771114917, "uuid": "d4fd6976-b355-426a-a54c-80ca91c401fc", "value": 254634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771114917, "uuid": "f7d00a0e-6029-477a-98aa-17291a9b8475", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771114917, "uuid": "8ac5dc34-5c8e-453f-954e-f37bb6739197", "value": "\u0417\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0430\u043a\u0442 \u0441\u043f\u0438\u0441\u0430\u043d\u043d\u044f.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c16677-0a97-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771178246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178246, "uuid": "60519cf6-f3c8-4401-b961-b3624ce788b1", "comment": "Malware payload", "value": "21f0c71c7bfcefea02aba14c96784181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178246, "uuid": "4ebf6e13-e50e-410c-a113-3bfb5c58df14", "comment": "Malware payload", "value": "8b957387bae51ea60e52bed200446976db6bf29cf8bd5969cccf2f48638a331a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178246, "uuid": "421a53c2-cae7-45c3-8d97-fd9b44def5d8", "comment": "Malware payload", "value": "db457d4ceb52906016813ac5417f4c7e5ac1ed3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178246, "uuid": "6ffa5387-8f08-4ea4-89d5-dd319701e9dc", "comment": "Malware payload", "value": "781f68b2e5ac97c5704817b5876f721f7cf62e015e56ae4ef26c7830aa1ac3a9bd35f2d3f6601d3ee7191aeaba96ae7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178246, "uuid": "7663d689-18f1-40bd-8346-51cf0073abc7", "value": "T19EC3F606770D4E03D1633DF02B3B2BE0839FFD9228A5A680B52EBEC952719F21545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178246, "uuid": "de2e40ee-1ee7-42d9-a4f2-fabdb0a6e2a6", "value": "1536:NykMWMCjHx1qh0iBYawq+08MglpGvAFDpIaR30GuWzqc/aYNXsNFH:NygxjHxR7ajV8HvFXUFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771178246, "uuid": "21faac56-1f6c-4924-9ec2-3876e712f59e", "value": 126580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771178246, "uuid": "9218100c-f014-405e-8205-851d75c11a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178246, "uuid": "a70379ca-d0d4-4a76-9a66-1095d6a8ccff", "value": "israel.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41f9e25-0aa0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771182075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182075, "uuid": "0b26c4a4-77bc-4000-a556-12b7d4d6d611", "comment": "Malware payload", "value": "e438cbba956db1708a45fcea19daec00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182075, "uuid": "a9678250-2010-460f-9b1a-7e6b86560b12", "comment": "Malware payload", "value": "8d4ada8db727f3e684fa2f22cdf99610b71898528fce31fbd7267c058d6c5583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182075, "uuid": "96ea32d1-ae6a-445b-acb0-0d334594e6bb", "comment": "Malware payload", "value": "a0a9c173d94acb1be17ce2a934a63accf980db70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182075, "uuid": "9f68b895-e6ba-42a4-b19a-cd6280a52f2c", "comment": "Malware payload", "value": "0de023ce5d92b06ba2b66a2b499df4ca9a8ad65588283f8a58a403ff8e40a3995f10819aba62863b236e42a74d7df9ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182075, "uuid": "1f60de26-b99d-4ad4-a1dd-92757b18ed81", "value": "T117A3E605AA429F01D49731FAFB9F425833536FACE3F97101DA24AF6123C6ADB0F66512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182075, "uuid": "04263bcc-e5ba-4129-91f1-fc6c13b9dfe0", "value": "1536:kkn/kkgvtE3BTEsgokiaMrsY5lNtilQ+AGKi2zVQtnKZFYFuOw2X9:/g1QpxgokiaMrsY5ptzVQtnKLeuOw2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771182075, "uuid": "16781951-d6b6-416d-bd72-fdb311206423", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771182075, "uuid": "3d3933a9-82a1-4e48-8fa5-2d5d2f7e1b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182075, "uuid": "a6214fbd-69f0-4e09-8454-e78cf10081c2", "value": "israel.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad383c06-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118069, "uuid": "27dd61eb-8877-435b-a734-e90043c017a4", "comment": "Malware payload", "value": "6f519e844c81e312ca9f41bce12787f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118069, "uuid": "7c13a73f-6223-43bc-b2c3-7a38eb056696", "comment": "Malware payload", "value": "8e1df42a50ea94b3a55b4bd1543de6d1dea1d19c17d97f5ce7c8e6026919601a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118069, "uuid": "53d1fdbe-1f21-4bca-888f-3942fdc30c49", "comment": "Malware payload", "value": "bf9741d8ffc14cb87a19b1fa95920a4f961be3bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118069, "uuid": "bddc7a12-a6a4-41af-838a-7f45556db7c4", "comment": "Malware payload", "value": "6033c25c0072cc5e628067c4373365711adad7f58a0dbaa87e49aa601f3253c6497df6bf796a6efa73ffd13c8a40ad1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118069, "uuid": "66014272-3aa7-4248-9448-0d3e5b178604", "value": "T1EBE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118069, "uuid": "66519a51-6b9b-4ef4-9f19-40dcdc9f00e5", "value": "1536:p+6TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxYdbK:pVlybKpzEOfGQ+vEubTt4ouftL4sdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118069, "uuid": "98272328-fc05-4fc1-a435-0ef128bd693a", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118069, "uuid": "73f14322-ca04-4747-9bbf-abde9a8c679a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118069, "uuid": "7083a0a4-72aa-4a04-b84a-bce38ec81125", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10933ead-0a79-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771165051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771165051, "uuid": "614569bb-7f53-473a-a780-b3706a3095d7", "comment": "Malware payload (Mirai)", "value": "ef99bd28c9a4991c2002273f318f06ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771165051, "uuid": "1d141994-0bdd-462d-9f57-b4e709f2dadf", "comment": "Malware payload (Mirai)", "value": "8e588b95c688f0cd54d687c684cf10c86fa6f65c8359a3e5355dc3cf77272897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771165051, "uuid": "3d5175b7-5de3-4f7f-8081-76599983107e", "comment": "Malware payload (Mirai)", "value": "cfc3d62527c8bfe9fa940717d7f34b89a162db6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771165051, "uuid": "60385f86-af0e-41b7-9b72-9d3ef15a2ed4", "comment": "Malware payload (Mirai)", "value": "d22aef4f5ad4925a47d8233a053d0098acd1d4334a7f7e3161864ed0773b81605cf2dee1c2756626ba77fbfc782df6c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771165051, "uuid": "2cd27fb7-c0a2-484c-8506-e5736f01018f", "value": "T1F1933A85BD419622C2C116B7FF5F028D371697E8D2EA3202CD281FA4778B85B0E6B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771165051, "uuid": "a266ce37-ccda-440b-8d4f-f3820c84f478", "value": "1536:v/mbfzFJ9S1c9MzRnKXRdxjvE5iDelbzh8t4l8m5+8UmMWLrTkO+QG66AuvhnzW:v/mbfBJN92Rgzfabzh842m5+8UmMGlWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771165051, "uuid": "3f8013af-a220-4ed1-aa7d-a7504a200552", "value": 91600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771165051, "uuid": "f0170538-8edb-40c7-8420-2057374fce85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771165051, "uuid": "f2145e57-b6b5-4bfe-8a83-ec40d3a0e623", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb11174-0a71-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771161929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161929, "uuid": "d32ac7a9-41fc-482f-a3a4-bd0741850719", "comment": "Malware payload", "value": "95d929fa2cd5ab401e4f4c203aff05de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161929, "uuid": "35f89957-3cc5-4187-9c0e-1391e2d6c953", "comment": "Malware payload", "value": "8f17f85085f91981089860713c6ae572db5bacc4f5338b1c58d06ae1b7bff5e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161929, "uuid": "a01e2e40-7e5c-484a-825e-028820b08052", "comment": "Malware payload", "value": "ce025fca3f203342d798b1b0e43d0eeef46e84cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161929, "uuid": "d7f8c802-f0f3-4000-b98b-7bd1b4212ef6", "comment": "Malware payload", "value": "449342f6dc5a9ed786d3699cbc4e09c155d77d057d8c42aea4a9a75e549479034a377eb88032e75299f6ed8f06075d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161929, "uuid": "fd68956c-563b-4008-8fcc-7f02d46d36bc", "value": "T10FA32902BB0D0F43D1632DF02B7B1BE1979AFDA119F4A580652EFAC65274DF22142ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161929, "uuid": "1af8ae04-b77e-4b2c-8cfb-528fc1c72ab2", "value": "1536:YHPCvr9XSzNUf7jlAk/xNsa92Qav/HmdttzSa6wrW4Wi8fJFGPkdfmPoMVIN:YvYW47Ay2Qy8DxlW4WrfIFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161929, "uuid": "1d4e96ff-1546-443f-bd94-5543846efea5", "value": 102960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161929, "uuid": "8bb28a18-cb47-4380-b6fd-e7fd21794a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161929, "uuid": "8b891fb8-021e-4092-9cfe-86b9c34ad83b", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dc0ae9-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120206, "uuid": "dacefe61-356c-4851-8dec-615cb2c72156", "comment": "Malware payload (Mirai)", "value": "96bf2f5b956861a6b417708085915841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120206, "uuid": "cb2eba34-f3db-49bb-9694-339049cc38b9", "comment": "Malware payload (Mirai)", "value": "8f9bf186f76693da9008570ecb7b9e136c8e48286945b3a40b393378f159049e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120206, "uuid": "41c983db-ef8f-44ee-aecf-b622581a0f1a", "comment": "Malware payload (Mirai)", "value": "283fc575f502778beada81f0e49d5a0af07aa3c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120206, "uuid": "a6882339-927e-4af2-a58a-193c704e1b1e", "comment": "Malware payload (Mirai)", "value": "792fdfb1ea05484370849d73342a4c98320b5fb3c28af3775d668cf4a59f51f54545beb641fa87f9d2692c64f1b7430f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120206, "uuid": "7f60ad45-85c4-41e5-93cf-7d435fb15405", "value": "T117C3D506BF114FF7D89BCD7346EA0B05258CB82B16B92B757534EC58B24A1CA1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120206, "uuid": "41d9495e-7a2d-472e-92d0-d673a93c225e", "value": "1536:D4w4zW/h4SZsqEzLMzgiDSAP3POgjaXbzTZjifPNXe/SRKEEFCSmf:UxW/rZsqgMnPvjarzTre+mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120206, "uuid": "08a93cc8-9388-4bf4-bf80-00fd1a811c22", "value": 118300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120206, "uuid": "5da51d04-c257-4db7-b514-fb3f83ed4b28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120206, "uuid": "40a57b30-fce7-4983-8be9-ed20d236f99b", "value": "manji.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b4c1b7-0a8c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771173569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771173569, "uuid": "3e1b19b2-e145-4c1d-aa16-3668c4fa3479", "comment": "Malware payload", "value": "4b8fa54fe313634704f340f5d680d0d2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771173569, "uuid": "5e922318-ddf6-462b-bda5-bcec95903620", "comment": "Malware payload", "value": "9027ac8aaa56206513ece1337eefc34b6fd2869ecbda167254fb39130626c060", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771173569, "uuid": "e9878d61-f037-40df-9769-67bce8d7fb55", "comment": "Malware payload", "value": "6caae144a1f1510d01ba3a4ed7c663900f569471", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771173569, "uuid": "7e89e098-7102-4e3a-b5e9-bbeb9a6c434c", "comment": "Malware payload", "value": "2e64a7bc9a6f53c73de4b42009dc942d69b38296b9c959fd1978a688a416607594f80bd363e8f7719acc608ff01283e6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771173569, "uuid": "ec22d9c8-0ef1-4963-b6a3-13d4c3750ce9", "value": "T133B3FCB4B99E45A0F2AF89047EBCFD54617131D7D7C92E6802BF91218BE5AD23E0D18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771173569, "uuid": "cceef491-10cf-440d-820e-7cc8b78b531c", "value": "1536:cj/8b0BuFgzwcH3Q1CndHHFzGcjQT36MjNyWN3ZhyHldKlNPgwSYqZc+xvlepI:cFzlny5xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771173569, "uuid": "2bc446b4-c393-4a9a-b2a6-3001ff6a31f6", "value": 107569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771173569, "uuid": "238fb2e1-c354-4c9a-aa21-d7eb61a5e8fa", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771173569, "uuid": "f5c440be-394f-41e5-96db-bf8f7ba80dce", "value": "XWormClient_dropper.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41834383-0aa5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771184031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184031, "uuid": "d4ef5cfb-a109-42cb-b926-87122e5da0e5", "comment": "Malware payload", "value": "b194ad5d830078179aaa08d3eada986c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184031, "uuid": "4246eae8-33e1-4be5-b924-9c3055368793", "comment": "Malware payload", "value": "90e429cfa24c43fa784556a0866a43419a8690047e6f3e298e46ce122614c651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184031, "uuid": "18276a6b-fe06-4579-9be1-0f5f6e567bda", "comment": "Malware payload", "value": "b449d262e47d8d99366accfcc584c08826024c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184031, "uuid": "acb0f2eb-f08e-49c6-a1bb-052cb26a3163", "comment": "Malware payload", "value": "032a2a8ccddd2f8956f57d885a695674f06b426979e5937c5c5649fe1ddd01008b69677bb9c83d053dac54fdc2690cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184031, "uuid": "ae69673c-9df3-42b4-81c4-ac58e95265e2", "value": "T13F446C07B2A559BCE146C03CD3179673B672B88B0620BDBF13E48A302F5AE555F2CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184031, "uuid": "8996ad14-657e-4ef4-92d1-3b634a4b179a", "value": "09ae2267c6c1433614a8bb7f10a407d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184031, "uuid": "eea8df1d-cff1-40e4-a41e-fc82dd2b79d5", "value": "6144:ihINjehE5p2tTaa44xR+b4pxkyTrL0Gf+hdexysP8QS/:mIQ/Q4pxkyTrL0Gf+ixyO8QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771184031, "uuid": "216f7460-08af-4559-b11f-ced05a99e646", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771184031, "uuid": "288276e6-7b08-4c17-9e0d-27b48f3e5904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184031, "uuid": "393faf84-56c3-41f7-93ad-baa62c3e5c50", "value": "WinStore.App.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b835f8-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150406, "uuid": "d200a91c-29e2-40ac-9a11-88ea81714155", "comment": "Malware payload (Grandoreiro)", "value": "53c55acead042c24ae9b7388e7e35668", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150406, "uuid": "201b8431-08e3-4b47-82cf-3ef59534bb77", "comment": "Malware payload (Grandoreiro)", "value": "9164da590eaa423eadabfae2bce7991ccd3ec9c736d1c55e38997d281c8f5fef", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150406, "uuid": "ba4667bc-ad99-4aa9-970c-b20d58337da3", "comment": "Malware payload (Grandoreiro)", "value": "7f24b8296bba1fccacaa23f458cff85634fc5478", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150406, "uuid": "c5d0013b-6ac7-4990-8dcc-5f5dba25e006", "comment": "Malware payload (Grandoreiro)", "value": "31ac7b03f1d76323b8540a1f02d206a5e2dbd67a678fe172481eea5e2ff29fcf2573978b7278fa45d41258ad667c568f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150406, "uuid": "9d69215f-5ce2-4ccc-bf3b-61a71c50a6b8", "value": "T1B6262336EF01985BC44047B5B96F7E32AF3D63038688D6D1789D91072796FD3AB2E890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150406, "uuid": "5ea65534-532b-4c72-9d8e-18067bfff211", "value": "49152:OeFtxc/ukYJPJYrSuxnfrxUmqL6zZyiRI6WWdeM4Sud3MF+WYmr:zWYmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150406, "uuid": "1082d9af-0b84-4719-8c12-588ccda2f0c7", "value": 4616192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150406, "uuid": "67a18a8f-3928-4e08-a907-a3c23e76fe37", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150406, "uuid": "a75d1bdf-50af-4c4c-8396-872601150b1a", "value": "Prdc51398V_706287NJEXCDHF95Bmvafrd.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd813bcd-0a71-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1771161905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161905, "uuid": "31086f0d-1228-4537-ad48-1ddc62c7b70b", "comment": "Malware payload (njrat)", "value": "0e92806e280af74d6e94fc5bf1d7cd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161905, "uuid": "1e7143ec-7550-4b14-8bf6-f44bedf3824e", "comment": "Malware payload (njrat)", "value": "919c8580df6b910d895771b6425b5abea742b80a88677e3dbd5a1b3a30482eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161905, "uuid": "ccc27c3e-ebd0-435e-b7b7-956637071179", "comment": "Malware payload (njrat)", "value": "db5eb5cb8a1fcbb447f61b1ca4af4ffc152353b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161905, "uuid": "957e974b-dfe6-4116-a9bf-e3a3d6f9019d", "comment": "Malware payload (njrat)", "value": "e3af0315b56f558be90afaf92c738af55aa1f6a3061e1e08b82f1a84948f30bc9af4d5d323ee84666c8bb3941d268b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161905, "uuid": "70d89a37-23c4-40d4-af07-946d1d8ce96b", "value": "T196032A4D7FE18568C4FD167B06B2D41207BAE00B6E23DD0E8EE1649A37636C58F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161905, "uuid": "c7476bfa-a254-4882-99e4-df64cde09f42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161905, "uuid": "b12466f5-428b-4cc7-93a3-87de85ab0124", "value": "384:g6v5qiUDCou44pvayFzCe4nfOsWQVFfrAF+rMRTyN/0L+EcoinblneHQM3epzX75:nSspvJFzCx2NQ7frM+rMRa8NuFrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161905, "uuid": "67208883-aaf7-4da5-8d8e-694e1a0de4ed", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161905, "uuid": "6d16aa10-f6fe-4aec-bd2e-a45d870fddba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161905, "uuid": "1888c3b7-9cfd-4754-a4a4-4a17059ddc23", "value": "0e92806e280af74d6e94fc5bf1d7cd1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7e8d8b-0a90-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771175031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175031, "uuid": "57db3ab3-4863-47f3-94a4-35c7ad5e8eb2", "comment": "Malware payload (Mirai)", "value": "1c65dd8a27a16585da31c5c96e722f29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175031, "uuid": "87e08d6b-be38-4e35-97c5-70b472c5baf4", "comment": "Malware payload (Mirai)", "value": "92811f349693156f35a989936099e1a0255b9b43c3909c6a96000083d0bba7a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175031, "uuid": "aada4a4b-bee5-46c4-a815-b7c81b2a8d60", "comment": "Malware payload (Mirai)", "value": "54d3d7541a808dfc54d74202122900426ecb79e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771175031, "uuid": "158e3dfa-286d-4995-80b3-d771c8556714", "comment": "Malware payload (Mirai)", "value": "125f427cfc94d04e780b0822deef8d911615874c2feedd41d0a0ec726b09e1c9880c0b9b4b670833c05603ff9d32d2d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175031, "uuid": "2bec0def-3f4d-4f0a-bbe8-1aab938b2518", "value": "T192B3070AFB614EF7D86FDD3746A80B0534DC550B22E96B363670C528F64B24B5AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175031, "uuid": "1d8977ca-75e2-47fe-97e1-3982cbe34004", "value": "1536:2EvZCJ87cFTaT3vxyf5cvvEHz2wVNZcl0ailFiwTlslfZmALSW9PnzZ:26ZCJ870Ta7pNnETNRriBf9ZnzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771175031, "uuid": "b26c36ce-ec60-4c46-a8a9-317a4b6c3299", "value": 114104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771175031, "uuid": "f4843f50-eff9-4895-b847-66121c423341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771175031, "uuid": "9cf57920-14a4-441f-9c8b-973fd23ba336", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cff5d8-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193777, "uuid": "c80e1e3b-f161-44ae-8de0-86bbb3cfd02a", "comment": "Malware payload (Mirai)", "value": "bdc90b42b1b0baa7be0125ca64a25833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193777, "uuid": "f8bc4c2a-ef93-4499-bcf6-60a67329fa1a", "comment": "Malware payload (Mirai)", "value": "9357d9a2e153f2a42e7324183f4e07b52c7414dc37f7feabb2de0b927f50fd93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193777, "uuid": "d5e4feab-f0e7-45a0-8a8b-35fc9ef4b880", "comment": "Malware payload (Mirai)", "value": "ede448f37ebb8adab889b40f588367257089138f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193777, "uuid": "a42d5300-da1c-40f5-afcf-fb79dc3dda3e", "comment": "Malware payload (Mirai)", "value": "30d4079d949b4379b096207e06b9b3be7ee33e8a2a69f365b3ce03622e2caaee6a6c7ee38e858a6d6eb910c94223f57d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193777, "uuid": "18ef0b17-bc89-4908-bb5f-fb8c2b8d3bb4", "value": "T11BC31863DD279F5AC127A5F061F24E341B53BD2688570FB9A07AEAE08183DCDB5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193777, "uuid": "a631bb72-f0a5-4bf4-8234-4cc0749319d6", "value": "1536:teVDBF0lVw5CGUNKPOGo7dj1XGYjSU/Wn32ECzMQvAN:EVDoLw53UUPi/XGiv/W33CgdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193777, "uuid": "be7f65aa-f396-4846-a477-02f532ede45c", "value": 119476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193777, "uuid": "382ecc22-3a9e-4b51-951c-1ae5484d2bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193777, "uuid": "8d24f6fb-d9c9-45f4-b91d-88eae888ae04", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bae7cf-0a74-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771162887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162887, "uuid": "01bfe89a-58da-4ae3-ac8f-fcfcbf4880b5", "comment": "Malware payload (Mirai)", "value": "936c2fdbec6a049ecaef70bd9f6a216f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162887, "uuid": "38f42fa4-d596-4efe-b137-cc69b3ee6ea6", "comment": "Malware payload (Mirai)", "value": "935cf945931dcb95d3dd78ac25c929f5c2331cb2698abbd7baed7be413035369", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162887, "uuid": "1dae71cd-2311-4137-af99-44ecbaf50be4", "comment": "Malware payload (Mirai)", "value": "e660c266260d96a3a720a40342ad04af2b4047aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771162887, "uuid": "61e3848f-424f-41c2-b8fb-95d2251696b8", "comment": "Malware payload (Mirai)", "value": "152c30d63fa2465857f1bee8ab6fd4527c4a452600a5cd3adcd632d089835a6834d2f54e9f7abfd16eddb52402ec08b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162887, "uuid": "e94ef760-c260-43e9-aef1-f9f59978905d", "value": "T1F1C2F823537B2D07C0D5A73560E35332E8EEAF5A4660834F7D559C8B6EA6390263BBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162887, "uuid": "4103ea5f-44aa-4f3a-947e-f6819d42b6ca", "value": "384:SEJ8K0h6240vh55DJYnw2f+vzsJeu65TLy2:Sy30h6240vh5tJCPf4sDYLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771162887, "uuid": "53f65679-d344-45e5-b5d5-bfdb1f18bac3", "value": 27288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771162887, "uuid": "ac79c2fc-78ec-4f58-91ce-9a8bcae8ab8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771162887, "uuid": "95a880bb-19aa-47c1-ba4c-6d2d92fdb7f1", "value": "israel.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060678e2-0a09-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771116929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116929, "uuid": "6797f147-2e0c-4d9a-ba46-64c49804323f", "comment": "Malware payload (Mirai)", "value": "7175b21850b1b9ec6314b17c253e54e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116929, "uuid": "cf71cb80-25cc-4c66-8007-b10690fa7ae6", "comment": "Malware payload (Mirai)", "value": "93625ab1a520f851f71b7704e5dec6113cbaf2e4be081cebc19c2914a6916ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116929, "uuid": "b40255cc-9b1c-4c72-904e-c3dcf66c377e", "comment": "Malware payload (Mirai)", "value": "9293517d4cd2def17eda75f5a14f24e4af430de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116929, "uuid": "9881d067-c415-47f8-bc4e-704eb3a9ba48", "comment": "Malware payload (Mirai)", "value": "80ab79774e01356f2d66ac90d9dc6360d7c9000e50b9f8e53f75178f585d1b3b101fd59175c1e3f155d9a094cb1b37a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116929, "uuid": "35165932-c5e7-4428-873d-7f68f7bcfa41", "value": "T17AC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116929, "uuid": "89a513e6-5a3e-4032-b096-06b2f97a83ac", "value": "3072:fZD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1R:fZD76aX9aKTcRQVnoiYq1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116929, "uuid": "07453834-e020-411a-ada8-959749c5d4c4", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116929, "uuid": "b6576748-1232-49f9-a76b-110a2006e697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116929, "uuid": "e63642c9-f4b0-41a2-be49-69d93d65efe3", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f20544-0a06-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771115719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115719, "uuid": "a7f58c14-f39d-4b8a-895f-1b3c5fad2435", "comment": "Malware payload", "value": "a62762180f6a2f8f88a55b38606995e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115719, "uuid": "09ec9703-5abe-4f80-a770-925a54c90561", "comment": "Malware payload", "value": "941a8c17890e588c14edc71f1cb40391be561fc55b0b4889307da626188ee493", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115719, "uuid": "714e4ad1-219e-4297-858b-be8c7a134df7", "comment": "Malware payload", "value": "bff756f7978c1118391726516b9513698c9dc18a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115719, "uuid": "8a6883d9-ef71-42fb-aa1e-63eeaf69c9a0", "comment": "Malware payload", "value": "798cfd66db395c573a5e2fd21f9ed1dba6cf482c660a95018c50a25d0e48cdc07434547ec1c4f71fbb741c7e3ec43d00", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115719, "uuid": "b52a66b6-61c6-4fc2-8d59-dbc813765634", "value": "T1F944E16D54BCDD57E85E75F0CD14399007BA27A0E2AB359A02A313DF5E2EFBA90C4306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115719, "uuid": "d1322694-4f52-4e21-b5d1-5df96e866717", "value": "3072:v6sqm908oqm908Dqm908wqm908Aqm908zqm908Fqm908Rqm908lqm908xqm9089:13Kh3Ka3Kp3K13KO3Kw3Kg3KM3Ko3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115719, "uuid": "567e1afe-36b5-4ec1-bd87-12404fa4c4e8", "value": 253844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115719, "uuid": "b8a82287-0ed5-434a-95e4-65054116af77", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115719, "uuid": "4fc0f79f-7492-44eb-973e-b5bbd455758a", "value": "\u0440\u0435\u0454\u0441\u0442\u0440 \u0434\u043e\u0433\u043e\u0432\u043e\u0440\u0456\u0432.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4664be96-0ac6-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771198212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198212, "uuid": "2f98dcd4-89e3-40ab-8639-e740afe0e251", "comment": "Malware payload (Formbook)", "value": "840b29f5ca79f891d0eac37b2fc051f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198212, "uuid": "3e68db12-c899-4188-8f19-726ec9296f43", "comment": "Malware payload (Formbook)", "value": "946baa56681d7e954c471671a8eeb9161a208e0e2f1d2c2587eaafcea8d1d5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198212, "uuid": "b1cc2259-8779-4b0e-97fc-ab6dd943d8e2", "comment": "Malware payload (Formbook)", "value": "2ba02de0ce097d9d341ad66d1b31803cff596486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771198212, "uuid": "ab57fcbd-09a6-4e02-8bae-0b13128dd469", "comment": "Malware payload (Formbook)", "value": "1f4dc29aa4be31a31d1b0325a46e5416e5838bdf9ecc2d2256e47e2d5f727bfc572f94eb09a25134a15dc1442a155350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198212, "uuid": "3ba24fb1-d916-4752-939c-c0fa0f50a2ae", "value": "T1D645AE0273C1D062FFAB96334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198212, "uuid": "d97cfeab-8db2-437d-b1b3-0d0fb67940ca", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198212, "uuid": "f8c78bf0-c140-46e1-bc36-156216d400c1", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdahj1cnpVML3w:wPVt/LZeJbInQRahj1WaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771198212, "uuid": "50527748-85f8-4799-b4c4-48c740886748", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771198212, "uuid": "c65df484-7267-4bee-be98-e10b641a5fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771198212, "uuid": "bb888ff2-d28a-4417-b663-51354f5f1853", "value": "rShipmentDocs-B56bbYn89OpdRwB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba2859d-0aa4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771183779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183779, "uuid": "dd10204e-d6e6-42d7-8eee-414f89269111", "comment": "Malware payload", "value": "4d179328a9f6514916dd2cc411fb039c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183779, "uuid": "eb1863a9-9868-40d5-a649-d373ef19cc2f", "comment": "Malware payload", "value": "94e27c52a3e5d3498a89492a192d44972ae1cf0e6bac211844d537288d14bd84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183779, "uuid": "f1001c6d-069b-4967-ab5d-f61a047ee677", "comment": "Malware payload", "value": "17428fae8cec00f88598d69772369d73b6edf015", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183779, "uuid": "2e7fecd5-60ca-4d0d-9d18-77edde74d9d2", "comment": "Malware payload", "value": "c46ed81c29fc0ed7bb25e49663fd07b51bf90b06768e44e71cc0eefcddebe33ae4667d18f0e81e6abcb3754b26c419dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183779, "uuid": "ca93f0c8-07ad-4db8-bd76-3e8bb94726b3", "value": "T127B31763DE5AAF1AD617A1F0B2F28E741B53BD6548470EB9A472EAE04143CCCF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183779, "uuid": "d977a720-1761-46d1-b77d-afa79f61ccd4", "value": "1536:NTqZdRb76lsC9eK3q0U7/mGJrTlJMzW5sMDzpGeTAEXGy:9qpX6lsoR3YFJrhezW5lDzplJXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771183779, "uuid": "b4f65d0b-a324-4306-98a0-0ea98dc8b7d2", "value": 110108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771183779, "uuid": "ae6f2d81-c1ca-4a9b-b1f1-9834c74db04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183779, "uuid": "b86f58a2-ad85-4649-b1fe-65de44892808", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323f2aa0-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150504, "uuid": "23866627-d8f6-4398-a241-bc0b2b102b87", "comment": "Malware payload (Grandoreiro)", "value": "7e00248d14038495a190287ccb85adc4", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150504, "uuid": "aec17fed-13d3-4972-85f7-b88a7f2008f2", "comment": "Malware payload (Grandoreiro)", "value": "97fa4309203e008d6b3f587158cbd02c5a71ee21dc1965fa1b9badfeffed8af1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150504, "uuid": "2097c2c7-b80b-43c3-ab73-5fbe89309a83", "comment": "Malware payload (Grandoreiro)", "value": "3464e16d76875f77a8d6fa61f11438e8ff86a0ea", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150504, "uuid": "684a3799-f1b5-41bc-9543-8be0c2efc6ac", "comment": "Malware payload (Grandoreiro)", "value": "348d7cadfca27a483072f0bba06cc81abfc4c230f782cd1c43d580b1ba692dc805af9ffb8c0fa93238c50981b0afbe34", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150504, "uuid": "c7e3b0d4-db7b-461c-956d-7e973137509d", "value": "T17C7623329E087C47D6908335B47B6E391E2C2753854CA5E325EC95CB3B8BFD2862F469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150504, "uuid": "ca859482-9190-467f-9c3b-c81f7842a0d4", "value": "49152:+LXbQOAYznZO/ITkO9yPxFaNlfZxdQShYX4vXvdx9/SNfj7PXYbqJtb80NB6/fC7:Ix8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150504, "uuid": "26f83d3c-409a-4e3f-b21c-8419591748bd", "value": 7473152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150504, "uuid": "240aaf2b-5610-4abe-ad8f-6a23eb286030", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150504, "uuid": "46cd7769-cc27-4857-be31-ea1c2670e82a", "value": "R41YZ_14656GSRXB-Reg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db11f3d-0aa5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771184131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184131, "uuid": "7789ad9d-3f44-431e-a880-59e48958ef8a", "comment": "Malware payload", "value": "be22640e61cd5359417c06c514bdd2bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184131, "uuid": "60f1cd83-435c-44d1-b241-1375fc067817", "comment": "Malware payload", "value": "984a0cd9cec096362928ed2847a0745184fda7c2f66082733cc1a097a81b09e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184131, "uuid": "3beb7b6c-629e-40d2-a99b-ef98d786ca08", "comment": "Malware payload", "value": "2c1c78fd1f570f736ef56ab87d2562e62d0952f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184131, "uuid": "cb308ed5-b103-4760-9801-00b71e3372bc", "comment": "Malware payload", "value": "2c471f729918de523ccd27403612e4de7f91e13be199851997e3af0c16491b397e061303e1c4c6dae5a41b8c93c530b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184131, "uuid": "8e881bad-a802-442a-8885-73cfcfcbde9f", "value": "T1FED32A077581CABFC897D1F44BEBA4268972FC2E1935715A63D4BDA21F49EE02E1C720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184131, "uuid": "2ac2c9db-5091-44c1-a009-ae44699e01c5", "value": "1536:2lmRazEKB0G1aT6nAnCho6mL1gy2UmXB6GxayiQe12HM48NE3F:2yazKnBeoZ1gy2UmXFxayi1H4YQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771184131, "uuid": "3279ec2b-2a54-4e15-a661-608223d653b9", "value": 131968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771184131, "uuid": "841713c9-de4c-4580-98f0-b2cddcbdcebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184131, "uuid": "11539e52-2416-4e36-b3e1-8f619aa5715f", "value": "israel.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404f2108-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150528, "uuid": "f17f332e-5075-486c-8007-1caf56178937", "comment": "Malware payload (Grandoreiro)", "value": "9a2baae8894365fb07097c2047c95395", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150528, "uuid": "daee4035-71c4-41cf-b1dc-b0ae2002c2d1", "comment": "Malware payload (Grandoreiro)", "value": "9aa5041b741783a00e069bbbd274afa512b67757419a15a7e599f9279ed0023d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150528, "uuid": "cd3549a4-f4f8-46ee-aef7-44ca0d5b9e55", "comment": "Malware payload (Grandoreiro)", "value": "39848f5d7595a63dfa9f9a314cac1af7d8550344", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150528, "uuid": "e6baff6b-7819-4142-a8ae-0305df5ebd5c", "comment": "Malware payload (Grandoreiro)", "value": "c1b5fbf1357469bd53059ea57c1d6df3d48f8e2933a083719d96af3309c0a64036d76b30680add088076740662b108fb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150528, "uuid": "40bc8fd8-ef26-411a-ab5a-36540684326e", "value": "T1B8362332FA81587AD5A007B5F02E3932BF2D7663094D9995ACBC56437B4BDD0E23F092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150528, "uuid": "1f3f89dd-a376-496d-837e-ca69fba04278", "value": "49152:6E9/q+GNkbtZZljPiKgMMwyjnyiQRjOWdBpLamB8sPtNT0aFlvxE8pu22E48:Mm148", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150528, "uuid": "69544ef4-791e-4257-aace-74aeff77c079", "value": 5163008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150528, "uuid": "da096524-0cd7-4183-9e72-28dbe834227e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150528, "uuid": "61be51cc-5f6e-4b3f-8ad0-209db510c46d", "value": "Prvis841897FTXZTB3630P_64570.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec30356a-0a9d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771180881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180881, "uuid": "e6a03a85-2806-4ed7-9fd5-c017b1069dcd", "comment": "Malware payload", "value": "5cfd907e2d0914a1a33cfd530e5f3640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180881, "uuid": "ca18d695-9629-4e1a-b96e-9ea98fc33165", "comment": "Malware payload", "value": "9b105c48a6e76392fd83b14143aed4bb0a32c0640cee37fa4c81d65c2f4f0bba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180881, "uuid": "1c0d5204-3a0e-44d7-857b-73a33b7b5821", "comment": "Malware payload", "value": "6bd3a7eed7f019af640760620148f4a28daa77fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180881, "uuid": "e7e3a556-6558-4109-b7db-c4d3f1098c29", "comment": "Malware payload", "value": "b0c4444b67a5f3dfdbb656677938e633cfaffee8b2a62e636aa44130d800d2edd808c9489a80d558c962893658360ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180881, "uuid": "6ff91e47-9d02-402c-8f46-bfbd23a28635", "value": "T195A3189ABCC5C602C6E061B2FB1F519E375743A8E3E6B107CD18AF29674B85B0E37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180881, "uuid": "39f7e893-29be-4562-b036-50a6a8b927cf", "value": "3072:U0VGMHunaY32IBrEo0vf9pFjhB5/Y5xqk:DRHuaY34o03bSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771180881, "uuid": "f6059d0e-838d-49dd-97b7-5c1455ec43a9", "value": 99852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771180881, "uuid": "c5f0c008-0260-4026-92c6-d16522509d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180881, "uuid": "ee6e7044-1aac-46b1-a23d-de8f4f324275", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfb84e6-0a12-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771121184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121184, "uuid": "dee7ecac-7248-45e3-9e4e-0d1fc8480ea7", "comment": "Malware payload", "value": "7047bc9574bcd12402ad2a54901c6ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121184, "uuid": "5f8db4c5-07dc-44e2-a790-7445bb604abb", "comment": "Malware payload", "value": "9ba4a425ec940b0053f2c512fd94cad8047ebedee7f1b006be8c991d8c87c333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121184, "uuid": "59ed326a-8b47-4615-9903-52a2f8c709fb", "comment": "Malware payload", "value": "967fa8decaf751c875d2c6c2714b04e71300a5d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121184, "uuid": "312bc17c-ae4f-4349-81b8-703e4874f1bb", "comment": "Malware payload", "value": "86f5c206c876996dadc32eb944e2aa1079bcaed56684c3b57e02dd068d927a2feeeb419d349b8f7c8da45fac8ae64775", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121184, "uuid": "8efd2422-77b4-463a-a124-1c0f4f6d8b12", "value": "T1E2B5F757B8924942C4D53A37ACBE81C833665EB99B8A53276D05FE3C3ABF1D80E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121184, "uuid": "fd923c24-616d-471d-b490-834cef0dc9e9", "value": "24576:jdpQphbqdkzv2OCyuop5Ds8rY0AGSbY2+6Xf6rIo3dZSO7HEblV3akKGsZTGL5wk:j/5g9ldTYS+trH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771121184, "uuid": "c6d95062-d989-4f45-96a0-b778eadf6682", "value": 2359444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771121184, "uuid": "7a51098b-2a67-4684-ade0-1f0a6e9a9f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121184, "uuid": "24f6f77a-b1cb-48c1-8596-589d3b14eda6", "value": "client_armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa574c91-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193790, "uuid": "7eba8fb5-48e4-4906-a584-6a56a05d13ed", "comment": "Malware payload (Mirai)", "value": "7ca87d2f2fc3ed21e57f5c8be6c86fec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193790, "uuid": "6bd2a5be-457f-4405-83fc-0c952210639a", "comment": "Malware payload (Mirai)", "value": "9eb2ed94c54993784b23b9f654ecde936b7d5a844703e6361507fa4468f2cd2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193790, "uuid": "acb6856a-7029-4c14-ba86-bf88d1d32ed2", "comment": "Malware payload (Mirai)", "value": "30d39e222d12d2145c99ff9747c00244bddaf416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193790, "uuid": "90826259-2f9d-410c-a6fc-4dbf1f157512", "comment": "Malware payload (Mirai)", "value": "7bb748917e28612c80243ee362305f93c2a3f434a68d2d18c8561dbd031b33a5561749cd3476b45a269fc87eda831255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193790, "uuid": "9fdfb550-484e-4b14-8349-6b8097ddea85", "value": "T175E328C7F800DEFDF80AD37648634909B630BB9255921A377317796BEC3A0E44867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193790, "uuid": "1c5870e9-baea-4c4b-a893-382e1641231d", "value": "3072:l5qa2+oF+ye1g7CA2LFoWVZjbiXLMDX4/bVAye+jhAk4o:Sa2+oWg7CLFo3LwiRAye8A/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193790, "uuid": "056100d3-f9de-4454-9df2-ee28141a5e79", "value": 150368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193790, "uuid": "a92bcc6a-bce5-4e48-8fe2-e2ac7b1ad75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193790, "uuid": "0dc49313-02d9-44d8-95d0-add87c3ac51f", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d0014e-0a9d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771180525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180525, "uuid": "9e21d5a6-ded9-49c7-911a-b7b2354fb293", "comment": "Malware payload", "value": "b55355556a548fd42bcc990e8de82713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180525, "uuid": "3d914bfa-69e1-40ba-a965-4c9717231367", "comment": "Malware payload", "value": "9ecf76d9fc252698333543964408bff2c6db638f25edc3fdc773d7e4a396020e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180525, "uuid": "13b3f52e-e834-4cfd-86ff-fd8a605cd6e6", "comment": "Malware payload", "value": "284c5a3c9c43194f244bdb82489b75760a571d7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771180525, "uuid": "51d832ec-2a66-4b13-8779-279aadf028c8", "comment": "Malware payload", "value": "987e1e3a88d3b9a845d8a47f6ffec9e1b9c52b43ce6803d8451b26f00b8e29c919c9423c4614dccd8f9bc74778fce1c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180525, "uuid": "93851871-9f83-48a2-a9d8-b877729a54a4", "value": "T19CF3C8069F520FBBC86FDD7302E90A1139CCA81716A53B757674ED28F60A58B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180525, "uuid": "704bf223-36f3-432f-a83b-92d78a5ee286", "value": "3072:1dFwBgnT/kWhExi+MPU/+hYacAfcsqpay:1dFweExmZWsf0pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771180525, "uuid": "60df0c14-3b05-4466-b6d8-92bf83edb317", "value": 165896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771180525, "uuid": "5d16d8e4-bcec-4d08-af99-6eeb857e18f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771180525, "uuid": "b4ba25f2-5d12-4806-8efe-02bbe5a15e0b", "value": "israel.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e2201-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120207, "uuid": "21f593b9-5e30-47a6-9616-97a505d3eaa7", "comment": "Malware payload (Mirai)", "value": "43657d7714305760aa06316623d11218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120207, "uuid": "53834c74-dd53-45bf-b4fb-49debe3e0068", "comment": "Malware payload (Mirai)", "value": "a396ee5a6cc14a9288839bc0a2ed31921b3a715f8de52d447376dde60035362b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120207, "uuid": "a307652a-0068-4988-a8f2-9932e46fd206", "comment": "Malware payload (Mirai)", "value": "6500bda7e1abc4d4ab762f056163326de24ee6aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120207, "uuid": "061bbf71-3f12-408f-9a07-29676cd055bb", "comment": "Malware payload (Mirai)", "value": "4f1c79af6975e7248da3cedf76ad8c390cbb053791d4b13060a656bd9b3cddbfe9d21faa6f9a2ce4fa872aee45fb63c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120207, "uuid": "6198d7b2-2ee0-4d6e-89fd-c46a4f890599", "value": "T11C93180377080F47D06328F426BB5BF187AABD6118F5B284751AFEC99271EF26142F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120207, "uuid": "beda7194-5776-4183-9ac2-dd6bf43ec166", "value": "1536:eLsW0DCsRh/6YICSw7gSKWF/xzLntTwDq2AIlqT4thnrLmvdhpx:eWvRYY7m+ln6lqT4rOPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120207, "uuid": "04c95f8e-dcc1-4349-a4ac-4cd24206317c", "value": 88820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120207, "uuid": "ad1b31a5-97ac-4ed5-bc68-116fbb92152b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120207, "uuid": "41e30c91-bf72-41d2-a4f1-089014d56c31", "value": "manji.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc306c7-0ab9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771192881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192881, "uuid": "ba51da04-967a-4cf8-8b7b-fc0e96a62e24", "comment": "Malware payload (Mirai)", "value": "a18fbd32c8f6545a7b57bedd71a6978f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192881, "uuid": "6d9ce2f3-fd6a-46e8-a92a-908506094fa4", "comment": "Malware payload (Mirai)", "value": "a4d11a7ae26740bf1de2d2f1c37f0fcef6c077d5ce3ec87d2909c51ac35530f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192881, "uuid": "b3b6e295-e52d-4284-8763-9e456911c046", "comment": "Malware payload (Mirai)", "value": "bcdaf7251d853fc993891e4bf47911cf46f1a9a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771192881, "uuid": "4e769f07-1708-4d46-8852-d17e44dc76a9", "comment": "Malware payload (Mirai)", "value": "85e0cabe4f2a268c0d264cff856f3cbf21c6e7f6b4b68bc73c2dc94b35f6f3b5d43ef39d341df7cfeb0a50d9383bc1b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192881, "uuid": "397e1a11-8373-48e1-a41e-6393b96952ff", "value": "T12EC34C1775D0C0FEC8D9C1B44FEBE526EA73B0291134B61E27D86A261F9DE20AF1D660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192881, "uuid": "6cc0302b-2bf1-47f5-b335-c136b6446bbf", "value": "3072:3kqKDgAiTiWM12NdzsiBMs7VHUJUBvEP:YRnkKgB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771192881, "uuid": "209fb248-f0f9-47c5-a8de-893b01ccdf21", "value": 126856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771192881, "uuid": "4abdb3fe-0f55-47b8-a7e0-be75624e773c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771192881, "uuid": "f2cbfb04-4e02-4d35-ab74-d5bb570330e1", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84e5f5d-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120208, "uuid": "5d8c7ee4-0c0a-4166-a871-3be1d5b807d4", "comment": "Malware payload (Mirai)", "value": "274b3ae42a0742d6aa0a3f6101dad7ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120208, "uuid": "01f13a20-1dee-4339-b616-6954b20aaf7b", "comment": "Malware payload (Mirai)", "value": "a5ed870a754af58eb5ef2e347dfa996d5447b3bc8cebadc3f8fd5b4abac54238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120208, "uuid": "7b33ddd4-7a50-429f-81e2-5ac260104e9e", "comment": "Malware payload (Mirai)", "value": "e04055d2acfc01d31f59bbd9ab4d4e9c724a1c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120208, "uuid": "49b2d258-e4ef-4f9f-abaf-e9452da3d5bb", "comment": "Malware payload (Mirai)", "value": "b749bcd09707211d98ac68be59171752102326dad585f0071e35ae3a0427ddc5559ac8399ebd36cbe126bded483a70ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120208, "uuid": "0f00951f-0e64-4a92-bfd7-b6d57fce4fc3", "value": "T11FA3F887F901DE7FF80BE6BA449309197520FB660E530B76A367BDA3AD311D41922F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120208, "uuid": "5a982ab5-a2db-4f5d-9e88-62e1fa5fdb0e", "value": "1536:3yD7f6hZC+TxtRnuqI5fQ+7SAsNYpxl068Fl4/zW0IEpmPZY/hdhEhDhx02MV65B:3ynSLjI5zsNuxl0b45Ix+V2MVEOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120208, "uuid": "0c650f74-c37f-4d51-98a2-5f96589cd010", "value": 99692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120208, "uuid": "f7f470a2-6df3-4ce7-bbd9-c6abbcba5990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120208, "uuid": "d07159da-b9f6-4557-bd1b-6099befcc25f", "value": "manji.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd54663-0a76-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771163997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163997, "uuid": "ad48cd25-6d82-44d7-90a2-e5f12c008b01", "comment": "Malware payload", "value": "4ca868b8857f09988ac2c4426806150f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163997, "uuid": "bb907795-ac97-43ce-91c8-ccefc17a148a", "comment": "Malware payload", "value": "a9ac75edac52f05e1a07b0447cf8e58b5d90eaab16f01ee19affa1cf9e599da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163997, "uuid": "624e3e30-5636-4100-b443-74ee42aec357", "comment": "Malware payload", "value": "97978fea3ff692ee9c056866dc8626c29e78d67d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771163997, "uuid": "aeb54cf0-c91a-4669-afdb-051c5c79c513", "comment": "Malware payload", "value": "7c8905dee5951d5a86dcfd99b8da4ff15b510c63e99a4bfd8a6b4eb5ce2355b6f9d6065915f026a3cd4d9780575562da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163997, "uuid": "c74c83fe-a4c4-4ae0-960c-0501a45f5e22", "value": "T15597D033A652C223D7920071CEAA5ABD576C3E2D1BB132F3768138EDE9745D56A38313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163997, "uuid": "eca3e108-d645-4008-b16e-17a42998bf7a", "value": "c9b67774a6e043e2b5c5317847919af2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163997, "uuid": "bf77d4bb-d4f1-4236-967b-ed22995df73d", "value": "786432:rNc2T8dOO1/RCvc+5CmS0eZ7OwKFXtoXz8JI2G:rNco8gO1/RC5QvZ7O3toXz+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771163997, "uuid": "6d76d96b-484d-4768-9183-6435353b8f56", "value": 42444800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771163997, "uuid": "76ee84fd-ee59-4a7d-83fc-78f0bbe89f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771163997, "uuid": "73bd90ae-e98a-4ad5-9a46-888087fdce7e", "value": "\u817e\u8baf\u7535\u8111\u7ba1\u5bb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ede3d5-0a4e-11f1-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1771146863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771146863, "uuid": "24eb0e6f-2841-4984-8fb3-0e4b55ccc93c", "comment": "Malware payload (VIPKeylogger)", "value": "455777ff7363780de9f81e6e9bb11f26", "object_relation": "md5", "Tag": [ { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771146863, "uuid": "a9a41943-8020-4a08-a081-e26ac4c881d7", "comment": "Malware payload (VIPKeylogger)", "value": "a9cce38a5530477894c07177ace3681b671bcfb5257d8219eb324970044ba3d6", "object_relation": "sha256", "Tag": [ { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771146863, "uuid": "ece7eaef-e45f-40d3-8858-5d9cf4d3cb68", "comment": "Malware payload (VIPKeylogger)", "value": "e9c611582632e73ecc4b246ad4fb0b9bfbd0508a", "object_relation": "sha1", "Tag": [ { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771146863, "uuid": "6f4b1273-6fee-41c0-b681-ea52814ca38f", "comment": "Malware payload (VIPKeylogger)", "value": "5cc7335a96c7e0e7a8c4e25fbd6dda0ce7fa399f8399a767d626cf4aa492a6cb4c467d727443990f6db77b4993ea1efe", "object_relation": "sha3-384", "Tag": [ { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snake", "colour": "#BDE377", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771146863, "uuid": "b2279f9d-2abc-461c-bfa5-10225e15bb56", "value": "T194D5333D19AB57A010D38CC8EB850D6FB9C373B2448923856DFF52ADD2EACD9178D624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771146863, "uuid": "c207e023-4f82-4bd2-a6a1-d1e5923aa3a9", "value": "49152:AtQ0udF8XtpV5vS/7B31N21ny+p9jIg9WoKkSBYm1IOEi765YtfyBmH+n:A2R4Q77Nin7jIg9xjSBYmNrfyBmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771146863, "uuid": "9cf1823b-1c2c-4a61-ace7-e792950cce8e", "value": 2811824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771146863, "uuid": "bc2b4362-a712-429e-b279-4598f61438c7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771146863, "uuid": "7583a027-bbc3-4bb9-93a3-71651cd822f1", "value": "Doc2803826741 - RFP 6008874822 IKS 3117744344.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd00da0c-0a01-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771113854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771113854, "uuid": "7d7654aa-45e8-4454-9e8d-f6ae5e372c3e", "comment": "Malware payload", "value": "e4fc6a9ce9056e100798b7cd8fd063bf", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771113854, "uuid": "13f2e5e3-778b-4840-a7fc-5e34581ddd06", "comment": "Malware payload", "value": "ac3c27100a757c06f60f1f43fb703bf3a980587bcbee84e90ac6088d5285b38c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771113854, "uuid": "d34f5593-810b-4b62-8c6e-092f2494c6f5", "comment": "Malware payload", "value": "8b90ddd81d9ebf4fe2db4512fabf90609fb7b3ce", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771113854, "uuid": "f1cecaee-90ab-4921-8dd7-e1476ead034d", "comment": "Malware payload", "value": "eaf51b975a5213fe8b7031a9b9334209cee3aa8f37702ca16dbdc9535360c8b577c597d2089c2e466d996ce779d460ef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771113854, "uuid": "ae655d4b-b2da-4bcd-8679-b4e72a2e1829", "value": "T1E544E25D54FCDD57F85E75F0CD14399007BA26A0E1BB259A02A313DF5E2AFBA90C4306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771113854, "uuid": "30b74f91-a5b4-4263-a009-775aa4881919", "value": "6144:r+P3Kh3Ka3Kp3K13KO3Kw3Kg3KM3Ko3KS:r+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771113854, "uuid": "065985ea-6c9a-402c-9b35-5af59d62d43c", "value": 253837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771113854, "uuid": "b2db173e-9f29-4360-b042-62232571bfc2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771113854, "uuid": "37c3b708-f91a-4283-b5fa-5b53d2bb6960", "value": "%D0%86%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D1%96%D1%8F.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431dd715-0a06-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771115743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115743, "uuid": "7b86c76a-4fb7-4e70-8d6a-89d09f2416a6", "comment": "Malware payload", "value": "e05e582e1e182dce1870909a8e8414fe", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115743, "uuid": "7556b3f4-89ff-4302-94c0-bc15d65e773a", "comment": "Malware payload", "value": "ad35d8ae9e9814338eed0052f67a6e6acf1c5860d2679ae59d687093b9caa53c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115743, "uuid": "52c017b9-611a-4518-a9f6-cc06c7fdfb44", "comment": "Malware payload", "value": "fb73b1fd9ec5f32f8e421f51cfa0d7d86759a9e4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771115743, "uuid": "37e61249-d57f-4145-8b49-e619657a8e6d", "comment": "Malware payload", "value": "53ca77bed9e88a176318274d56779c96700ac682bfdaccfcb0b3fdaae7e34bcd6765e0c144d9aaf99d2bedaa728fe6b4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115743, "uuid": "cd03b22e-9dea-4b98-bfba-af623d83a505", "value": "T17244E16D54BCDD57F85E75F0CD14399007BA26A0A1AB359F02A313DF5E2EEBA90C8306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115743, "uuid": "865e2dd7-8702-49ec-bd1e-e3dddafbac74", "value": "3072:Sqm908oqm908Dqm908wqm908Aqm908zqm908Fqm908Rqm908lqm908xqm9089:S3Kh3Ka3Kp3K13KO3Kw3Kg3KM3Ko3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771115743, "uuid": "166ab979-299c-4fd2-a9c9-3d87f11b1260", "value": 253840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771115743, "uuid": "b2060dc6-4132-4141-aedd-4e03299c5675", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771115743, "uuid": "7a5e3de4-c1ab-42e0-9697-bb20691d92c7", "value": "\u043f\u043e\u043c\u0456\u0441\u044f\u0447\u043d\u0438\u0439 \u043f\u043b\u0430\u043d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a4f692-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159288, "uuid": "e8a9c276-5ed6-4c85-8411-a221298562c0", "comment": "Malware payload (Mirai)", "value": "f9be1f2d012544d6eb3ae1b60d607e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159288, "uuid": "96f87596-a9df-4708-9bb4-f8ab291975b5", "comment": "Malware payload (Mirai)", "value": "ae00a052ce855b22d7833328c8629c833fb9531b4ca99490455275b4f5df922f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159288, "uuid": "6d48f091-f071-4ce5-b574-2136d0d597e9", "comment": "Malware payload (Mirai)", "value": "149c71570e4606ad5e6677c229a7a3216984798d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159288, "uuid": "ac69b765-8065-401f-8204-810ed33b13a8", "comment": "Malware payload (Mirai)", "value": "cc82d44b8a1d8dcc67c8c78804b981dc99c7af5b1e89e582f7d9f3477ad6808547bb9b72512a86bf57c5a0b099bcf320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159288, "uuid": "bfc072dd-19cd-4193-bbe0-82213236d1e3", "value": "T134D3E942BD419F13C5C325F7FBDE42983A166B6DD6FB3202A9257FA037864D60E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159288, "uuid": "906ff477-1d7d-43ca-a1da-f56c0f03dfa5", "value": "1536:721Bb1f/Xa86q8m2NnGeWADNzTSvCKPLxkOdr7Sy007R4+l8UwywqZnG/ZxHOf5h:7MXf6q8m2NCAhwCKzbx00Vc7F1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159288, "uuid": "2d34957e-0a20-4bc7-83f6-02c1781b0a48", "value": 130920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159288, "uuid": "3d5c929e-c830-427c-8ce2-3dfc573d3661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159288, "uuid": "ca5226fc-a3f0-47ef-b240-e668b1e4b5b5", "value": "israel.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1732db00-0a94-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771176658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771176658, "uuid": "7226312d-8d42-46b1-ab9f-913d5357fd74", "comment": "Malware payload", "value": "9bfccab6ea36e172003c3230429fbffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771176658, "uuid": "106877d3-7ece-4bc1-8684-3b887e495ea4", "comment": "Malware payload", "value": "af3d7d49ff847c2657ae2c8ded12c61928217996ab177b756e7fb7fdcbfd2704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771176658, "uuid": "012a29d6-aef8-4aea-b850-5eba307a7aae", "comment": "Malware payload", "value": "c94fc53f83d0c5c9e35ddfb2dbc5429e1ab632c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771176658, "uuid": "3bc8a1a9-4060-4bd5-b62b-69e684477034", "comment": "Malware payload", "value": "768344829987c67ef5a3b69db96de1665c001a9c335c0bd3521e191af01a23e62a2874d8794b1deaf49f1f6fb0642306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771176658, "uuid": "240f07f2-d27f-465e-9ab2-76bb5eae0d19", "value": "T105F76A4267EA04C5F9F79A3499E25213D673BC067F3082CB325C172A1F736E09976B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771176658, "uuid": "eafa36a3-17d1-422d-9423-2687f0cde550", "value": "f205b027c46cadf1e2534d1aa11a4093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771176658, "uuid": "497ed0ef-f1f6-4619-bbb9-0188fd70d1d8", "value": "393216:SQaAlwWEraEssgBjgV0XR/3tVe+6dAy6FPWv+hZQu58EISEhoIaE2FShX0Ix6VGK:S+3LQxhnLUYg3muRovxOOxUj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771176658, "uuid": "4612cdcf-6b51-44a6-be23-4a3d5d5c6cd8", "value": 71526400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771176658, "uuid": "6e3d16f8-76e2-46f6-843c-b506406fddc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771176658, "uuid": "e72fd9dc-8b13-4a7b-bd7d-ea7048f94e50", "value": "SecuriteInfo.com.FileRepMalware.71999277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57758a6-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120203, "uuid": "3781166b-a517-4192-9aac-085e6557aaf9", "comment": "Malware payload (Mirai)", "value": "a4c637216d35cc8499fd368b76b9dc56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120203, "uuid": "25cfc6f6-8116-4cb0-8b9f-1d1bb022f554", "comment": "Malware payload (Mirai)", "value": "b034b45c2b163d091c32796bde45e928320530b922939976561e33a45a6ae591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120203, "uuid": "ddc5a8e7-0a7b-4a3e-b18f-9fb64ebab2b8", "comment": "Malware payload (Mirai)", "value": "90167020ee7bcb3fa7edcb95ec5e344a9af9ec01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120203, "uuid": "97a57dfb-371a-434b-b7a7-64c304195b3e", "comment": "Malware payload (Mirai)", "value": "ebbf3c7962f8a6d0c1dfe00da0d960388246a934f4a053ace65fc0ae77ab30ecaee8f6307a8c9f4543acb19c837c463b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120203, "uuid": "9e7e795d-fd7d-420b-9461-8013d8a57c87", "value": "T1BC930C46B9528E12C5C212BAFAAF415D33136F7CD3EE7212DD20AFA063865DB0D77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120203, "uuid": "e141b5c0-525d-4512-88b9-22c4018c6619", "value": "1536:870nOhjxCMMJEl3EVupOFnjRfGqtCMPc5pyHtLoY08ivJa2RPk0aDQOiFYgNf657:mtCxEqVupOFntfGqtCl5gHZo6ivJa26d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120203, "uuid": "7364dd73-9661-470b-98d0-f8340c3c5931", "value": 96872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120203, "uuid": "c0760104-993a-49a6-9919-ffa2ce69f0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120203, "uuid": "173e8d01-8a77-4900-b02c-ad98bf670bce", "value": "manji.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a4da5d-0a08-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771116632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116632, "uuid": "deae70ee-d411-4abc-bddf-fca37d074136", "comment": "Malware payload", "value": "0ff2ec4efea2c902d817e57084452ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116632, "uuid": "8194579f-b7f1-40e0-ab5c-7a936583dc45", "comment": "Malware payload", "value": "b550ec299edc05c8cc126591976c676b65c492c8ca7b85e6f65f3878a8527205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116632, "uuid": "3685ea9d-c1f8-47b9-84d1-06034c15db6f", "comment": "Malware payload", "value": "b7c16e0dd63f6345c2a0ac5982871919eef72008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116632, "uuid": "0c3f76d8-185f-47d8-83fb-f4512b370527", "comment": "Malware payload", "value": "cbd8a3ad48563d6bfceefaf355e8faa79b416d242b570141878cc5872ae57009b430d7797e568f5d27a872ae11b5e112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116632, "uuid": "85083258-0975-46e3-88e6-dd2c3ceb13de", "value": "T1AEA4234DF646D8A3C59B1734CF5107FB74DAC1AA3538EAA7C818356ED8B41B2034D1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116632, "uuid": "43ac4fa0-75b4-484e-a63a-3a6c7a1d0c9b", "value": "12288:91jw2rcaoqHleD4kafbe37yay7ZdIaroO:L8VqHl9Rfbwyay9df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116632, "uuid": "759a8dbc-34c0-4e96-8b68-0846a5c69337", "value": 460559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116632, "uuid": "0829c8e2-6a86-4ed5-b229-da0681034659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116632, "uuid": "b2bdbb0c-9646-4ab8-93c5-35c623441cb5", "value": "bizy.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f883f8a3-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771118195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118195, "uuid": "81085e5c-2a2d-42c6-91fd-9b575893317e", "comment": "Malware payload (Mirai)", "value": "608d65d650cf06363c33c70b391f148d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118195, "uuid": "97dfd0d9-c916-405f-a8fa-7432b6678eae", "comment": "Malware payload (Mirai)", "value": "b62bfd01bac40dec3cb308f63a7c439581c958d7dcc1652d6b1f35191c36a8ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118195, "uuid": "bb2ca394-42b8-4aaa-be0c-485295de7adf", "comment": "Malware payload (Mirai)", "value": "39cdbc969f1ec6a84c31d70fe82cef8fc72cb556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118195, "uuid": "e9601a2c-9d47-4a65-8447-341e3b018e61", "comment": "Malware payload (Mirai)", "value": "0065da0c96c73d92b81fb908f96a0b279d311bbdcf58d22484256a5bb95c085182ee7d809d704f1ccaa27cb5f36ac6f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118195, "uuid": "3651f431-4ebb-4008-bbf5-44c90c692d86", "value": "T197B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118195, "uuid": "a854a90b-77d2-4574-9b46-ed68b56e4e22", "value": "1536:sUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvl:9ixnUHz4Z+5ypkn3E8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118195, "uuid": "c1764d83-6cb1-48cb-a3c8-89c638342858", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118195, "uuid": "535020e5-1ff0-4c97-8503-b179a535edee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118195, "uuid": "4eb10651-7523-4366-b299-3feaa9e66828", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1052d6-0a77-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771164270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164270, "uuid": "651dca99-124b-40fa-afdf-b1c8589e5c5f", "comment": "Malware payload (Mirai)", "value": "0e8c2c3127861013940f41184cfc062b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164270, "uuid": "ecc24bd4-e00f-4207-ab18-b20634706e34", "comment": "Malware payload (Mirai)", "value": "b69faaf6e8918063dbd5e5b32a639f7a8b1f7419f684bbef41f001d72e513dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164270, "uuid": "f95a343c-6baa-413b-b7bd-a2b98d06a81d", "comment": "Malware payload (Mirai)", "value": "4223506ba750b14ffaec798e9e0ac5ede033b9c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164270, "uuid": "291fac56-0a19-4922-b466-9e1112114d3f", "comment": "Malware payload (Mirai)", "value": "f2744b2b6bb4e6cf988534359319a9fdde1ae3bec901d0dbc9611bb97c79dc14d3b1cfacf16ee00e7a175e301b4b8820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164270, "uuid": "132e908b-ab54-4762-8c57-b1c095bc70c2", "value": "T1CDC318639D26AF0AC227E5F062F68E341B53BD2648570FF9A476EAE44143DCCB5053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164270, "uuid": "c9787a99-f5bc-4184-8db6-6256540ea67d", "value": "1536:nKVcQKeSFSPOeiCVvKjlRI7JlH75W7aR8DBWGynWZW7S17bCv:KVmeScPa8yjAH75DK9WLnWZYabC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771164270, "uuid": "edf8707f-a2fe-46ff-86af-1a794117feb9", "value": 119688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771164270, "uuid": "8b00e557-11ee-424d-a671-a822dd28db6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164270, "uuid": "e338c918-a1f1-40fd-9e6e-535894d9b744", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ae601f-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193785, "uuid": "09675bd4-62c1-454a-aebd-0983f200a2d1", "comment": "Malware payload (Mirai)", "value": "d4b165b8a659b974337693b51ee1ed2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193785, "uuid": "965ef7bd-88a4-4868-a142-d203388cdcfc", "comment": "Malware payload (Mirai)", "value": "b8f0a3df290c2394e4b3e3d7fd89dfbebd14ea231e396a2385932e2caee162bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193785, "uuid": "5fcc0690-969f-4de0-93ea-b44365e3153e", "comment": "Malware payload (Mirai)", "value": "7495f798f3b515edc01b1b4f2e67690bdea68e82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193785, "uuid": "e73d922f-21a0-4737-8982-a132825deb09", "comment": "Malware payload (Mirai)", "value": "a43b21243f7b2d75cbd62c719126c1baa5fd991f1d8c02e30ec1fa6cf0ee38e9c0effcd2213cddbd6c856c1610a08ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193785, "uuid": "50c9be23-fe21-4f4a-a0dd-932d966f9ca6", "value": "T132D30802770E4E43D1233DF0277B2BE0879FFD9228A5A580752EBEC952719F26445EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193785, "uuid": "8bc5292d-c0e2-4daf-a9d4-515c9679b56a", "value": "1536:HyC83HbYXipxvBkcIBl+Q0vr9ehd+A30g72H/+qhvAPRDyK3x++MLXsWhG1qA:HlM7eipxvqca+XYhT0BSPhehG1qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193785, "uuid": "8f6a41a8-f6b8-41ee-be4e-0aaab4d37261", "value": 136652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193785, "uuid": "7075dd02-c07c-44a5-b3fe-8eb0c118d4af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193785, "uuid": "503c49ce-35d8-4770-8589-41cf2210593d", "value": "israel.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5c3b0a-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193872, "uuid": "725396b3-eaf5-4d5a-b36e-3e1c78ff8f96", "comment": "Malware payload (Mirai)", "value": "2be3c8d490fa8141bc313451479b3a56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193872, "uuid": "ee912014-2309-4285-9a76-6ab3f25bbf1f", "comment": "Malware payload (Mirai)", "value": "b9554980b9f7d0182937d3183ddddb9d4a65e65260b6697c6a1901cf32e522fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193872, "uuid": "a97ec1e0-e9cb-4805-a652-4616bfd0629b", "comment": "Malware payload (Mirai)", "value": "e89d2e67f5ca523e94e4fb9f15859fd9d657b149", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193872, "uuid": "1365c122-52e3-431b-8202-dd8018a77185", "comment": "Malware payload (Mirai)", "value": "9848d1b25733e6f6a1359a4ab96193dc0cb9aef8b6d54be155327c9590df74fe0a48807280c48c12be94303c62b10000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193872, "uuid": "160f288a-017d-499e-9950-d9ea7ad2616f", "value": "T1E3A34A85FA83C2F6D81704306062B73FC731CDA580B9EA5ADB9A5E35CA37541C7263B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193872, "uuid": "13a633a9-508e-4ce6-83f4-b0c833225fa9", "value": "1536:/+xr9S54MRhkQ3jfHxRO36iZpvaAH4AWkSjIyIZ:/+xrMmhQTHxo6iZp94tjjIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193872, "uuid": "a4879027-3801-4ec3-bf8c-fbcf088ad766", "value": 97768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193872, "uuid": "4036f823-35ae-4684-a7ca-9ae05e97b401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193872, "uuid": "1c75b793-4a3b-4769-ab4e-909db8d4af28", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fec7b6a-0a0c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118476, "uuid": "2635ffa3-30b2-4959-87a3-c34199b9e9ff", "comment": "Malware payload", "value": "c88f7a74c93a58b8181e4eda78b2d01f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118476, "uuid": "090c55dd-7781-4ed1-8dbe-eda4f79ebffb", "comment": "Malware payload", "value": "b967112eb909f04f1d94a5d748af30eea79fdcecd91499242aa7fc4fd8a36ace", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118476, "uuid": "7c004210-88bb-4307-bbdf-d4cc2ecb61d0", "comment": "Malware payload", "value": "66dd15a7735bcfaf22b251a2595bc719e6f99119", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118476, "uuid": "664800c1-1823-480c-b4ec-c3d15625ea8f", "comment": "Malware payload", "value": "3dc35e4dac23c3a444f8d8c1abdcb3b36ade7e66c95b022c7d8b2e7e29a3f42c8bc28f47bf783a30c10e52d64f730ad1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118476, "uuid": "0e0ee79f-e242-41e4-a5c7-7b69829feac9", "value": "T1955733E5CCE62B5FD43FB471C9A58A0A71997E2E28470DB07DECB35236F3B906621604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118476, "uuid": "b1474a35-8627-4d23-a09b-7cf305518bed", "value": "786432:2qs7MJwJkGC7ZthRf5zfZUDuFNf9ZhagF6aJ4KaGL:0butvoDSN1tnLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118476, "uuid": "b1afafb2-a4f7-4011-bf0f-282fbfdf482d", "value": 29274112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118476, "uuid": "5435247a-f1a1-4f55-a974-afdcfc76daae", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118476, "uuid": "94fd9eb6-7532-4247-891c-20b21764f332", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f24e86-0aa9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771185977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185977, "uuid": "b74ae4c4-a28d-4dc7-98dd-70d904ca8c9e", "comment": "Malware payload", "value": "3ffaad7e9e51b07906da9d61ad39404f", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185977, "uuid": "2e50bd0c-c258-4c46-9f5b-fcb2cad23f94", "comment": "Malware payload", "value": "ba01212cab818c10e49100909a254a5435cef8b8303fa6fa06a233d53ce9851e", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185977, "uuid": "cfc482d1-88c6-40d1-b18b-e8604d08537b", "comment": "Malware payload", "value": "2c5eca61f0f29eaf8a2e95112cb17b2ab2b21aab", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185977, "uuid": "326255ee-9587-4529-9ab2-26c481df1165", "comment": "Malware payload", "value": "070d5e5ce13204327cf333e046d97ebff06f60217e57870ce72ced4693023d68cbfb305219e3f08b3957d8961978b69f", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185977, "uuid": "a86cf22b-8df9-4a54-978d-918d536a40ea", "value": "T1D0348E21B992C432C66B09B39879DF69493DFC514B7165C763C41EFECA206C1AF35A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185977, "uuid": "0645d0c1-73a3-4c7d-aac7-82535c71d5c3", "value": "00e004ff0649be67e6fbb756d37edeca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185977, "uuid": "d048cfb8-7a4c-47b7-ab22-bc7d42ca701b", "value": "6144:og3gtnmRPCbvN8EeeDb0ZH0mTznfSYiH9n2KdO:LymRPCbvN8EeeDbcnqPx2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771185977, "uuid": "53fb24fd-8021-496f-a0c4-3065d6df3421", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771185977, "uuid": "393d5308-5bf2-445e-82c3-d37bb32daabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185977, "uuid": "31335ba7-00f6-4533-aaa9-b98ccce34bf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c91bedf-0a78-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771164695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164695, "uuid": "9daa2f43-7c65-488f-96e2-6b459715aa1b", "comment": "Malware payload (Mirai)", "value": "ea58af70563e3ea3dc5e09c980d08655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164695, "uuid": "9e4c0d98-6a5a-4932-be2e-b17aa792a84c", "comment": "Malware payload (Mirai)", "value": "bbbb2273d9cc7ae78b271ab36978281caefa16dc54848de9a8bbbc98b8f0765b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164695, "uuid": "6b5021cc-5bd1-4cf8-b1c0-5192fd66c31a", "comment": "Malware payload (Mirai)", "value": "be052f4472b66220747b5f381a75f6f2f392594e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164695, "uuid": "3da8d86c-39a8-4fa2-9445-0433d9d033be", "comment": "Malware payload (Mirai)", "value": "49f1ec10e3b7d6857de45d3ea18d7b43a1e79cfbf0eff3519d56c721fe0d8a2c028b89462ea03bd100123c18d00f03f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164695, "uuid": "c34bda02-1d08-46d2-b81a-d65e981fc75e", "value": "T147D308037582CABFC49BD1F44BEB95369D32F82E1935714A67A4BD921F4CEE02B1D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164695, "uuid": "e63f560b-a951-4a1d-962c-d7975b269f2b", "value": "1536:k6/4ljUU3JoMU+v3hmehZO6B8lci22l/wLe6d+alCz+vR9XKJXPIMQzmcFP432lm:k5KMU+v3TB8jv/wLnnlCa/KJXP6zxy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771164695, "uuid": "5acd3b9d-38af-4d85-b7de-239a4828528c", "value": 141784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771164695, "uuid": "b4c65370-932b-4714-b645-74ec197c98e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164695, "uuid": "42beb2d6-bb97-46cb-9a6f-c28bfe7ef3c5", "value": "israel.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcdd8c8-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150440, "uuid": "bf7a6eb6-f13e-41d2-9220-933ca995cf86", "comment": "Malware payload (Grandoreiro)", "value": "d45bdd2ff5ac9a4004ad4449d357d08e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150440, "uuid": "e727c1b4-94c2-4ac0-aa05-fc28d793a155", "comment": "Malware payload (Grandoreiro)", "value": "bd2e13fc462872ab2adbb730b0abe561b00e8e9d4626cd5b0c4d70c5f17e9635", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150440, "uuid": "9594f888-c947-48d2-8317-664165c5001e", "comment": "Malware payload (Grandoreiro)", "value": "631182bfe45a06dedd27635559b404c7fe69f28c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150440, "uuid": "02e63f72-270f-40e0-8130-decbe1963b37", "comment": "Malware payload (Grandoreiro)", "value": "884a8f2036e2f4dec0abe1a760dd24e58bd9ee83caf69bdda15c76539a12300d3cc68d6b595f5c1f9d7969b8c0309f6c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150440, "uuid": "df91c3cf-dc3e-4080-b249-f86f9a1ac72a", "value": "T15A362331F5A1187BC5D04739F07E2A117D3D36131B4C99D3B8ACB542BB43AE29A3E992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150440, "uuid": "59ee1420-95d0-4447-ba28-a027c014a55a", "value": "49152:+fFV9VERF3grlSc8r8eqBB1STWdSIR0+Ch+KSGaQzq+OREUMVWP83+33tu2bs1:u7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150440, "uuid": "75b1281b-326b-44a5-a293-88a7cdd0b7af", "value": 5183488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150440, "uuid": "4b89aaf5-7db1-4404-b813-12e0c3075c7d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150440, "uuid": "5981f626-8729-4f5e-aa44-c560b72fee64", "value": "Reg4N89BR187786-VZJUR.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f32ce4e-0a6d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771160002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160002, "uuid": "cbc733c6-03af-4c43-961a-db742ab4a498", "comment": "Malware payload", "value": "7a13c96619043e316216c1967e1071fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160002, "uuid": "28bb5837-a9b7-4b6b-a5b8-6424ead69c7a", "comment": "Malware payload", "value": "bd3a5f2a5cd3fcca90201c8914e3cb6ebc555ed48760a765f09020ecabc0be1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160002, "uuid": "c21abc08-30c3-44cd-b917-99cb6bc42db2", "comment": "Malware payload", "value": "4377560179a995bbf37b68081f891a640f28eab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160002, "uuid": "37bf9c35-7799-44e3-ae3f-8a90214f4ae8", "comment": "Malware payload", "value": "bf8a0b586b8c9403783db47e024081ee82d1f3e3d2547b25a9d35bf6f3235ad016f3de7474ebfc9706e321cb2287f3fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160002, "uuid": "14c68116-0de0-457e-94bf-8585ecec0302", "value": "T14974F751ADBFB453D5CEF6357722A6D9302F7284D0E5A035CAE1CA9846F9BA48E13033", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160002, "uuid": "bf8e8810-58ae-4bbf-a051-e8141aa3e6a4", "value": "6144:Sld0eWZ3XmYWpZPXVLQb28MHka4yegeNMok2/saPS/9HIUsirkh7p2GCDhGtRZEd:Sld0eWZ3vWpZPXBQSHka4yegeNMok2/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160002, "uuid": "dab37028-8775-4f07-8a07-408deb26cd3a", "value": 342460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160002, "uuid": "2a3c163f-9f64-487f-9f48-f8ed4834d315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160002, "uuid": "c9c99dbe-e001-4472-ade0-66038266375b", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfef137c-0a6d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771160191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160191, "uuid": "7465529e-6686-42f5-a063-bac8966279b5", "comment": "Malware payload (Mirai)", "value": "f3386a495ae9874b27a0894e661d0f45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160191, "uuid": "6feef5c7-dcbd-46b6-8c5e-aa113299a256", "comment": "Malware payload (Mirai)", "value": "beba0da09403077197d3bcc1414f8e83160c566a2784fd923ad33c604b495d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160191, "uuid": "989a762e-330f-4ea5-a5a8-2de29d5bf16c", "comment": "Malware payload (Mirai)", "value": "ccec6f927c62ed4f704b10637cee06c4b0f8ab64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160191, "uuid": "9d8fcb5f-c872-4f82-bf17-e4b03191c14d", "comment": "Malware payload (Mirai)", "value": "8c929e46dfb3053a518f19254f57fa9d168783b7f94000bfe2c1c045e69a2c28e9791fe8b05ef6f2bc712dffa0fe3baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160191, "uuid": "f847d798-01f2-4e9f-98bf-e34aee63e19f", "value": "T190A3C70E6E119F7EF75DC3394BB78A21925833C62AF1D585D26CEA005F6028E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160191, "uuid": "60802e50-354d-44ce-9efe-699336dd4d5a", "value": "1536:NBbnsj0YtBu2WTwQFJqvBeZHaZHpRHGgzuvCWTU4mcePUsnzCRF:3bsjNBu2WMQFJqvBRuvCWTU4mYsnzCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160191, "uuid": "13a5d63a-b541-42e4-aef2-021a3e82aa53", "value": 105924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160191, "uuid": "ee81d5e6-3886-400d-a4a5-19a2c549ea82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160191, "uuid": "feb3a306-3b67-449f-8374-dd7c1daed149", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f4dd3b-0ab1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771189105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771189105, "uuid": "742c5246-3ef1-47e7-9a0f-ccfdd7f0e10a", "comment": "Malware payload (Mirai)", "value": "3262401cb0e374f060785b36fddfa364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771189105, "uuid": "05c11150-cdf1-4296-b159-490bc8609eb7", "comment": "Malware payload (Mirai)", "value": "bf9028a6e7759eeee657800fe246f9468a13c9974732097c40aa4f308a6e5abd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771189105, "uuid": "5293274e-bcc6-4f1b-bb98-5b859a8ed0ca", "comment": "Malware payload (Mirai)", "value": "853f1262b7f9ddcaa9f0322f180ee076e0efc221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771189105, "uuid": "bdfcc767-bcf1-442f-a88b-270a7dd3868e", "comment": "Malware payload (Mirai)", "value": "679691b34657736ccbc43bf142c7dc1324cba74b632368e046625b05829cd91bcd4e2a66f794906d50b31e4ee9e28f6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771189105, "uuid": "4c94a77d-1070-41ac-98c1-af6ce1a12f80", "value": "T12AE30945FC414B27C6D612BBFB5E428D3B2A17E9D2EF71039D256F20378685B0E3A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771189105, "uuid": "4154da51-c106-41fb-93f4-af0a65a56532", "value": "3072:EhgZRLPgcjw8KTV/4mMzyli913o+FrjV:EhgZ1jw8Kh/4m+y891DFrjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771189105, "uuid": "de6cfa5a-5439-4b74-884b-7c141d141b21", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771189105, "uuid": "ec0fef55-5e6d-4726-9356-377afe6df930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771189105, "uuid": "fa1246cd-73b5-454b-bfd4-84cd87184cb6", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053d28fe-0a09-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771116928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116928, "uuid": "d96c4539-385e-485c-a6b2-7a57d1793309", "comment": "Malware payload (Mirai)", "value": "dd6b1a3c918c640a20e35d8bb00117c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116928, "uuid": "e7f87318-229a-4068-8dff-039835dfba97", "comment": "Malware payload (Mirai)", "value": "c28bb0854c6adbcaef89386033cff8b26227b328673eaf0e346a4b1cd4c25865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116928, "uuid": "03b061a8-46d8-40e2-a291-79cb3874b1f1", "comment": "Malware payload (Mirai)", "value": "61e87651eb01d7f6ab74a482eb072998dc8c840d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116928, "uuid": "0c444b3f-9d89-4eda-9c26-b15220a3c7d4", "comment": "Malware payload (Mirai)", "value": "b6f7e776296874b09091e59818614071197c8847e2a4fb8b84522ba732313e4dcc7650bc2f1d426e403a087406bc2f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116928, "uuid": "faa93e18-12dd-45b4-9c6c-f99e74c4e612", "value": "T1CB23F1E3275FD0B7D07A68361F3D1140E86AF462A31C2F0BC984253D5C652E59EC2BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116928, "uuid": "afc1342b-1d38-4e1c-a24f-335792400fc4", "value": "768:IptfxMz03QL34mE15tZaSpgZMr/bQ3+D3ziO9Eq+H8JPoA4p:8fezvbxE15t51jNKuEq88JAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116928, "uuid": "35489690-f5fc-4843-a4ea-74a9b0825ea3", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116928, "uuid": "4bbbedc7-0ecb-4f94-9b63-c0596adde314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116928, "uuid": "026ac1f6-97ed-46f9-bad9-ce7640b5b824", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04f6257-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120195, "uuid": "f8483434-8a99-4abe-8ae6-45d6a3dfb3dc", "comment": "Malware payload (Mirai)", "value": "2bb33b13a8b3405660c0181cb16b564a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120195, "uuid": "4e9664e6-9d26-4900-b50b-eb22dfba5e19", "comment": "Malware payload (Mirai)", "value": "c2dd56da154b5db6d277b27bca49c7d631695558113ff7ddff03c656cda97a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120195, "uuid": "d4b7dc6d-3bc1-44b5-aceb-cf741674b1be", "comment": "Malware payload (Mirai)", "value": "76d3fbbc0a40a9648ec9c01e6843cde7ade088b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120195, "uuid": "9d5f4f7e-d583-457e-a0b0-a163795af906", "comment": "Malware payload (Mirai)", "value": "93ca31473e3c71eb1baf8985875f1ef15e5e576a4a789cade1ee8a443803282cfad51e09f946460c3528730b5cf52e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120195, "uuid": "81da1660-ce4f-43fd-8978-1697c153f895", "value": "T104631B07BA428BAFC14FC1F407F76A399922BD7E0A36F1E5E3A4FD865901CD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120195, "uuid": "4e700642-2033-4d44-ba01-0c7d75cb3aac", "value": "1536:GnHkHRxHBFPSWGzNGIlGy5TGpWE7wH9OXEL9qC:mHkHvBFVGzNUytJE7wwXEcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120195, "uuid": "a34d0802-74b2-4b33-9913-bc39eb2d4098", "value": 69624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120195, "uuid": "256376ee-3225-4fdd-aeac-1ec5b2bf269f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120195, "uuid": "609d855f-c036-47a3-9c3b-d4694ce25d86", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f59247-0a56-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150398, "uuid": "7b0419d6-27f6-45a0-b694-3b3e4aa3d93b", "comment": "Malware payload (Grandoreiro)", "value": "4b0d04f689b59617865e3d33988ff88f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150398, "uuid": "6ce8ce33-e072-450b-9419-4e1b878a543a", "comment": "Malware payload (Grandoreiro)", "value": "c6a29a8252154d1057355157b3bab2780f29658806d606a9c200eb8666843d55", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150398, "uuid": "d7f4cb73-f974-4acb-ba9e-08c38ff486d7", "comment": "Malware payload (Grandoreiro)", "value": "5037ed71ee956eb59815d1630d285eef5f9e7d79", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150398, "uuid": "b2931e26-6b0a-4aa5-b70f-733964da3408", "comment": "Malware payload (Grandoreiro)", "value": "21d2e176dd8be8b814ad122271c38836d3c1909b54d97b645732a6a79457ec83c5972e13e73869b708118d7243711d50", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150398, "uuid": "3c3f754e-f9b7-4f6d-8341-bfe9ae927040", "value": "T18B762333FEC55C77C2904735B41F7B153E6E3E435F48A5D7A0AC3A862B66AC1483A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150398, "uuid": "1a1bd280-f978-404f-bc6c-ead0ef9ac331", "value": "49152:HHbL/cdsZpCVSdlyteVmUsMNpmm27jhrf4zm/t9nATCq2EbDUDJes1rycS8ITDYl:tICvMUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150398, "uuid": "9a68fec7-5ccd-4118-8539-81a8bb9be29d", "value": 7190528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150398, "uuid": "54759a17-c2f0-45c4-a15b-9e51c41288cc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150398, "uuid": "fff298c8-8ed1-4069-897d-11d3128caff6", "value": "PrdcA8KK4_40226JOXRIGRMGN5lfcgp.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8423125-0a6e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771160634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160634, "uuid": "72be2fbd-5e2a-4667-a9b1-d1ca38354610", "comment": "Malware payload (Mirai)", "value": "f78934bf74343bf8b32d9a3135bbbe9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160634, "uuid": "29d57bf5-b414-471a-917c-9d21cb10c69a", "comment": "Malware payload (Mirai)", "value": "c709ccffa8d7c9818a4b33f3c8e550823cc6bd2cb371de3fae8afa742e3dfc11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160634, "uuid": "5ebe76be-fb7f-4405-8c26-82d505a65325", "comment": "Malware payload (Mirai)", "value": "660f25c7d83e4f2ed6e3c3595f1d154f58a11f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160634, "uuid": "eb2ee5ec-7caa-4bb3-83c0-1017287a979f", "comment": "Malware payload (Mirai)", "value": "602816f970134430efe2895988aecb22558e05af6844e6abc03f947d15f621e1c576bbb753f1cb2d2f6d39833307bb80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160634, "uuid": "27c637bc-1b95-4d6b-949c-807576b0e043", "value": "T121C31763DD26AF5AD526E5F061F24F741B13BD2648530FBAA47AEAE44183CCDB1043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160634, "uuid": "95a96b90-9269-4017-a6da-27aa6a73f513", "value": "3072:WVYRYJLDfiV5zXFYSrfWMMUCWjX8wVxhSC:WaRsDf05zXFrEUvj3VxhSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160634, "uuid": "ac19d8d8-e7de-49d9-a7a4-e99e59171fde", "value": 119784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160634, "uuid": "86756724-feac-4457-85bd-1cb8adb46e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160634, "uuid": "94cdcbda-ce7d-4624-a102-12fe0231ade8", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a907178e-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120209, "uuid": "1b03ec04-185c-4926-a498-091d9dc13308", "comment": "Malware payload (Mirai)", "value": "05ba1eb41cadffe20d53b61f40cdb855", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120209, "uuid": "591a5ceb-9271-4210-b692-2ee470ece352", "comment": "Malware payload (Mirai)", "value": "c72b2c48ccdd3eeca1c404f3d58abfb3452eb5227c62eede646e798c36e96989", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120209, "uuid": "6ce7ba58-a1a2-4879-bc26-77037bc1b519", "comment": "Malware payload (Mirai)", "value": "04696f5c274cd1c7f19c6e44be0c38ff653e39f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120209, "uuid": "26a647ea-5513-4b5c-bb42-bc3457aa79c9", "comment": "Malware payload (Mirai)", "value": "a49d112cf5ee694c298e02a3afb029439928200fbd99127a702a4b340acbab6e69f458a1628626656bd23d3f717d31f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120209, "uuid": "921a285a-bb02-4af7-acd7-e841d15c4360", "value": "T1FF219A9E10A4651D508CCD4071BE16004B858BE57AF8BFE95EF404BB4ACA71077ACF6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120209, "uuid": "491dee41-4cc3-4092-804b-392c1d620bcb", "value": "24:6y9FNIzkK3H37EzyA79zmo6Xf3o29Pygv:jKC2f9aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120209, "uuid": "5e0c5bf0-a35b-4493-9bff-883ed24ae445", "value": 1131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120209, "uuid": "9abef2af-ad02-40ea-aa33-73874b9ca4c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120209, "uuid": "9c561f40-0f2e-4cf9-8d35-659abd982ea8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503cb207-0a64-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771156138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771156138, "uuid": "07393dba-839b-4f56-bd7a-72e03f1f725d", "comment": "Malware payload", "value": "1341cc2abdd83c63a06967969e6dd064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771156138, "uuid": "997ce3f8-0e53-433e-b560-baede9f294c0", "comment": "Malware payload", "value": "c7715fa575c7f7345bffbd9e1233d1948f4179cd8030c91c9cd22ee27885f40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771156138, "uuid": "08aec779-0319-4d90-949f-0e3ebc63ae56", "comment": "Malware payload", "value": "1cf22e645f09a755be2cee226550d7e517755ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771156138, "uuid": "fa5f989a-2f1b-4587-a6e6-c0bb052328a2", "comment": "Malware payload", "value": "b4a169a3b7cf48941ff4ea7cee226bd4c6716eafe4f3f2662bdfef41663d5bb87a96dbcfe80a05e6f469c7909eb8006e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771156138, "uuid": "f3853e95-0e93-4402-abb4-2030975f9c3a", "value": "T1CFF5236857F4112EF0F78F3066F12697E9B57E22A8744E6D1A8503AC0A36B10F97137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771156138, "uuid": "27ba7702-a1d9-4678-a81b-c8d5f13d000e", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771156138, "uuid": "ac85c373-352b-43e9-9974-9c68d7c87216", "value": "49152:RUKFTzROi3TWq7hxgLzKDgyWxCY4d1R+LcHkyuK5Q277e6xT1+/wiqV3tyg:pTQwVenKDkvW7+kkjK5Q2G6q/xAdyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771156138, "uuid": "93d6371f-74d9-436e-be23-53897cce4dcf", "value": 3346904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771156138, "uuid": "64fdfb2c-7cab-4d32-914d-a4c557cfb7e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771156138, "uuid": "873e439f-7df5-4a07-beae-755023cfc94e", "value": "_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a68427-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193788, "uuid": "aab6de80-904b-4691-98f4-5c3950163010", "comment": "Malware payload (Mirai)", "value": "6f7df8ad16cbfbeef4330b0ec17dc6d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193788, "uuid": "0a5c0cb2-f073-4d83-b0cf-9516e24c7970", "comment": "Malware payload (Mirai)", "value": "c78f27b4208ad3049c1d0ecb502b3ea3ea6e215cafff856abc2214c3e867a4cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193788, "uuid": "64c30c44-2e9d-4cbf-8f68-37e6c067837b", "comment": "Malware payload (Mirai)", "value": "9e5e9c25c59d34cf155f436e372595fde2d76c37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193788, "uuid": "ce6b098d-8c89-480a-837e-405514b76638", "comment": "Malware payload (Mirai)", "value": "234746be41b7978f4d75d9ef28021ca9f0e02d1e059ffde156d41fed609c05ce8c8e0a54d475f068dfd47c53a04cb42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193788, "uuid": "1a32f507-5c75-4a26-b92d-6f16c5f4fa26", "value": "T18823F17826C65E70DE7415F4EFA941CB63A39875C2BC7572230279B2FF02B41242E5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193788, "uuid": "e9cdcc69-8a4e-49fc-af7a-d12cdd2c51d6", "value": "768:vP6URumxuAevP+CMXSCwsL6TRofGEiWKOrlb1OZxvo2iuX/NosemP564x6wnadTZ:36URAX7MXcG6TRoeNOrlF2rXWEQ3wnSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193788, "uuid": "1107be86-265e-40b6-88ce-05e1f90bebf1", "value": 48396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193788, "uuid": "3e6ef843-6e80-4dab-8723-dba56d9169d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193788, "uuid": "863e1ba3-3d6a-4fcd-9b45-92e2a84abf1b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f18340-0a07-11f1-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1771116255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116255, "uuid": "a8e0fb2e-d785-43a0-a83e-1d347be24fa4", "comment": "Malware payload (Joker)", "value": "bb14b0990ac68339e078f71042860dfd", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116255, "uuid": "1af0d52c-156a-45ce-a5b1-5e160dca84a7", "comment": "Malware payload (Joker)", "value": "c79f9f1ffa9ba5b999d42f9a292e162d880c6d71e983b8890a8b8ba46c4748ba", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116255, "uuid": "30a10dfa-6e36-4f2e-bbca-93cf0c82fcb4", "comment": "Malware payload (Joker)", "value": "fb98489e2fc381ef7b02b253556fb1cb77434be5", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116255, "uuid": "ac1ba54d-7e26-4d4e-b0a7-9a6384b3c07d", "comment": "Malware payload (Joker)", "value": "bacf7221fef2ac863545404156eb6030dc3ed132a5e33b3d2f8752a213c6ce7bd80fd847776cf43ac8424e8481fc4781", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116255, "uuid": "ce6d9c07-177b-4754-b30b-71f67917e8be", "value": "T1A1C62342DB0C942EDCE3A0384DB905A2532B39DBC161E317A834717CADBB6D45F61BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116255, "uuid": "eea5a33c-3c25-4cce-807a-1578b8068cd1", "value": "196608:nZO7m+4OTasCP8VmMJebzUHO/omBhMoImpxtQXEtn4LmWJwWe0vDdSDw:nEy7eas3oMJ5QhkRQQ0tn2iWe0h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116255, "uuid": "44c85425-16a2-4cc3-81ac-0aea53c76562", "value": 12568252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116255, "uuid": "f938b2a8-40b7-4183-af46-ec33c6e13008", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116255, "uuid": "2aa498ed-b885-40e5-b3f9-9a97c85cf3ae", "value": "com.sherry.storage.lowcleaner_2.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97936885-0a6f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771160982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160982, "uuid": "f8bf988a-833b-481f-8961-60e5f61bf01f", "comment": "Malware payload (Mirai)", "value": "ca091ea07128b010c020c63e60a49484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160982, "uuid": "e7d3b269-cf65-4a2c-b9f2-2d69b5bf18b0", "comment": "Malware payload (Mirai)", "value": "c83eeb7ecd43733b6531c7c91ae8fbc7e964b33542a0187461006a039b869daf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160982, "uuid": "6ba23275-a74e-4709-88d9-7061fe60f25e", "comment": "Malware payload (Mirai)", "value": "29bf8405e912ede5bc06fdaf8390c2ee33baa8d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160982, "uuid": "6c448a22-85b0-4435-a056-b2b9de5c5e0c", "comment": "Malware payload (Mirai)", "value": "c973d11a5656b910bcee2521d73c21bb1164c408597b58e1f168a2ca6402199db8b8d6761f92bf792e2e2b101ac79d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160982, "uuid": "7c5873e2-0073-4ae2-8b4d-0413a7f2284e", "value": "T1C87329C1BC92892AC5D027BAA67E758D3391B3F0E2CF3627DD184B10228D19F5D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160982, "uuid": "849e6d1f-c01e-45cf-96f3-d71f6fdf4a9d", "value": "1536:E7YQrQ2gRSTr9LYmWdgZ9d97nteo+QWn+9W2jXTo9nrVB2ty9fKuL:E7lrQ2gRS3ymWdgZ9d97nteo82I9rVkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160982, "uuid": "c9920b00-6431-44bd-b30b-602ca1dd13d2", "value": 75204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160982, "uuid": "ead3028c-a9b1-434e-9fc8-0480f9ea073d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160982, "uuid": "eca083f9-5986-48ad-8f01-a587c81c3125", "value": "m9x7k2v8b3.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bdc901-0a70-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771161387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161387, "uuid": "23e5d3de-8ccc-47a2-b99b-4f04436ebe6a", "comment": "Malware payload", "value": "bed3434faa97e634a42d2ead36f9e2f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161387, "uuid": "c82a573b-fbeb-4a92-b04a-63d2288bff94", "comment": "Malware payload", "value": "cdb0690dace0c8f548441901f74051dc23f1e22d0720743b66581426072c5ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161387, "uuid": "c115b921-1d83-4193-a1dd-39b490447bbc", "comment": "Malware payload", "value": "f297dc16d0c78d5946831bcb8325318ad1235b3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161387, "uuid": "2b64ae55-6695-4dea-ae52-34711fba84ab", "comment": "Malware payload", "value": "0a6c85f457c3ab19aa6794dc6cd3b0fdc42a7152e647e215f7edbb76ba8fe4b82f45211cb7aaa2c6d92a3062827d49a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161387, "uuid": "1828242f-405f-4d1c-9643-f8ffb5c50471", "value": "T158157C9CF786E0F1F26340F1025EDBF64534A12A5013FAF2EF452A6674727A16F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161387, "uuid": "382d3b3e-1e85-449a-91a0-72900ea86c05", "value": "12288:wZsow2khDp4hU6hYQHkzLVgShXl0HyHyzxh4wWCDEPyI/LEDpJ0Lu:osow2KehU6hMzZ5T6GIxhhDQ4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161387, "uuid": "5bec8299-9144-4c94-b5da-a3586b6ad1aa", "value": 878712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161387, "uuid": "398c5e7e-ea9e-4919-bd79-0f2af487957b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161387, "uuid": "8aa34c4f-e25b-4d67-bb90-cc29068fb096", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90a1e29-0a97-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771178245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178245, "uuid": "abd02f14-5e65-4562-97c4-a077edc300fb", "comment": "Malware payload", "value": "54e0c239b1077b579a01fef34f5bbc76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178245, "uuid": "ba7fa522-e654-47d9-836a-31c062beff3b", "comment": "Malware payload", "value": "cfdacce3f520aa721111be50c6f5b567c42c5751c7b9c3413d14cc61f1668f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178245, "uuid": "ea58afbc-acfa-497c-a551-e3e0045e1861", "comment": "Malware payload", "value": "94c2d4f554f71cbcd78707a6b95b41e7d3d543fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771178245, "uuid": "b74e0b43-e954-41dc-ba93-0128945f6daa", "comment": "Malware payload", "value": "70d94d9b533b5b0eb89ae6d0e9adc04abeeefed48fa639ac503827bffbbeb83782fe03891adcf5a6a87ec6a220cedfe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178245, "uuid": "19548ce9-103e-4c8a-8bdb-2adce93dfa63", "value": "T1A952071B1BBAEE03C1D167F315E743A291EA5F95A4A4072F3E052C896E953401E36BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178245, "uuid": "056f7906-b2f1-476b-85e4-f3977d0df203", "value": "192:80Ntk14+qZuy4sB7zN8mgpC/aHXuOfJ29gtDB9jjj+49KOYak3hUM/eba:ZN1yUHDg+ars9MUuKVakWMQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771178245, "uuid": "3d255a7f-c630-4a3c-a10b-b8e1296e5bc6", "value": 13480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771178245, "uuid": "6782656c-21dd-46fe-a91a-808ef9db1152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771178245, "uuid": "3190ff4e-ddaf-4a17-bdd1-c344dc8cf43d", "value": "israel.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27ad03d-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771120252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120252, "uuid": "05f48e18-893d-48bd-ba2d-5e242db6adbc", "comment": "Malware payload", "value": "4c84bff59b7e8b2df76e38466ba8b627", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120252, "uuid": "ffd357fb-b78f-4d42-b1fc-1944be7cd731", "comment": "Malware payload", "value": "cfe781129d8db1dcbfdce5fa3b62157bbd6e7a7e8b7f421a4767189463ef28e0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120252, "uuid": "632fde61-51d1-470a-bb10-1b1040f0a63e", "comment": "Malware payload", "value": "6a0c60cd5ebdf6c7cb88b066f928d2c46f811c34", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120252, "uuid": "da995fd8-fb08-4c69-98a2-5d0890e37e24", "comment": "Malware payload", "value": "e9ba680d38477d10e54bebb05cd1ef238d2c54890aa1faae5872e2ae5c0913e8b63e59aa497a77b3f4b4df47c2f9706d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120252, "uuid": "e0fdcb9e-31b7-42fd-9f7d-1197e5348146", "value": "T1C173720533F957A4E2F78F7CA4B129048E3E7C4EF815DA9D2C58204D89B2B4D6962F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120252, "uuid": "cc6a51c5-69ff-478a-a66a-c73e4d530086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120252, "uuid": "08a4944b-5eb9-4746-a479-7460ff508024", "value": "1536:7Hbv7cRCBzS4ScGLdsvkwSnNYGaIJLYn7fSXqQbcbHhs8eJ5u6DfZCQ:7Hbv7cG5S5dGS5aIJLYn76XqQbcds8ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120252, "uuid": "62733a6f-54eb-4a8f-8317-67064c829d71", "value": 80484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120252, "uuid": "9e7f3b32-bb3f-47fa-a7bd-0214f49017a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120252, "uuid": "6f8f4426-01dc-4d57-a902-d8e64ac79778", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38847650-0a0f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771119591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119591, "uuid": "f6df0a69-6413-467e-8d8e-4ae0b19483aa", "comment": "Malware payload (Mirai)", "value": "64b7ca2c5e95fa64970180ee5fd31807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119591, "uuid": "6ca93074-2318-4ebe-a150-b8412e9de6a4", "comment": "Malware payload (Mirai)", "value": "d0d643ae6e4d4c164373637c8634c6e53b335668da94f80e926fcd486e745fe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119591, "uuid": "538172a5-77c2-4292-8812-3b8a4727ebd1", "comment": "Malware payload (Mirai)", "value": "c260287e336efde57f646cb06bfc2f13bfd218f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771119591, "uuid": "441a6ecd-3e78-4cd9-a200-6bc1756fdc74", "comment": "Malware payload (Mirai)", "value": "6bff48bba41ab6c1ff338e7ad47966d4dbb0aee715acf198b5f5d404323d0603a01d31fa61c7b6f73697e6567f163146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119591, "uuid": "929ba2aa-06be-4bc5-bfb0-70eec06c45e6", "value": "T15F43F641F88B84F5D51749748077F33FCF32E6398071C9AEDF9AAE36DA276429116288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119591, "uuid": "63d5af7e-2416-412f-ba84-adca183553bd", "value": "1536:y+ml11IujxuIX9GtkxBP4Hojcs/jjee/riWj8iamQuPs:y+ml16ujxVXPBP4HojcEd/3wiam/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771119591, "uuid": "d67b0d90-d367-464f-a088-4cd761794ecf", "value": 56940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771119591, "uuid": "c68b328a-5726-412f-98be-ccdef80926f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771119591, "uuid": "2b45362b-918a-4ff2-a0be-782e7a21ed98", "value": "manji.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc62d42-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118066, "uuid": "1ee2cc53-c444-4a52-b944-da50ccff5618", "comment": "Malware payload", "value": "1ced59b498efeb89bb7ade2079c6200a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118066, "uuid": "5f4b8fa7-6a33-46bb-bd8b-c3c3453e1f34", "comment": "Malware payload", "value": "d1eba5b833cc175e9dac22403d79ff7330e58a4be2a150e1f3f884b75d618cf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118066, "uuid": "85f330a8-e4f6-49e3-8c91-1543c4ba1276", "comment": "Malware payload", "value": "193fdd5ac4917a5d405253320a7cfeedaaecf192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118066, "uuid": "557ee38f-8a7b-4e41-ba3d-b6c1dcdee863", "comment": "Malware payload", "value": "9aa634631f17c11c9a07fd7111cc275197212c1c0c104e5da6dc757182560096de03368b3162c329ec19dc9d77e93efe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118066, "uuid": "a02ca66b-c1fc-4477-9c45-c7bf328520d6", "value": "T199A328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118066, "uuid": "06f6d08c-0319-430a-9b6a-4c361971d874", "value": "1536:7GufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAq:hbU2RC4kPCtSzWu3/3L1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118066, "uuid": "51415bb2-b5e1-4eee-8326-24f7c182691a", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118066, "uuid": "82aa961c-21c5-4d74-ad27-1a96d7e1e35f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118066, "uuid": "f4f2be4d-8c35-4f25-a9c7-89a4d22f420c", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e534b7d1-0a12-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771121169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121169, "uuid": "d5818202-1a0f-4b0b-800b-ad3d51687f03", "comment": "Malware payload", "value": "c4e3f7772c4aae0374a7c3f55696cd37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121169, "uuid": "14b15947-d8cf-4643-8565-9003d31224b3", "comment": "Malware payload", "value": "d37c225468f5a72b50c8eb3ea7bc13012fa69dde14aac074fd8f565e5ea4e928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121169, "uuid": "e5229c53-56ce-4fc6-b7de-89caf8fc1775", "comment": "Malware payload", "value": "fde3467c86a69c248a3afa6575055cc1efe53284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121169, "uuid": "3ab9548b-3fb5-49fc-98ef-a2fd95c7c221", "comment": "Malware payload", "value": "80c24c3dfd1ccc12009febf0ec21a096ac943613f62e2733b20778b41d8b640ea49a900e1aaa1e9f26d68cd2d1ef663f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121169, "uuid": "56f3107a-de9d-42e6-81fa-4d0caf7ad12d", "value": "T1CBE4237E45E3F9C6BDBC81F352621342E3FA98B80E7D7D86C727158A9686238B4850D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121169, "uuid": "40d11cf2-3141-470e-bc17-f914d36cad70", "value": "12288:k8IhAUU87pVHcidj90lNMgL8nOpIcmffpJqCTqS6AhcHVRtMHuL5hStDk+:HiAxkTjGlTLPpIcwtTcRtMH85uDk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771121169, "uuid": "af3b47c8-79f7-437b-8e6f-1501360caca9", "value": 703860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771121169, "uuid": "66dfc14c-3989-435b-8548-74705f847a9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121169, "uuid": "516de659-a95f-4803-8d94-e7b20cc4750e", "value": "client_armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca778b1-0a6c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159729, "uuid": "042d880d-8572-4f09-a13d-4bbe94c2bcc2", "comment": "Malware payload (Mirai)", "value": "615bff081adb64e8b07249048f1e5c74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159729, "uuid": "4f56b921-3c68-481d-bbd0-8f2fba6e9823", "comment": "Malware payload (Mirai)", "value": "d3eaff55a6e9fdd6681d9f46f0b1a552b9dfeed94b433c3c0f8b14f15bcbb385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159729, "uuid": "ffd0f8ee-574c-42be-86d9-91bcf5cec227", "comment": "Malware payload (Mirai)", "value": "564770b5bd137d22d98447f50c77edbfeb474288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159729, "uuid": "21568ed7-59b1-449a-8a21-511ec3538a21", "comment": "Malware payload (Mirai)", "value": "011f3a827b10b06dd36546c98b40d1da807f20c56cb236bc4a09f41a5130592f0316b38ffd0358cd353687f0964e263c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159729, "uuid": "f209d21f-cf96-492e-b149-e4920d359ee8", "value": "T121A31807BB610EF7C8AFED3752B9070534EC551A22E96B763670C828F54B14B5AE38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159729, "uuid": "45e6a68c-ffd6-47ff-9301-a93ec2375cce", "value": "1536:mTtkMyAU2SpUPTBGERmazvvEHfbVMSre3HBSizZeYZCfXCOkyMnz/X:m+MyA+pUJrnE8BSi8YkUFnz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159729, "uuid": "ae4de9c0-1c6d-44d9-84eb-4f3263e38f5d", "value": 105924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159729, "uuid": "42a74371-455c-4f94-8e20-df2f6c15cb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159729, "uuid": "f04c4cf2-466c-46c5-8f04-2ada6ed0dfa0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63aa70b-0a12-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771121171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121171, "uuid": "e1cfe876-3ac0-45d8-83db-308288239758", "comment": "Malware payload (Mirai)", "value": "413e6d297034c4ac2c8d564318e0d48b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121171, "uuid": "83f5a227-27e1-4ecb-ac24-caf083b07365", "comment": "Malware payload (Mirai)", "value": "d5bda205ea560d6ca315e21de93aa7d268a5e005a120c33c454559954725a9ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121171, "uuid": "a651fd1e-ec04-42c2-b3c7-d6ec62c250ea", "comment": "Malware payload (Mirai)", "value": "1c7ab68cc91cd1742cf68861339773d75a474cd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771121171, "uuid": "9bb2183e-a9ed-426b-83b8-b7b4dd384ce6", "comment": "Malware payload (Mirai)", "value": "b5bd0e9adf0fc7944be29485e160757bdf3a7d6f9615b24b74d21217adf40acec0bc4cb04c3af26bb0dcbac81ee78e8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121171, "uuid": "c5bbd78f-1761-4d95-8190-f25a88a10347", "value": "T14E14C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121171, "uuid": "a6e1d518-2c68-4510-a872-cbccc97a93d3", "value": "6144:426eQCbeoufx4sdf2dp06GtCqjYW8nY1j20WI:Yely4sdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771121171, "uuid": "5c42b05c-afa4-4ce2-87ea-eb52f9d1a580", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771121171, "uuid": "e6474fb8-fd3d-46aa-81b2-1894e03fd161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771121171, "uuid": "2237dfe2-9188-40dc-b259-598b48631b7f", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c429b9-0a10-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771120200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120200, "uuid": "adec4871-75a4-42d3-966c-11de30225123", "comment": "Malware payload (Mirai)", "value": "27354e05d0ce43e0a9f2c444e501c263", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120200, "uuid": "cf58313d-2444-4ddd-95d6-4db86c5951a9", "comment": "Malware payload (Mirai)", "value": "d642e2278d5be96357d0657951d184d518cb2637e3ab25f40bc18ab8de3c583a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120200, "uuid": "ee98438c-c17b-4c65-8c9c-61740d13ac61", "comment": "Malware payload (Mirai)", "value": "9a8929650aab6ca6ff2aaeafc48e7779e58e1259", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771120200, "uuid": "9a859555-bb03-4cb8-af81-d39f643d2c4e", "comment": "Malware payload (Mirai)", "value": "60fed9b1064f940433f0c9ae4ba90ed24a947222b1dfce516eede2b59034eb6414d51a38c854926e259aff746c50ab4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120200, "uuid": "444d7528-70fa-41be-a0a3-0b2c4acc77bc", "value": "T1BA21D29D10F4651E63ACCD40B1BF9208488086E539F4FAE59AF404BB45C531277ACF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120200, "uuid": "e8543f51-e01b-424b-bec9-3eb7445df968", "value": "24:3J3nxiFNIokKsHsgrzxA7izVo6XfsP290ygn:NHrpZ9ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771120200, "uuid": "0f33d931-e1df-4439-8c8a-a8bd3f20a785", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771120200, "uuid": "8178e9ce-141e-4229-a565-21e47dc9ce5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771120200, "uuid": "e0ff6a66-d64a-46cb-bd27-83bb2ac92505", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f651656a-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193783, "uuid": "34073193-ad01-4656-9c97-f235d5693bf5", "comment": "Malware payload (Mirai)", "value": "7548309560a4fdcc5d1f4cdbf13f93b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193783, "uuid": "4093ffe0-1644-4545-bc14-d97d88d5983f", "comment": "Malware payload (Mirai)", "value": "d689a6a7b2c81d48a037346ab751fbc73d7aa299e61306cc2d4643ad43d2df43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193783, "uuid": "5618b972-a3b3-4259-8d4a-f22b8e14cf89", "comment": "Malware payload (Mirai)", "value": "cc20ff156523689ea2e1f43b2c2ac1fcadffd194", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193783, "uuid": "63ca23b8-b447-4026-8bc2-aade23d66d8e", "comment": "Malware payload (Mirai)", "value": "c0da857cc0099d9ee5b193255f14cdb397208633d82efe9b0ec10702fdedb0deb07fa8f581c52d25ab5691f4e92d7650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193783, "uuid": "7fa1369b-5cb5-4924-a655-f6bd24ea8766", "value": "T18BB3D606AA429B01D49735FAFB9F41593353AFBCE3FA7101D9209FA123C69DB0F66112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193783, "uuid": "ceeace61-3878-43ad-aaf5-52ec6c17016f", "value": "3072:bNYwRYJzDG9BaoaEWOJSUBm2/8MPwwSctk3:bIJzC9EoaEWOJSQmDMIwSctk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193783, "uuid": "45ffab8e-3c98-4654-b152-9eed209b7341", "value": 112652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193783, "uuid": "3afabf59-cd96-4e18-9262-730d445d09f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193783, "uuid": "3dc9bff9-b6a8-44fe-bfd5-63bee21a0fc5", "value": "israel.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e51dbf-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193780, "uuid": "2880d55e-832a-4515-b133-7c5f7372c396", "comment": "Malware payload (Mirai)", "value": "0df745491955729114c6c70665ab4b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193780, "uuid": "1ecf4916-858b-4553-b975-445deaf4196a", "comment": "Malware payload (Mirai)", "value": "d7881800d0a515714616456714712f4f656ed9744b2392bcb56df7d537a7968b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193780, "uuid": "003609da-7f5e-468a-8249-53fad22d50ae", "comment": "Malware payload (Mirai)", "value": "e895b88680d921f3fea608800b5ef54ac2aecee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193780, "uuid": "49227952-e90f-4706-9f1d-8bb4856792b8", "comment": "Malware payload (Mirai)", "value": "e8a8b5a53880926b99bc18e53cdff749c26b5bdf1895cb9c37dc4939a1ce93ae5e0258c20a3347dc0bbc608fc0bd5f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193780, "uuid": "9d04c26e-487b-42c7-88a7-ffc19f2fcfdd", "value": "T193D3F946BD418F13C6C321F7FBDE429C3A166F6DD6EA32029925BFA137864D60E36211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193780, "uuid": "5904ed07-b3af-4c46-8433-599e91b0f8e9", "value": "3072:Ocp/LThLvWIS+v7IjA6KXdvSQjN5LJv971g3:OoWezIjAZXJSQJ5LZ971g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193780, "uuid": "dd88040d-e766-4ba4-93e4-8f2832570bd1", "value": 135000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193780, "uuid": "a7f2d36a-bd2d-4832-a02b-8cd192146462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193780, "uuid": "cd5b697f-fcc0-45e4-a080-91cbbdd7def1", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06231d72-0a6b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771159020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159020, "uuid": "8ad0c245-8103-4f9b-a98d-b90021cf5291", "comment": "Malware payload (Mirai)", "value": "f41cdfb5c12d7a1908140760ee5151cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159020, "uuid": "85b1deea-973a-4e33-a33d-a5fd6d4fb50c", "comment": "Malware payload (Mirai)", "value": "dcebaecf26d5637eceb81cd2f562aa4d923da2881a48b2a4cb0592aaf225420c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159020, "uuid": "ac466445-5d08-4f1d-ad45-dc8c5f5d0e4e", "comment": "Malware payload (Mirai)", "value": "62cabcea13d7c1e354eef4c2807a64d9db3e5fd1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771159020, "uuid": "f01a3701-dde3-4f54-83a6-a374f2026d74", "comment": "Malware payload (Mirai)", "value": "2c0d2a881fe466aa80f62d96c89707071c9cc1312d7818e1a6f425772f86e611475510350c360dec672341d1d67bb1c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159020, "uuid": "2f765b04-1d2b-4939-bb47-1ee1aea5a8fc", "value": "T1DEF012DB21A69AF200ACDF14F166A895B02A9FFC30940F4CD4DF24EB6F44A507C14F01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159020, "uuid": "1e9e619e-35a1-4e14-b868-bede556521c5", "value": "12:bgdzudzibcdzZJdzZadldz3dz4dzQdz6hFcdzvydzP0LK27:bgdzudzibcdzZJdzZadldz3dz4dzQdzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771159020, "uuid": "f09d8440-144a-49eb-9ac8-cec58fd062a4", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771159020, "uuid": "9a090768-d07e-4d22-8ecc-0e2e249f3539", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771159020, "uuid": "5574fe12-f812-46d0-b1f0-d32f63a6e7e8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebde22f-0aa8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771185556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185556, "uuid": "47ae36f1-bb05-4514-a02a-44ccee4fbf6f", "comment": "Malware payload", "value": "b967051f8e6adf5d7d35ce73da7f65e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185556, "uuid": "5c13cba5-a1ed-469b-a086-e89e5f730682", "comment": "Malware payload", "value": "de0c0dc38a48c9933946d64e6cd89622ef1e44386c9dca6c728b393807c8d86e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185556, "uuid": "7f45bb35-37e7-44e4-a24d-6f3df086e1c8", "comment": "Malware payload", "value": "0316b8adf516150955d7bb2afa6d92655897cef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771185556, "uuid": "8b53c9dd-ff9f-4972-b580-fe9613889edb", "comment": "Malware payload", "value": "9b18606cfa7c6c76cdb1d2396212ea5b2accc493ebf241ecf6f6a0bfaa5d0096852d7c14f653393173d3c6ebe4f39086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185556, "uuid": "a5cf2fbe-4887-4842-a294-d5ce9058f025", "value": "T199432949F393E4B1D90705B002ABEB794A30FE524534CE6ADB54BFE29E326C27057729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185556, "uuid": "8cc9ca76-abb0-4763-ab99-6e8d2fb6647f", "value": "768:P7cyZ1aqLxONQyEp4/CY45UDstwtNsFgsS7NuKPZV4uUcu31AKbmpFR9iqDCFims:P4yZ7ImpXc+qNNhFpUX31AKbmpJSar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771185556, "uuid": "c34ee07f-67ea-4622-af42-667434c0ce85", "value": 56692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771185556, "uuid": "c2ec8346-8f2f-4a4b-a1c5-21e779b1265b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771185556, "uuid": "dec11793-ffd9-44ee-b33e-fd9d2841fb07", "value": "israel.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f433b50f-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193779, "uuid": "1ef05f23-c679-4b10-9e5a-9f2f1cb208ad", "comment": "Malware payload (Mirai)", "value": "884cf528cf163e99742acd64ca59da9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193779, "uuid": "f6326394-0803-4af9-9fb4-6249da33ded7", "comment": "Malware payload (Mirai)", "value": "dea7b3f9c4e806083414bb90b3d6a326ef46313b821963ac633479b784560e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193779, "uuid": "4fb9239c-f95f-4774-ae2d-8a381ddf1bfb", "comment": "Malware payload (Mirai)", "value": "e31305f365b21286fc069b9c15a477d2389fb649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193779, "uuid": "2ab3ab35-86a4-4c10-b124-727784c9dd2c", "comment": "Malware payload (Mirai)", "value": "8b7de7ec81453a8ec4be30031959d303659b2c23f18bba0c68dceeb944565dbbd418b4ff85ae194529a1fcadcb21ea6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193779, "uuid": "d97a6e69-513c-4fb3-aa4c-df900f3230eb", "value": "T17633F26475411D66EEB680B52BBE4FA2D6D04AD471035C08B44ED6BBCCDA0F231EBFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193779, "uuid": "0804f4e9-30d3-463a-8ba0-a12d0398902a", "value": "768:Ye+q02YbVNDcdExaf5Q/elhYfh8iWxKOnKgPWjRYfDHRGDJIy506LJCBJgGlzDpm:YV2iVNDcW8KuUh8bY+WWoJR+6L4VJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193779, "uuid": "9537df02-b27b-443f-9464-003cb34be052", "value": 52880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193779, "uuid": "0e772bab-78a1-4105-8334-1dec75c4b10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193779, "uuid": "5e170e04-0873-4d2b-8f3d-90c6773c1a64", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9c66fb-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118071, "uuid": "9adf1c9c-d541-42d5-a44b-208e79f6a28f", "comment": "Malware payload", "value": "25f4bd9bf11520fada49a94e9d59cdd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118071, "uuid": "e0c2359d-9daa-47fe-9b7e-d17c9611df2c", "comment": "Malware payload", "value": "e072470520b6ef0b5556d9f883878b6f59c5a02aa7dbd07ae739e9a2389b5dab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118071, "uuid": "ccfa0f57-0ae7-445b-ad45-f2007ba7abc9", "comment": "Malware payload", "value": "7c88ceedc1fe7b555e52c6c0710ea3ff566d1863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118071, "uuid": "cb42a886-f58f-4f4f-a255-0ad7e5aa3350", "comment": "Malware payload", "value": "5a5116a23cb3eeee87078f996d5f75bcd9ce5f972a3148bca93624c35a216aa449060789402f89f089a53151d922cb8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118071, "uuid": "7cb52c20-a946-4b4b-ba4e-d5ce869cc3c9", "value": "T18AC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118071, "uuid": "8b950e7d-4f96-4a82-8351-32432de17a53", "value": "3072:3f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4dqe:3f0tJBR4NSALD7rnCrheiqqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118071, "uuid": "dbf4a929-0280-4bd8-9d3a-8ca9791ffdd9", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118071, "uuid": "c035b0ae-8640-4226-9a00-a71cd55fabd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118071, "uuid": "5b47430d-6e49-4b5b-87f1-d1cfdf350f07", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177a1438-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771193838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193838, "uuid": "13c71b8a-f611-4bcd-9509-1e9a698d0c21", "comment": "Malware payload", "value": "01b904c0ddc9dd42dc45796819a4686f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193838, "uuid": "66f473b0-9029-4324-81be-ed6e6f5cefa9", "comment": "Malware payload", "value": "e0dc74e1069d16fbec35b392b247a13bf14ccde705e067f551d94abc74215455", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193838, "uuid": "77cb6cef-79d9-4ce9-a2a5-35083368fc59", "comment": "Malware payload", "value": "1d38fd3bb1e6299b7ccd664c37ad0b600952dba1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193838, "uuid": "ff4bf9bf-f0c1-4e74-9913-9512604fada8", "comment": "Malware payload", "value": "688782021ad7bdbbc7490b61c89a55026e1e370ff726a934cd268f71c762053405e6b071b7c6f2c446b0da06945fea60", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193838, "uuid": "a9f612ea-22ce-4592-9f8e-370464b6672f", "value": "T1DFD544D1D27AD674722118E7E3CE24D35F21DE82C5A8C6BD4F92DC17B18921320ED7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193838, "uuid": "11f5042d-bc71-4487-abd6-11be85121cb8", "value": "12288:EJSqVo/ppQJSqVo/ppyjrFjGkIcIy4P88rHB2SwMwX7fDMwX7fVKU1JQTgfzxNNd:EJSqVo/ppQJSqVo/ppyfbQk7mAvherE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193838, "uuid": "260a4c9b-cecf-46d8-8ab4-4f14127f5cb9", "value": 2963848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193838, "uuid": "9bc25f66-44b4-4c6a-9aba-fc06dd5f724c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193838, "uuid": "8d1e344f-d78e-4077-b70a-ef0e775d9e7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6f5d7d-0a70-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771161203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161203, "uuid": "c7f0d033-8146-4733-b9a9-6ad07f1d4b6c", "comment": "Malware payload", "value": "43444b78024c32e11ac02cfc4f1edee2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161203, "uuid": "3b7ce19b-1997-488a-bcc3-16cd1e497b1e", "comment": "Malware payload", "value": "e1e04cc4713e0d53d7596622b452ac1ed56eaebff81a59a984ae8e305138e78d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161203, "uuid": "8c64db1b-c670-4aed-b655-47642566f8c2", "comment": "Malware payload", "value": "433be84ad43f963c852cd4f098f8a9b83dc222e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771161203, "uuid": "299f4c94-4584-4860-aef8-cc2f9f6e2faa", "comment": "Malware payload", "value": "70614d980a32c2186a016263f6da0790d2b83161a173195fa807c4040d8a07584834e7539a24522772e893e0f2e0f280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161203, "uuid": "63d8a578-8aaa-418e-9903-a88d0ef164c9", "value": "T106C31856B9529B12D4C325FAFA9F414933136FBCE3FA3102DD206F64278A8DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161203, "uuid": "5d19d95d-b864-42b1-a9b0-7ff75ce21921", "value": "3072:7QGmm2I+Ry7IXbl9EaiEE1RRxdwFqdeZY5kt85i:ZmmKy7ILjEaiEE1RRxdcqd55e85i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771161203, "uuid": "d2455318-7438-48fa-a857-a43fc0dead9b", "value": 129580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771161203, "uuid": "898afff0-22b8-4b3d-a996-05dc6138f733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771161203, "uuid": "2dfd5569-78ff-4d4a-bff8-d142a1bcc9d7", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b5ed44-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193857, "uuid": "5a3575db-e1c6-4576-9491-ad44a33c6314", "comment": "Malware payload (Mirai)", "value": "3486504df14a9ae75f21326d80c4bf22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193857, "uuid": "49adaf7e-bff3-4baf-85be-62550a0e52ab", "comment": "Malware payload (Mirai)", "value": "e318dede79563505e27642628cb37798896ca61946b530de82c2495d1718b835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193857, "uuid": "38570146-fd91-4b2f-a1b9-ca4eb4bee821", "comment": "Malware payload (Mirai)", "value": "bbec20dcaff06d482116bfb8ae48378dcae91a8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193857, "uuid": "5a732e10-d38b-4c26-bdfd-60d95405c20f", "comment": "Malware payload (Mirai)", "value": "5eb2808c873c338e6bfb0d672fb7c57d24066a8ee194afc417c04713459ca1166e7a9e489e707f53ba877b80540fd905", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193857, "uuid": "74ec537d-5bcc-46ca-9119-7c6c44529c11", "value": "T1C804855D6E229F7DFAB8823457B34E20975923E623D1D684D2ACD2001F3029E645FBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193857, "uuid": "4c4926b4-31a4-45e5-8c09-cec3eec2d8cf", "value": "3072:Y2e+VrVslZWt7ndFORhv1+7LOHTvYO3AQmchAREkNwBtN568sO5N1dJkInOCJGyN:YnvWt7ndFORhv1+7LOHTvYO3AQmchARY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193857, "uuid": "a0a5b7e5-7766-4fd9-bfce-679b91756653", "value": 174124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193857, "uuid": "a2a9478b-92bd-4937-81fd-e69d4914ba99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193857, "uuid": "c5a7f3b5-be10-431c-8aea-3044ba006eae", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90a5011-0a6e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771160636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160636, "uuid": "58eb6adc-7eea-4e6c-b4da-da9ac3e1c011", "comment": "Malware payload (Mirai)", "value": "8b50cde3b1feac13c6fa44919ba7bb6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160636, "uuid": "66df6cfe-b9da-465b-8ba0-b408d1cece32", "comment": "Malware payload (Mirai)", "value": "e56ee3569c96ac9ac8a5958334a461c9b7f04f7bca500293d265e21bef3b0665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160636, "uuid": "4229d0a5-097a-4370-8c1e-f72ae104d229", "comment": "Malware payload (Mirai)", "value": "9627d63a6d67476753681093e8809eabdc7612e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160636, "uuid": "225586b5-d0df-408c-9447-a9c161342cfd", "comment": "Malware payload (Mirai)", "value": "f929fe1b717b7fce7fccbdb888a4d7505acb43153af863efb321237ef36bb1ed54d0bf3bd448f5288952bcf6c8a48143", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160636, "uuid": "4b2ffb99-e763-407d-94d4-5932ffd4fc03", "value": "T1D8733B46F7A3E4B1D44705B001EBEB794A30FDA20520D95ADB64FFE19E225D2704B739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160636, "uuid": "20f47235-601b-4189-8f76-93bade2a13bc", "value": "1536:0+8prYQ63yhlzJNDU631sdJo9Hd4Kxw9t7r09Y7mry:k6ultes9Hd1w57uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160636, "uuid": "ecdafdcb-4511-49dc-97a0-b0f5c07a0b09", "value": 76460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160636, "uuid": "fd968dd1-fda7-4c37-8f92-0ce5a9a43bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160636, "uuid": "3082da22-9197-4a71-939d-41552a02158f", "value": "israel.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f9c2b9-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193861, "uuid": "09a39a0c-68d9-4b02-a1d0-d0a69c355b91", "comment": "Malware payload (Mirai)", "value": "e53a4c574663110567153c6045352f21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193861, "uuid": "9888d4f0-eedf-4108-a59a-344c93c5d9f4", "comment": "Malware payload (Mirai)", "value": "e583e9fd9d5e330aede2fbd8bd095418bb0dee4e19f209c26e7821412ee76eaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193861, "uuid": "0f5abd1a-47af-45c9-ae6d-08dce392fffc", "comment": "Malware payload (Mirai)", "value": "62136fce2d1d84ce0873f6b67bb0c23328f82463", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193861, "uuid": "3869775a-058f-426b-8ec8-dafde672a95f", "comment": "Malware payload (Mirai)", "value": "d3315f1583bf6d8946196c9e21bc7244b312a0feb3579ec0016b72b990505d0360de7d37a1fd46a5b0fed70d74746d4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193861, "uuid": "d8534d83-6885-4fd0-ad7b-b81d29b76ca0", "value": "T19904D60AAFA11EBBC8AFDD3705A90A4239CC641722A53FB57674C524F54EA0F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193861, "uuid": "64f9dbe7-9623-4e92-a9a9-a376dafb5d5e", "value": "3072:+d2kBaoYRjENmKlMH2XLxWAFXbtG4J0P6P:+d2kBaoujENuH2XLxWAFRGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193861, "uuid": "516383db-2f43-4edc-846b-1dda213b8ea8", "value": 175596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193861, "uuid": "022d0a4a-0790-4c1d-a40e-82f3e9bad280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193861, "uuid": "6b416926-b352-4c15-836d-a52778db535a", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb3804d-0aa2-11f1-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1771182846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182846, "uuid": "0a460951-7369-42e5-8c58-fbfaf158da44", "comment": "Malware payload (RustyStealer)", "value": "b3ee8558ad35d1531f5f8458f649f5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182846, "uuid": "b65da6c6-0d18-4155-93bf-62b9dad0f7e9", "comment": "Malware payload (RustyStealer)", "value": "e5a5f1d25e05687a214f1305ab6ab307dadbcf997e6f632756b67c9579a5fe0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182846, "uuid": "411f2ae3-9286-440c-9217-fbd930d0ec5a", "comment": "Malware payload (RustyStealer)", "value": "8a48d4d963d97409c5062b062eaef86aee920c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771182846, "uuid": "845a3313-3951-42f8-9e23-2f70706be733", "comment": "Malware payload (RustyStealer)", "value": "ce0ec77ff3aaff824591790756142455bcfd5ff6c20db7c09cc5c10e9b018f05c57855f2d05dc8fa3d7ac67728624040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182846, "uuid": "26ff220f-4db2-4758-b1e1-723676ffff9e", "value": "T1430833C46969F54FF39C897CC9A1E27E8BF8A91FF4F04488E7684D56462618162BFF00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182846, "uuid": "9f304314-c082-4438-aac2-9c61c13b2f27", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182846, "uuid": "8a93dec2-d928-413b-a1b9-93b724aad719", "value": "1572864:3slzi4uN38yUrBSXdkkWyzvLwI/kSEfYiMF1DsBbGebCPk:36zPuNzUCVzvF/kHfYHslnCPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771182846, "uuid": "9aae3ad2-0038-4e31-a2be-66c697701dd5", "value": 81190688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771182846, "uuid": "8a6d1f16-1242-4faa-8a7c-a767783a48d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771182846, "uuid": "0405e616-01a4-4274-83ce-76b9b2228136", "value": "888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59f1533-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193782, "uuid": "d53017e7-8a0f-4fc4-9dfe-e771938160e9", "comment": "Malware payload (Mirai)", "value": "ca09db3fb07b83975ae4f548f7b3f92a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193782, "uuid": "70ed7f1a-9898-4993-a971-82e474f12ce7", "comment": "Malware payload (Mirai)", "value": "e74b52e34a8fff53883595b683a42b880e1cc425e6a6d259c0137cfb0bd472e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193782, "uuid": "55ff5193-3b65-442c-a7b1-ef2fcce8d2c9", "comment": "Malware payload (Mirai)", "value": "b38897ea60b40d54ba68080c007c460c525ddeb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193782, "uuid": "11e84556-7236-4cb3-89e7-77d260bdf603", "comment": "Malware payload (Mirai)", "value": "8af736e21b3dd00b5d7027f2b597101de946ff1a67b381d806d5dcba98e80a6416552fe764121bd935e547e298ebfb39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193782, "uuid": "f7aac4a9-b3c2-4329-9db2-a0eb78e7c5a4", "value": "T1913302CDE048AB90DFAC0DFA148C1295D6CCE14122A46F5FEB139599B5BC937B83752C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193782, "uuid": "33562895-ab49-4c16-ba8a-e2b44212dfe6", "value": "768:KhURDQ70DNKJSF0tmxnNBuKwyXrijvAl/2ENzxGtfLOM5TPVxCDectIiEq8dW/:ib8imFNBurymbY/bxGtfLPPCDhxzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193782, "uuid": "dc024e88-1455-482a-8671-672c0a5cbcbf", "value": 53724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193782, "uuid": "0ab577d7-e468-4f71-a795-708c51b62fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193782, "uuid": "c83c4995-73b2-4d88-896c-3170362e8163", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040bc7d-0a97-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771177908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177908, "uuid": "c979771e-2706-46c0-ad45-cff1c39e0435", "comment": "Malware payload", "value": "f967267c0bf0ae354bc39aaf80d6b65f", "object_relation": "md5", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177908, "uuid": "dc910bcf-d784-42dd-b720-f40230ca57e8", "comment": "Malware payload", "value": "e7aa84c2b3ac31d3a948f0431cdbf7b28116fffb157b8e99e8efe455c92dd661", "object_relation": "sha256", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177908, "uuid": "50e623cd-4d31-44f2-b619-7d43d8229b28", "comment": "Malware payload", "value": "12e98363539ad672a2c7effb04434fe28148dddd", "object_relation": "sha1", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177908, "uuid": "d37202ff-716a-491e-9bac-c143b145c0b9", "comment": "Malware payload", "value": "067eb9559d75172953283f056e10c20a856219657e084c4c8e525d3889033d9881991829b4644358eb10421cc5624ea3", "object_relation": "sha3-384", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177908, "uuid": "45e7a6a4-9376-4203-9bbc-1954db8c2462", "value": "T10C558B46FBD99E2ECC7340364F5A5631154AAD23C783C383D968365C78BB6E40E897E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177908, "uuid": "f4a7397d-0c2e-4786-99be-8c2a8e4b5e05", "value": "24576:RRy6s+Pbf4WAfNHvhvDHMU4zgdVHRhrV25agt/7N9EvKnAiu:RUAz4WAfphvDHMkdVxrgJ7Nvpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771177908, "uuid": "2532f4d4-59e1-487c-92d2-bc2ae05a9b53", "value": 1365190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771177908, "uuid": "ad551445-c704-4f98-9ed2-9b38921a8ddd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177908, "uuid": "e665fab8-b37d-4ab7-811c-393e17a3237a", "value": "update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceea8d9f-0a78-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771164940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164940, "uuid": "1146c872-05cb-433c-b350-1f70e058cd4b", "comment": "Malware payload (Mirai)", "value": "6ea0054661f077fdd3f1bd85f4fff86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164940, "uuid": "6c860992-1286-4770-b0de-2c60f0842cbf", "comment": "Malware payload (Mirai)", "value": "e94a8820cb2e4fab6f809bf1e380dac2dec18924155168c3ed5ddc2abc498a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164940, "uuid": "00e132c8-c43b-4762-bd33-b33d2980be65", "comment": "Malware payload (Mirai)", "value": "14e421e90cc43ae7934e92bde2b4c6dc48815d8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771164940, "uuid": "04963b58-185d-49de-b5bc-fec882bc62f9", "comment": "Malware payload (Mirai)", "value": "6212e08922fc5cba514c0233faa14aeabc3d5fd697486befb5b25eb416a37c1aabf7c2813002fc7a5bb5d90566a24a52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164940, "uuid": "2a4664a2-337d-43cf-8a11-ba721392febb", "value": "T125043B46AA419A23C1D31776FADF424633239B64D3DB330589286BF43F8779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164940, "uuid": "22e874e9-8d10-4fed-9ae8-3748217704a8", "value": "3072:JDbQlL2zA21MkWIx3aa/W8Uj2ZF1Dp5BmyycnzueaGZbXM/9GVob0:RQlK7WW3auW8Uj2ZjDl5ueaGZDM/9kog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771164940, "uuid": "0ea8640a-869e-42b5-a884-10d2a0d9fd1c", "value": 173943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771164940, "uuid": "1f9fafac-d03a-4af6-ad3a-b8a36e43d661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771164940, "uuid": "f1d9a605-cf43-4764-a99c-27a51e3cfbdf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a542f2-0a96-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771177655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177655, "uuid": "4ac32c1b-e0a3-4f7a-a971-8ea11935f04d", "comment": "Malware payload", "value": "1c705b18d3d7e5fa06c8719b0cab2411", "object_relation": "md5", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177655, "uuid": "f7d227fe-9bc3-430c-a9cd-875218ad4e5d", "comment": "Malware payload", "value": "e9b41fd64d8702f974e63374a03ad914b6f1b24e8ddd96c29ff14ce81713676f", "object_relation": "sha256", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177655, "uuid": "2fadf552-effd-4d99-b355-b7d89bfdab38", "comment": "Malware payload", "value": "e87c48bd6516203e95a8e13b05fb52351e644f9b", "object_relation": "sha1", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771177655, "uuid": "5c5a6fac-3509-4f98-8bef-9e06ec9efc93", "comment": "Malware payload", "value": "03e026523363375fbf90e77c843de250f28a7459cc373ea16385e2d1ba7b2c479fb8b8aa47d9bd07d836eeacd7b78ce6", "object_relation": "sha3-384", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "correios-aplicativo-br-com", "colour": "#062673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177655, "uuid": "3e55f731-a823-4bcb-bc25-dfeca1d2d6b9", "value": "T175962285BBE99E1FCC33403A4F4A573216499E27C742C347C9743A5C387BAE44E896E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177655, "uuid": "1086b388-eea5-4fa4-98e6-75e2867cce55", "value": "196608:scvhbp1qgj9mL7XrqEww/ii5tmFcSsW9ck9Iu3lwc00MDq44xdbU:HNfRj0HbqEww/F51Ss2ctOpOq4ydg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771177655, "uuid": "1956f7a5-67cc-4888-be0b-8f933cc5b4fa", "value": 8934662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771177655, "uuid": "0f50ad65-c87f-4805-9ac1-59f9531fcf5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771177655, "uuid": "13c2441a-b95f-4dd8-bfe8-64f6ded0f647", "value": "correios.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2fd85d-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193798, "uuid": "19b88952-3f56-4e41-824e-6b221c4095a3", "comment": "Malware payload (Mirai)", "value": "b6de6f85f21103bbc136dbb6d3130e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193798, "uuid": "d9f96e0b-9f27-43b5-9d55-308ba67b7bed", "comment": "Malware payload (Mirai)", "value": "ea22176d9a339d8f053e388c62801457369e3042608f1cd78184cf56abc045d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193798, "uuid": "ff7d0103-1c7f-404c-a3fc-3a233f92f0bc", "comment": "Malware payload (Mirai)", "value": "3b88f456fd876a2f9c46126f9cb042d40c70217d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193798, "uuid": "36f4b631-9287-4af1-be33-be2965859d0b", "comment": "Malware payload (Mirai)", "value": "be10fbf2259bcc24ae8478eac6eaf4af0f20c6c46a090f558e1f9ec2454e57f6f0af94d6be7609a5c45c04ee70c6373d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193798, "uuid": "4b7ff1fd-51dd-465a-a906-e359458dfbe7", "value": "T115B39DEFF34B1591C8628BF013C39BDE2E2722129F6B85E73C0E567A18751DB491A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193798, "uuid": "43bd6532-a409-44af-89d7-f218368e9c65", "value": "1536:zbOwWhgESLQT/7lY1dNlC23WXfWIiSRtg0/LWe:Gw/ESszpYdlCs2WIiotg0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193798, "uuid": "6562bd14-d38c-4f80-bf6d-04d45c9e0707", "value": 107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193798, "uuid": "1cd5eaf2-936d-4b8c-b165-7a227953c8ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193798, "uuid": "0bbc93aa-e3a3-4226-91d0-0184ff2ad051", "value": "sora.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc7508c-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193795, "uuid": "d33c5b39-19e6-4682-bbf0-6da5c9ccb115", "comment": "Malware payload (Mirai)", "value": "3fbc65c30df19dbc80d7f6d642c2869e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193795, "uuid": "1627064a-4403-4063-89e1-2c52a577979e", "comment": "Malware payload (Mirai)", "value": "eaac8a2e69f15e5a5ee57ff0255b22400cb3282cb184f22ea1a97810c36caf4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193795, "uuid": "5cdcc0e9-0e96-41b5-9d38-837aea4b84bf", "comment": "Malware payload (Mirai)", "value": "aed52bc50f4e6ade2e8dbce7c2326d02ebaa8647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193795, "uuid": "5fc21788-43ec-452a-b975-2672dd7e131f", "comment": "Malware payload (Mirai)", "value": "99c1ab62639d720851309059c358a573c67774c1fc117359d88a82e8e9d12d65adea5d5beae0d8111640060492cdc48b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193795, "uuid": "cecf00f1-0a1e-4a99-94c2-74b143188c6a", "value": "T17F93D682BB43DFB7E45325F102F75B314A32FD3A5C26DA85E328BDA48A514D0B61636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193795, "uuid": "8d921e4f-b2ec-4af3-8288-0de0df209e88", "value": "1536:/+o0+71SFmFGsh3kETN6heJm70NTT7C+4cRAwiSy1z:mouYhDm70TLfra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193795, "uuid": "6b4ad1d2-db71-467a-bee2-2564815cbaae", "value": 95020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193795, "uuid": "4b336774-39bf-4bd3-a524-7c386dbace38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193795, "uuid": "f74fd588-abc7-4438-822e-257392275386", "value": "israel.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a9e84-0aa5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771184237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184237, "uuid": "b5d00f79-6cc7-4090-ab27-e252772b5a14", "comment": "Malware payload", "value": "f1297c6f9db0d5817b09cc7c3ddb9d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184237, "uuid": "6020d11b-cc6d-4249-8dfe-b78577d7735e", "comment": "Malware payload", "value": "ee528a7d77950964bdd59a86f7fa9c0b7542b71867183dc33395e7cbd4284908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184237, "uuid": "98a71373-59fa-4b1a-8d03-ef173baff25a", "comment": "Malware payload", "value": "88a2712bdce5b7c99d7649e5fd2041f4acfca06e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771184237, "uuid": "e168797d-8001-4c59-a593-8c762663763f", "comment": "Malware payload", "value": "87577e974545a4d35181802ac47f486e599f4e4609e916563ddd45f2e1dcddb4d678e85e8fde50ff31b7a96692e023a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184237, "uuid": "fb7e6fb5-6e9e-4ee1-b94c-c1a8179c00bf", "value": "T151D30906A9419F12D1C321B9FF5E525937132F78D3EE72029D24AFA0774A8FB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184237, "uuid": "91113306-76d0-4b4f-aa9a-da9d73da0f1f", "value": "3072:FYhmczX5JahPmrDj24zN7H6TvvEr3vXO6sD:FO/XvadmrhzNbuvEr/XsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771184237, "uuid": "d9c84d15-5015-4b33-a9a7-df2358041c87", "value": 136512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771184237, "uuid": "a9ecac39-eb9f-48b6-af2a-591ba8121415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771184237, "uuid": "66e51f85-19f6-4dd5-9777-80b885144978", "value": "israel.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf28085-0a0b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771118070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118070, "uuid": "10de4287-896f-486b-94ca-57b00b971ad0", "comment": "Malware payload", "value": "fe08cd531a52969b1c54975a74683d1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118070, "uuid": "de1af194-1c85-4e85-825f-fa0e76a6e89e", "comment": "Malware payload", "value": "eed004cbe7d4dc52ad2ff89a822316b22dc9093c02bf9db390611091d5076c69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118070, "uuid": "03943168-4dab-4b87-8e63-6e188fc5c88f", "comment": "Malware payload", "value": "10e7512eb84b1a75654637876a9db83773283cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771118070, "uuid": "8d86b954-e701-4037-b5ae-ca3bda36a6de", "comment": "Malware payload", "value": "7cfcb93c6ef0bad2dcdddcc614bf78e213a3817fa445908477f40da375d960c9f0b6a3ba18435546fa0ec752976a06b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118070, "uuid": "dc4aa932-67b1-4c08-8c5a-5356dd739d75", "value": "T13CD308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118070, "uuid": "5db986ad-34e0-46df-8124-4b20053429da", "value": "3072:ZSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFItx:ZrybytG/Oyi42VOgLNux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771118070, "uuid": "fb76c822-4853-47ee-8de9-eadbd3dddba0", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771118070, "uuid": "f3d360f6-cc1e-46f7-892c-afbc6376d93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771118070, "uuid": "404305a9-e600-4bb5-b4ac-63042142298a", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38682cd-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193778, "uuid": "eb77f8ec-b422-413f-a3b9-6c7b25914928", "comment": "Malware payload (Mirai)", "value": "49bf6d14ae57992bb148696e3db9a8d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193778, "uuid": "0c1baf9a-c943-43b6-8a5c-1d3bf7b9a711", "comment": "Malware payload (Mirai)", "value": "eee7c1c7bcc00f8ffbbc25eccebaaa6bf18de6afb30265327f9ce1d18e717e25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193778, "uuid": "58b09409-7504-40f6-9555-e760110a1d60", "comment": "Malware payload (Mirai)", "value": "68cc8c4437d53d8f4d1fb7a85bf0ef78a962a74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193778, "uuid": "c070ed4b-de86-42f1-8167-a72dcf058378", "comment": "Malware payload (Mirai)", "value": "02ef92629e2113172198f5b8263cff6ba5902d57249c7021fd01181c7e5e1b9906c23c41e4a9981e888736fd2c300ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193778, "uuid": "46c2f5c1-3efb-4e32-acc0-1ecb508fc2de", "value": "T12DB35A63CC792F98D618D1B4B1B48FB92B539921924B1FBE5567C3B48403D9CF90A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193778, "uuid": "a5bfa7ae-bdc9-45d6-aca4-d00a8b19300f", "value": "1536:gaX881YRes+6myTxxR8Ci9pN2bTWcDXFlYcpKT62ye8nAh/V:gwYReZ6myTvR8VpNETWc7EZTYAhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193778, "uuid": "d1913bb5-4d7a-40d2-b3ce-6901d8aab075", "value": 114884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193778, "uuid": "503bd7a5-c012-4cc9-b44f-60256356d03a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193778, "uuid": "0017bd5f-870f-460d-acc3-9a5ac1be2dba", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29027b1b-0a09-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771116988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116988, "uuid": "df65a57d-ef7c-463f-a3c9-134aa7cb8f6a", "comment": "Malware payload (Mirai)", "value": "acb8f2a434563e3bbf21930e9b3dea4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116988, "uuid": "69e1c760-0dab-4d22-b802-818af718103b", "comment": "Malware payload (Mirai)", "value": "f4ca7411da937c952c93f08d0d61c7bf6aa9234692803426a9802ee1dac1c8a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116988, "uuid": "1b1f04fb-dd0b-4d12-b40a-23447886a4cd", "comment": "Malware payload (Mirai)", "value": "f4841b3cb0420c7998b4ac4d378fa3021c42c543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116988, "uuid": "d5b188cb-6438-4202-8417-c3b961c8c116", "comment": "Malware payload (Mirai)", "value": "9b2be931b86e407da89e50270e42e24c0b5d4c7851d4564852c67ec2e9f2e7dbe8776202b25260dd0eca1d528acd23c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116988, "uuid": "c971027f-8c14-4c56-910e-c8d639ff353f", "value": "T138C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116988, "uuid": "df2955fd-e7df-457e-994a-6bca30c149f9", "value": "1536:UiAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3M:U9FmSmviqS1Bs0+Nd6lAqktNMxSNbmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116988, "uuid": "cc3e6f69-115e-4e15-9df9-2a68469d902b", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116988, "uuid": "f2554a15-56c0-46c8-a03c-a4a6c020a8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116988, "uuid": "e968b3b3-63ca-4037-a390-d353c3ec5a78", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8333a96-0aa4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771183881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183881, "uuid": "77382f9a-ba29-41f1-983c-50ca4c088956", "comment": "Malware payload (Mirai)", "value": "b9eaf9adad81519688bff7977f38d05c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183881, "uuid": "07adb411-fc78-42d0-a273-b9f891e62ea7", "comment": "Malware payload (Mirai)", "value": "f6c7fecae7241b42ed82bc0109013da46fce46cae827954f8fd07ce0a9ba6759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183881, "uuid": "c87906ec-f4db-4926-aefb-f9b848429132", "comment": "Malware payload (Mirai)", "value": "bb9eb1565aeb95c655825fddf37c94451222f53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771183881, "uuid": "0a183b91-0d18-4cc1-a651-fa6df1943438", "comment": "Malware payload (Mirai)", "value": "a2e57f2dd9394bd5812ed3efce3d72c36336cfeeea77219a9c154c35e56f1cd4d062323afe9b7813eff426874a1b1d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183881, "uuid": "81cc2c44-5b23-4cea-9a68-a53b18306645", "value": "T1E6045B43EE890EDBC42BCDF046BF87AB19E755AB48D1E1F4487C8C1C799D28A45E3648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183881, "uuid": "74ee0cf4-b7ff-4700-81f6-5b50e72c81ee", "value": "3072:RIt6cu0mHf+bl1e4twsPkhgS1uISi2lUlIEgU9fmscxuYqX:2Q37xSi2lMIE1lcxuYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771183881, "uuid": "48bd0994-5235-41b8-aafe-4983103d399f", "value": 184892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771183881, "uuid": "da7f71cb-f1bc-441c-9316-e247439310f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771183881, "uuid": "f05c9fec-1eb5-4a4c-98ce-34436787a9e0", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdc436c-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193799, "uuid": "9db786ae-f86e-49fd-ae55-3ee7692c0d12", "comment": "Malware payload (Mirai)", "value": "0e9af598ca1a94c7123d460a07884092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193799, "uuid": "39e3bfc3-1c0d-4e6a-888c-ec8d0c455fca", "comment": "Malware payload (Mirai)", "value": "f71b9ccce705ae0f84546f6e8d9b66a5e98f96d4996f2c176fcea3773d256a7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193799, "uuid": "bb39b0b6-512b-42a8-846c-275e0f419686", "comment": "Malware payload (Mirai)", "value": "8622eee5dd4c4101b392998de9ee7280f38a1ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193799, "uuid": "5554979c-1341-41a4-aa71-f7c8848aea8e", "comment": "Malware payload (Mirai)", "value": "e12897bd0dbe524a226e3b03bdbe584f71171bd5c3306b9b5749f4747629150cee9230a4041b7782957047c78977a4b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193799, "uuid": "9bffb7d0-1a6a-424b-8e30-0194281dce9a", "value": "T1C233F153933B57FDFC2648B528A81540D83EA99F68C7079D2AC714BC4C2A2D2EF93B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193799, "uuid": "19193ed1-c36f-45ca-b07e-b9c285c4edb3", "value": "768:hlQEuWOnM8Io+/L88u5LjFETAvELh/8Dyr8IkHorc8/spNfFmEIq1gTRm7Wux0Xy:45h+/w8qLu8MkyaB8sLfFvIqKTR84y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193799, "uuid": "4e4c111f-09f4-421f-947b-63dfa290dd37", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193799, "uuid": "96ae5849-a030-4459-81ec-c369a115d05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193799, "uuid": "0ab0c531-0d0f-4f29-b11e-0406f6a51b49", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb48afd-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193792, "uuid": "55d5f2dd-4dfd-4218-ba91-684fba7f04bc", "comment": "Malware payload (Mirai)", "value": "bd9438eb738774d6754de666c802ecbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193792, "uuid": "8a93a64a-123e-484c-8774-035fe852c9f0", "comment": "Malware payload (Mirai)", "value": "f755025a23962299bf97f6f976b94856327a3d70046e3399ae08cf0b91a2d9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193792, "uuid": "ac277585-1c93-435a-83b5-02e5a46af325", "comment": "Malware payload (Mirai)", "value": "ce87178a3e11a77b7c7baa3fc4996b83e27269ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193792, "uuid": "f7f8b55a-8995-4ace-818c-860c8f73448f", "comment": "Malware payload (Mirai)", "value": "96a0b29ed2ffe28951d859bc93a1c623b656aee8f5469fc379fb111e117c80a22c3e7ba6221de4c9237b5b7796ff0949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193792, "uuid": "e1adba7f-24f1-4f4b-8300-c9e558d9cf00", "value": "T19504D706AF520FBBD86BDD7302F90B0129CCA81726B53B753274E924F64A58B59D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193792, "uuid": "4d994156-1477-4b25-bf2f-4a3f43d76e35", "value": "1536:H5Y8Sx1Px4sN5ZTanXIJTFIHaxKBd13ldw7ALUj/xZreUGSRYeUq8oPDtsHoP74N:WTZT44DMLmPRkeDtCoj4oUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193792, "uuid": "c3992ba5-ff4b-44f8-8411-4211b7b65533", "value": 178932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193792, "uuid": "0f4ea686-49a8-4aaa-9c96-e19460606ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193792, "uuid": "3055054f-67b9-4604-9ddd-83fd9c61be39", "value": "israel.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4568e40-0aa9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771186022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771186022, "uuid": "c0f2cc26-360f-479f-b05e-17770accaacf", "comment": "Malware payload", "value": "59d52d256824628dd0a74d7e3c9aacf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771186022, "uuid": "d0a84f0d-79aa-48f4-a1b9-313a92ee144c", "comment": "Malware payload", "value": "f85fa6d136c46a60acfaf9b11265f602c998483aef7df93a00b456d0f3d81f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771186022, "uuid": "403d42d7-52b7-4c60-b748-ec06699ac670", "comment": "Malware payload", "value": "b59cf2d0fc52bbf96c8be0b99eeac88c0eecf1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771186022, "uuid": "b2128907-538d-4965-ae16-683b5d7f991c", "comment": "Malware payload", "value": "82ff8377489cbce62516a7bc9fb0f0708351b9e376cd4a42f20c348d9dbf5c8e274ee6eb9a1b04f66bb250e800562075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771186022, "uuid": "966086d8-7114-4fb7-854f-a1fe72a41d03", "value": "T1ED06331AE991BCA1E999C5F4A87217339E221664FD60252003F39C2B3D7F6F0D929D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771186022, "uuid": "9322fb3d-74fd-4379-b21b-5ad78406d04c", "value": "e4e7c560e86639269dcf5a60c8dbca8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771186022, "uuid": "788730e9-0a5d-41c3-b6bd-d6992ed79d8d", "value": "98304:5B4rnPaqYYDB2Ba7DBbVBCZrTM4KyHHH3Spyd0CcoPoj7T0Z4jTTQz:5B4ZnGaH7BC1TlKW+CcNPEiXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771186022, "uuid": "f878285f-4708-4882-af6c-f604d001c3ea", "value": 3956224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771186022, "uuid": "034c2aff-b21f-40ed-9bc7-77f6dc238e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771186022, "uuid": "90cb178a-4375-4919-8c36-cecdeef95266", "value": "builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff0af4-0a07-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771116448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116448, "uuid": "34332f09-28f1-41b8-aeb7-77a5bd94ffc7", "comment": "Malware payload (Mirai)", "value": "8cc52a7a3c121faa3a2ef79c39c02ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116448, "uuid": "2660fbe9-6706-4432-9fe3-fd98ca9515d7", "comment": "Malware payload (Mirai)", "value": "fa557bdb178dfa41e368db8ed91cc1443e6d97625e2fb68e59a4783db8eced9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116448, "uuid": "73dccf14-7b75-42dc-853b-671dfe1894c7", "comment": "Malware payload (Mirai)", "value": "0ba1191406feef2173673f4e6dd94d2590c03fae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771116448, "uuid": "8b6c9dd6-44ae-42ea-98d9-978b22969564", "comment": "Malware payload (Mirai)", "value": "b97fffd5c39def5577a1b3f4255001918631ba5c769ca36c67c4bbe093a997be0b5bfc61e9a3074f3e215ef495afe112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116448, "uuid": "b9ca7956-6739-46f0-b433-647f4aacb4bf", "value": "T116C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116448, "uuid": "71f40717-01fc-4d6f-8b3d-fe01ef9e9ae3", "value": "1536:6vB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dwJ:6tB4exMF7oZKJnCNYaOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771116448, "uuid": "4c4ba5b8-3df2-45f9-8e30-7dfebfc5c984", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771116448, "uuid": "1f2217e6-76d6-4c7a-80de-b0ecee9c515f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771116448, "uuid": "80259c96-0790-4ba5-9968-d91a085fa778", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026c3214-0a6e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771160302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160302, "uuid": "bdcf3bb0-23b7-4f29-a309-6666c4ca42f0", "comment": "Malware payload (Mirai)", "value": "8771a8e551d0ca98e63f0d28e674c55a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160302, "uuid": "e08180dc-27b5-4e12-8531-1a8f2b0e0e10", "comment": "Malware payload (Mirai)", "value": "fb0370e33aa63fab013fdfa4fde0c554bba86abb2aa17b7e671bce4b0d8ecce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160302, "uuid": "94aa3613-178c-4a32-a39a-1a5cd852259e", "comment": "Malware payload (Mirai)", "value": "2757543a5cc510986575374d7193257218e96298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771160302, "uuid": "1e8b361f-7a9f-4e2f-8fd7-3ede7963b995", "comment": "Malware payload (Mirai)", "value": "cf7736304f4b941b43f70f4184793e8fdb83350a115149bee901788eccd4ebda72dd0708219249820a3e8922a1d896d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160302, "uuid": "667ba392-5463-4b0d-9aee-144da558b866", "value": "T1D9F33B46A6405A23C1D21777FADF42463322DBA4D3DB73059928BBF43F8769E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160302, "uuid": "c6a208ac-d361-4f46-a1bd-c0536e6c0e7a", "value": "3072:7jGDiJp9Nss21M5B6HywadywW977OTuhCPPqKqOnzYWigZQM/9VpJS95:7uiJpUWBmfawwW977OKhw7YWigaM/9Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771160302, "uuid": "23f501b9-e107-46e7-959f-12a6c5d5824b", "value": 168370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771160302, "uuid": "123819bc-716d-4f27-980a-2d7f91ecc477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771160302, "uuid": "eacdebf8-e945-4782-a3be-1dd7f820a592", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21b6864-0abb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193776, "uuid": "09e0c178-ab81-4e65-aed1-efefab5b7f97", "comment": "Malware payload (Mirai)", "value": "f539591cbc5d9cd577fbf63cbf69f875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193776, "uuid": "150b2bf6-8500-427a-b748-3988f4b40995", "comment": "Malware payload (Mirai)", "value": "fcbda1751d659402fe547997e965b37f03880aedef267833d1d141885986a498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193776, "uuid": "79191a78-45d5-48f7-b41e-f628677094ff", "comment": "Malware payload (Mirai)", "value": "5807431d3b84057fc90f71d874842d9e19ee8f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193776, "uuid": "41f58578-926e-46fe-bcd8-0922d53c4684", "comment": "Malware payload (Mirai)", "value": "18c1054a2cf2b37af4b78ad8f6697919b59a0a0d4e4919e1a4f9bc1ccb26fe466c33424715d9fd630f0946cecaed334b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193776, "uuid": "b0829e74-6e31-4646-9cd3-a269ddedd5e0", "value": "T1A1F22903127D6517D4E8A63902F39757F2DA7A9CA054871F7E3A0ECBBA613D00F6A670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193776, "uuid": "fc0accff-5d41-4e7a-a6fd-59eb743723c4", "value": "768:vyQIH1RjyptP7ehBxXOIma2MIh34DqSM2/Sb8BfYPr:vyQIH1RjyptP7e/lO3LkB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193776, "uuid": "2e15ab61-9cf3-4347-8f2c-76f04a077519", "value": 34648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193776, "uuid": "4802df83-06c4-4e9f-933f-6f837928e949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193776, "uuid": "ce315f5f-b282-4c01-82f5-c048bfcc302d", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fb359b-0a57-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771150537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150537, "uuid": "9a720062-2ef1-42ef-9589-e18babeac728", "comment": "Malware payload (Grandoreiro)", "value": "bb5ab4261c5a5de152ebf3f313c34390", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150537, "uuid": "9cb0379a-9b21-47fc-a759-aaf26017e724", "comment": "Malware payload (Grandoreiro)", "value": "fcd0797814d305b2ee1184496ace8138c469013ba4c45d803b922b9f7081e046", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150537, "uuid": "5cfa6712-3a0c-4463-9eae-2d83cae19f91", "comment": "Malware payload (Grandoreiro)", "value": "bf9d899b25e46ea1433b027cec2f5baab8e8e7f9", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771150537, "uuid": "80e54d8e-756c-4261-a42c-25c01e3a2fe5", "comment": "Malware payload (Grandoreiro)", "value": "29869edb46f26e430df82f0c5fd1ea2a88b0e8aeb44082d62b65d690829969ba471faee0b1ea42cff0f43c9d277c8c4b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150537, "uuid": "2e315cc8-5c46-46eb-a04f-f38cd82f6ffe", "value": "T19C362332BAA15C97C9404BB1B43A7B363E3D714747CDE5CBF488E6476B46AC21A3D880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150537, "uuid": "7e94b746-764d-4c5d-8792-b59527ace359", "value": "49152:MmJBaq+HxmPhLNvw3mHyq4vQolixIEMDf+eQTrUtcY:hUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771150537, "uuid": "bc7aa359-84dd-4fc6-8391-054f3f517e7d", "value": 4890624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771150537, "uuid": "0258aac3-4cf6-40f7-a5bd-6a2485b9e273", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771150537, "uuid": "602a16a9-3018-4387-9951-19e24cd0cda7", "value": "Prvis04780EOKYOQKP_35711.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00892b94-0abc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771193800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193800, "uuid": "23541292-764c-46ae-8d19-8bc41b203ead", "comment": "Malware payload (Mirai)", "value": "fea45d96e6bcb1617ca6e8000a588b98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193800, "uuid": "36e03a5c-0709-4657-85ea-608165bfc82a", "comment": "Malware payload (Mirai)", "value": "ffd23c7ace5f6f9e6b9939bd521407694fd7a4c21e9065944130b92a6f0e2720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193800, "uuid": "a8a0e2c2-5bfc-4922-a8ba-a03528e3fd4c", "comment": "Malware payload (Mirai)", "value": "69073092182327cbc79364621c691883cb8a59a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771193800, "uuid": "73877c59-2279-4dda-9c18-4c37a149a99d", "comment": "Malware payload (Mirai)", "value": "a94bace894a0d0fbdc9bbd873f08d75618e0a56ef70002c409fbcd0009eab483bfb369caf802dd81e88a38a637e66c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193800, "uuid": "ec83828c-f66f-4518-b4b7-74e703f3bc41", "value": "T129D3E846BD418F13C5C321F7FBDE429C3A166F6DD6EA3202A925BFA037864D60E3A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193800, "uuid": "ca5e458a-5ab5-435a-bd81-72772acc534c", "value": "1536:c4Sq00q5Lr6qyHcvnqPbADHzTKSWAx0QP/Oj5szCX0z+GnlkGwywzPxP7CbA9r+T:c4Z00q5H6qyHcv6AHrWAxf3Y0CnAbT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771193800, "uuid": "d233eb5c-6d63-458f-a04a-5e1bb0974db6", "value": 130904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771193800, "uuid": "7726f703-7293-4260-ba5e-a24fcaebc392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771193800, "uuid": "e1575339-d3ae-4c37-a5c5-2f1c34514faa", "value": "israel.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94943cf-0a7e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771167588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167588, "uuid": "baf57ed1-a6f5-4e01-a8ba-c8a9f8955667", "comment": "Malware payload (Mirai)", "value": "c729a358c2e7814259bb171d4130abd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167588, "uuid": "2ff65370-d3f7-4c80-a43a-e7bf380344e5", "comment": "Malware payload (Mirai)", "value": "fff82053caa61c62742f955608e1f72cdef875aebb2996ade9f7b59cfdbe105b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167588, "uuid": "aad1f67c-3989-4ca1-bfd8-96f55930be61", "comment": "Malware payload (Mirai)", "value": "ce2cd23d6f3718107f5820492a9ff1a9f6698625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771167588, "uuid": "d377d783-93d4-4837-a38f-dc1ad89c1ee3", "comment": "Malware payload (Mirai)", "value": "e8d6e84792c34df0246b18d6e9d930eab5a462b1e7819925f8b47eaed8237aca9ac42966915d36effdfc807f97c7ed97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167588, "uuid": "802242ac-816d-4109-a105-c9d6bff51079", "value": "T14FA30807BB514EFBC8ABDD3356A91B0534DC950B22E96B363A70D428F54F18B4AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167588, "uuid": "af4b22cc-2a83-4770-abe1-3ec5ac799ae4", "value": "1536:ECP1jzxm3MOctWzYkJTvvE5c+u4ocF1F6lOvYA3F4ZD18YSplnzq6:Eo1jzuckzRnE5cA6lO93F4mLnzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771167588, "uuid": "2724bece-15a7-498d-a679-271e31aab9d8", "value": 105864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771167588, "uuid": "1b1739c4-3c00-4bbb-8bb1-f228ef053bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771167588, "uuid": "933deb1d-5445-4f37-bca5-c5c803aa09ae", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }